Claw Wrap

claw-wrap Plugin

Secure credential proxy for CLI tools — credentials never enter the sandbox.

Commands

Daemon

• claw-wrap daemon start — Start the claw-wrap daemon

Admin

• claw-wrap tool list — List configured tools
• claw-wrap tool check — Verify credentials

Usage Examples

• "Set up gh CLI with secure credentials"
• "Run AWS CLI in sandbox without exposing keys"
• "Block dangerous commands like repo delete"

Installation

brew install dedene/tap/claw-wrap

Or from source:

git clone https://github.com/dedene/claw-wrap.git
cd claw-wrap
make build
sudo make install

Examples

# Store token in pass
pass insert cli/github/token

# Configure /etc/openclaw/wrappers.yaml
# tools:
#   gh:
#     binary: /usr/local/bin/gh
#     env:
#       GH_TOKEN: github-token

# Start daemon
claw-wrap daemon

# List tools
claw-wrap list
claw-wrap check

Key Features

• CLI wrapper mode for CLI tools
• HTTP proxy mode for APIs
• Multiple credential backends (pass, 1Password, Vault, etc.)
• Block dangerous commands server-side
• Output redaction
• HMAC authentication