Tools
Olympus
By Ask your own life. Sovereign, cited answers from your entire digital world — an OpenClaw plugin.
Install
openclaw plugins install git:<owner>/<repo>Configuration Example
mcp_servers:
olympus:
command: <absolute-managed-plugin-root>/bin/olympus
args: [serve]
tools:
include: [source_answer, source_index_status]
prompts: false
resources: falseREADME
<div align="center">
# ⛰️ Olympus
**Your whole digital life, searchable by your AI — on your privacy terms.**
*A sovereignty-aware source brain for [OpenClaw](https://openclaw.ai) agents.*
[](CHANGELOG.md)
[](LICENSE)
[](CONTRIBUTING.md)
[](https://openclaw.ai)
[](https://bun.sh)
[Quickstart](docs/QUICKSTART.md) · [Release status](docs/V0_4_RELEASE.md) · [Source capabilities](docs/SOURCE_CAPABILITIES.md) · [How it works](#how-it-works) ·
[Sources](#supported-sources) · [Security model](#the-security-model) ·
[Commands](#command-reference)
</div>
---
> **🤖 Installing this as an AI agent?** Stop and read
> **[INSTALL_FOR_AGENTS.md](INSTALL_FOR_AGENTS.md)** before running any
> command — it is the step-by-step runbook you must follow, including
> exactly what to tell your operator after each step (your install report
> must end with the Step 1→2 invitation, never a bare status line). Managed
> `git:`, `clawhub:`, and `npm-pack:` installs intentionally hide their internal
> package path; use the installed `olympus` CLI and this packaged runbook rather
> than searching OpenClaw's managed storage.
---
Personal AI becomes genuinely useful when it can reason across your whole
life — email, messages, files, notes, reading. It becomes **trustworthy**
when *you* decide which models are allowed to see which parts of it.
Olympus is both. It ingests your sources into local, trust-tiered indexes,
then lets your frontier agent answer questions across all of them — with
sensitive material handled only by lanes you approved: your own local models,
privacy-approved private cloud inference, or not at all.
```text
you › "What did I commit to this week, across email and Telegram?"
agent › Three commitments: the tax documents to Maria by Friday
(email, Tue), reviewing the lease amendment (email, Mon),
and the Saturday ride logistics (Telegram, Wed). [3 citations]
```
Your agent saw a bounded, cited, policy-gated answer. It never saw your
mailbox.
## How it works
Every item you ingest is classified as public, private, secure, or secrets
(internally S0-S5), and every tier
routes only to the model lanes your sovereignty policy allows:
```mermaid
flowchart LR
subgraph sources["Your sources"]
direction TB
SRC1[Gmail · Drive · Dropbox]
SRC2[Telegram · WhatsApp · X]
end
subgraph olympus["Olympus (local)"]
direction TB
ING[Ingest & classify<br/>every item, locally]
IDX[(Trust-tiered<br/>local indexes)]
POL{{Sovereignty policy<br/>your rules, enforced}}
ING --> IDX --> POL
end
subgraph lanes["Model lanes you approved"]
direction TB
CLOUD[Frontier cloud<br/>everyday content]
PRIVATE[Venice Private cloud<br/>secure content when routed]
LOCAL[Your local models<br/>secure content]
end
AGENT[Your agent<br/>cited, bounded answers]
sources --> ING
POL --> CLOUD & PRIVATE & LOCAL
CLOUD & PRIVATE & LOCAL --> AGENT
```
Four postures, chosen (and changeable) in setup — a config file, not a code
fork:
| Preset | Public/private content | Secure content: health, finance, legal, therapy, family |
|---|---|---|
| **Local models and private cloud** (`local-first`) | frontier cloud | approved secure pool with explicit local → [Venice](https://venice.ai) Private order |
| **Local models only** (`local-only`) | frontier cloud | your own local models only |
| **Private cloud only** (`private-cloud-only`) | frontier cloud | [Venice](https://venice.ai) Private model (`kimi-k3`) |
| **Do not add secure data to Olympus** (`no-sensitive`) | frontier cloud | **not ingested** — reported as an honest gap |
Some rules are not configurable, by design: secure content never routes to
ordinary cloud models, secrets are denied to every lane, and an
exhausted policy chain refuses rather than silently downgrading.
## Get started
**You need** OpenClaw `2026.7.1+` on a Node release OpenClaw itself supports
(`>=22.22.3 <23`, `>=24.15.0 <25`, or `>=25.9.0` — its installer refuses any
other), plus [Bun](https://bun.sh) `1.2+`. macOS or Linux.
Let your agent do the install. Paste this into any agent with a terminal
(OpenClaw, Claude Code, Codex), with `<owner>/<repo>` replaced by the Olympus
repository you were given:
> Install this plugin: `openclaw plugins install git:<owner>/<repo> --accept-capabilities`
> If OpenClaw rejects `--accept-capabilities` as an unknown option (it is
> OpenClaw 2026.7.1), run the same command again without that flag.
> Then read INSTALL_FOR_AGENTS.md inside the installed plugin folder and
> follow it step by step — it is the install guide, not reference material.
The repository is the install source during the pilot.
`openclaw plugins install clawhub:olympus` becomes the one-line public path
once Olympus is published to ClawHub, which happens **after** the pilot. The
`npm-pack:` tarball path is the maintainer's release-proof mechanism, not a
pilot instruction — see [docs/V0_4_RELEASE.md](docs/V0_4_RELEASE.md).
`--accept-capabilities` is required by OpenClaw `2026.8.1+`: an agent-driven
install is non-TTY, and without the flag the host exits 1 asking for capability
consent it cannot prompt for. Omit the flag on `2026.7.1`, which does not
define it.
The agent checks prerequisites, installs the plugin, helps you describe your
data as a sensitivity map, asks for your privacy posture, connects your keys
without logging them, and verifies the install end to end. About ten minutes
plus OAuth clicks.
Prefer to drive it yourself? The same flow, by hand:
```bash
openclaw plugins install git:<owner>/<repo> --accept-capabilities
# ^ on OpenClaw 2026.7.1 the flag is unknown: re-run without it
openclaw plugins enable olympus
olympus setup --preset private-cloud-only --cloud-lane subscription --yes
olympus worker install
olympus worker status
olympus connect google --client-id <google-oauth-client-id>
printf '%s' "$VENICE_API_KEY" | olympus connect venice --api-key-stdin
openclaw config validate
openclaw doctor --lint
openclaw gateway restart
olympus dashboard
```
Full walkthrough with what to expect at each step:
**[docs/QUICKSTART.md](docs/QUICKSTART.md)** — about ten minutes.
## Supported sources
| Source | Connect flow | Notes |
|---|---|---|
| Gmail | browser OAuth | one account in v0.4 |
| Google Drive | browser OAuth | docs + files |
| Dropbox | browser OAuth | full file spine: metadata, extraction, OCR |
| Telegram | guided phone login | forward sync of active chats |
| WhatsApp | QR pairing | live bridge |
| X bookmarks | browser OAuth with a user-owned developer app | folder provenance and provider cost ceilings |
| Readwise | API key | optional |
Model-lane credentials such as Venice are security-preset prerequisites, not
source connectors. Domain-agent imports and other source families are outside
the v0.4 public roster.
Tokens live in an encrypted local secret store by default, or in an explicitly
configured OS/1Password secret store when supported, never in plain text.
Ingestion, classification, and indexing all run in one supervised local
worker — `olympus worker install` makes it start on login. All seven declared
sources sync through the canonical connector-store runtime; v0.4 supports one
connected account per provider. Dashboard onboarding now presents one explicit
seven-stage journey from security preset through cited-answer readiness, with
the next supported action on every blocked or degraded source. Clean-install
and real-provider qualification remain Slice 4 work, not alternate ingestion
paths.
On an existing live OpenClaw install, treat plugin install/enable, gateway
restart, worker service changes, and plugin refresh as live-system changes:
validate with `openclaw config validate` and `openclaw doctor --lint`, then
restart only through `openclaw gateway restart` or the documented ops refresh
script. The repo docs and commands should never require raw edits to
OpenClaw runtime config.
## The security model
Olympus is built on the assumption that the boundary *is* the product:
- **Local-first ingestion.** Raw source content lands in local SQLite
indexes before any model sees anything. Classification happens at home.
- **Sanitized handoffs.** Agents receive answer text, citations, and audit
counts — typed wire shapes with `raw_source_exposed: false`, re-validated
client-side. Raw documents, embeddings, cursors, and tokens never cross.
- **A hard membrane.** Any evidence pack containing sensitive material is
barred from standard cloud lanes by two independent checks — policy
validation at config load, and a runtime re-check on every request.
- **Fail closed, everywhere.** No approved lane for a tier means a refusal
with an honest error — never a silent fallback to a less-trusted model.
- **Authenticated by default.** The worker binds loopback with bearer-token
auth on every route; new installs generate the token during setup. Browser
controls exchange it for a short-lived HttpOnly local session protected by
same-origin and CSRF checks; the bearer is never stored by the page.
- **A real exit.** `olympus data export` gives you your data;
`olympus data delete --all` verifiably removes indexes, embeddings,
configs, tokens, and service units.
The onboarding flow, end to end:
```mermaid
flowchart LR
A[Install<br/>plugin] --> B[olympus setup<br/>pick your posture]
B --> C[olympus connect<br/>OAuth IDs · session paths · API-key stdin]
C --> D[Dashboard<br/>watch it ingest]
D --> E[Ask your agent<br/>cited answers]
```
## Command reference
| Command | What it does |
|---|---|
| `olympus setup
... (truncated)
tools
Comments
Sign in to leave a comment