Plugin Aport Oap

Name: Plugin Aport Oap
Rating: 3.5 (1 reviews)
Author: aporthq

By aporthq 👁 79 views ▲ 0 votes

APort Open Agent Protocol (OAP) for OpenClaw — pre-action authorization plugin

Homepage GitHub

Install

openclaw plugins install @aporthq/openclaw-plugin-aport-oap

Configuration Example

{
  "plugins": {
    "entries": {
      "aport-oap": {
        "mode": "audit",
        "policyFile": "./agent-passport.yaml"
      }
    }
  }
}

README

# openclaw-plugin-aport-oap

**APort Open Agent Protocol (OAP) for OpenClaw**

Pre-action authorization for AI agents. Enforces YAML capability manifests before tool calls via the [Open Agent Protocol (OAP)](https://aport.io).

[![npm](https://img.shields.io/npm/v/@aporthq/openclaw-plugin-aport-oap.svg)](https://www.npmjs.com/package/@aporthq/openclaw-plugin-aport-oap)
[![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
[![OpenClaw](https://img.shields.io/badge/OpenClaw-%3E%3D2026.2.0-blue.svg)](https://openclaw.ai)

---

## What it does

This plugin gives your OpenClaw agent two tools:

| Tool | Description |
|------|-------------|
| `aport_check` | Validate a planned tool call against your OAP capability manifest **before** executing it |
| `aport_passport` | Read or generate an `agent-passport.yaml` for the current session |

Optional enforcement mode: set `mode: "enforce"` to register a `before_tool_call` hook that **automatically blocks** any tool call not in your policy — the agent cannot bypass it.

---

## Install

```bash
openclaw plugins install @aporthq/openclaw-plugin-aport-oap
```

---

## Quick Start

See [docs/quick-start.md](docs/quick-start.md) for the full guide.

**TL;DR:**

1. Install the plugin
2. Ask your agent: *"Generate an agent passport for this session."*
3. Edit `./agent-passport.yaml` to list exactly what tools this agent may call
4. The agent will use `aport_check` before executing sensitive operations

---

## How it works

```
Agent plans a tool call
        ↓
aport_check({ tool_name: "exec", params: {...} })
        ↓
Policy evaluator reads agent-passport.yaml
        ↓
{ allowed: true/false, reason: "...", policy_applied: "local-yaml", decision_id: "..." }
        ↓
Agent proceeds (or stops if not allowed)
```

In `enforce` mode, the `before_tool_call` hook does this automatically — no explicit `aport_check` call needed.

---

## Configuration

```json
{
  "plugins": {
    "entries": {
      "aport-oap": {
        "mode": "audit",
        "policyFile": "./agent-passport.yaml"
      }
    }
  }
}
```

| Key | Values | Default |
|-----|--------|---------|
| `mode` | `audit` \| `enforce` | `audit` |
| `policyFile` | path | `./agent-passport.yaml` |
| `passportId` | APort passport ID | — |
| `apiUrl` | URL | `https://api.aport.io` |
| `apiKey` | string | `$APORT_API_KEY` |
| `auditLog` | JSONL path | — |

---

## Related

- **[aport-agent-guardrails](https://github.com/aporthq/aport-agent-guardrails)** — Core OAP library with `before_tool_call` enforcement, bash evaluator, and framework adapters
- **OAP Spec** — DOI: [10.5281/zenodo.18901596](https://doi.org/10.5281/zenodo.18901596)
- **[aport.io](https://aport.io)** — Hosted passports, Global Suspend, dashboard

---

## License

Apache 2.0 — see [LICENSE](LICENSE)

tools