Code Pluginsource linked

Opikv0.2.17

OpenClaw Opik exporter — sends LLM traces to Opik

@opik/opik-openclaw·runtime opik-openclaw·by @opik
Community code plugin. Review compatibility and verification before install.
openclaw plugins install clawhub:@opik/opik-openclaw
Latest release: v0.2.17Download zip

Compatibility

Built With Open Claw Version
2026.3.2
Min Gateway Version
2026.3.2
Plugin Api Range
>=2026.3.2
Plugin Sdk Version
2026.3.2
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The package purpose, manifest, README, and code consistently describe an Opik observability exporter for OpenClaw traces, including prompts, responses, tool calls, metadata, usage, and errors.
!
Instruction Scope
The configure flow enables conversation access and the runtime hooks collect broad prompt, history, tool input/output, error, session, account, and subagent metadata; this is purpose-aligned but very broad and lacks granular scoping controls.
Install Mechanism
The package is a normal npm/OpenClaw plugin with no hidden install script observed, but the manifest activates on startup and the configure command writes a persistent enabled plugin entry with API credentials and conversation access.
!
Credentials
Network export to Opik is expected, but attachment uploads are enabled in code and can read/upload explicit local media paths found in prompts, messages, or tool payloads without a clear allowlist, per-upload approval, or documented disable switch.
Persistence & Privilege
No OS-level persistence or privilege escalation was found; persistence is limited to OpenClaw plugin configuration, stored API key, registered hooks, in-memory trace state, and cleanup/flush activity while the gateway runs.
Scan Findings in Context
[SDI-2] expected: External Opik client initialization and trace export are the plugin's stated purpose, so this is not evidence of maliciousness by itself, but it confirms high-sensitivity data leaves the host when enabled.
[SDI-2] unexpected: Uploading local files discovered from payload-derived media paths is not clearly disclosed or separately user-controlled, and this artifact-backed behavior is the main reason for Review.
[SQP-2] expected: The README does disclose trace export of prompts, responses, tools, and metadata, but it lacks a prominent privacy warning and does not adequately explain attachment upload and sanitization limits.
[suspicious.exposed_secret_literal] unexpected: The static scan appears to be a false positive: the flagged apiKey code parses a user-provided config field rather than embedding a hardcoded secret.
What to consider before installing
Install only if you are comfortable sending OpenClaw prompts, responses, tool inputs/outputs, errors, identifiers, and possible referenced media files to your configured Opik backend. Avoid using it on sensitive or regulated conversations unless you have reviewed Opik retention/access controls and can contain what data appears in prompts, tool results, and local media links.
dist/src/types.js:31
File appears to expose a hardcoded API secret or token.
src/types.ts:53
File appears to expose a hardcoded API secret or token.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Verification

Tier
source linked
Scope
artifact only
Summary
Validated package structure and linked the release to source metadata.
Commit
fac4cc3f0fa9
Tag
refs/tags/v0.2.17
Provenance
No
Scan status
clean

Tags

latest
0.2.17
<h1 align="center" style="border-bottom: none"> <div> <a href="https://www.comet.com/site/products/opik/?from=llm&utm_source=opik&utm_medium=github&utm_content=header_img&utm_campaign=opik"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/comet-ml/opik/refs/heads/main/apps/opik-documentation/documentation/static/img/logo-dark-mode.svg"> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/comet-ml/opik/refs/heads/main/apps/opik-documentation/documentation/static/img/opik-logo.svg"> <img alt="Comet Opik logo" src="https://raw.githubusercontent.com/comet-ml/opik/refs/heads/main/apps/opik-documentation/documentation/static/img/opik-logo.svg" width="200" /> </picture> </a> <br /> 🔭 OpenClaw Opik Observability Plugin </div> </h1> <p align="center"> Official plugin for <a href="https://github.com/openclaw/openclaw">OpenClaw</a> that exports agent traces to <br/> <a href="https://www.comet.com/docs/opik/">Opik</a> for observability and monitoring. </p> <div align="center">

License npm version

<img src="screenshot.png" alt="Openclaw on Opik Demo"/> </div>

Why This Plugin

Opik is a leading open-source LLM and agent observability, tracing, evaluation and optimization platform. @opik/opik-openclaw adds native Opik tracing for OpenClaw runs:

  • LLM request/response spans
  • Sub-agent request/response spans
  • Tool call spans with inputs, outputs, and errors
  • Run-level finalize metadata
  • Usage and cost metadata

The plugin runs inside the OpenClaw Gateway process. If your gateway is remote, install and configure the plugin on that host.

Install and first run

Prerequisites:

  • OpenClaw >=2026.3.2
  • Node.js >=22.12.0
  • npm >=10

1. Install the plugin in OpenClaw

openclaw plugins install clawhub:@opik/opik-openclaw

And for older version of OpenClaw <2023.3.23 you can install the npm package using:

openclaw plugins install @opik/opik-openclaw

If the Gateway is already running, restart it after install.

2. Configure the plugin

openclaw opik configure

The setup wizard validates endpoint and credentials, then writes config under plugins.entries.opik-openclaw. If you choose Opik Cloud and do not have an account yet, the wizard now points you to the free signup flow before asking for an API key.

3. Check effective settings

openclaw opik status

4. Send a test message

openclaw gateway run
openclaw message send "hello from openclaw"

Then confirm traces in your Opik project.

Configuration

Recommended config shape

{
  "plugins": {
    "entries": {
      "opik-openclaw": {
        "enabled": true,
        "hooks": {
          "allowConversationAccess": true
        },
        "config": {
          // base configuration
          "enabled": true,
          "apiKey": "your-api-key",
          "apiUrl": "https://www.comet.com/opik/api",
          "projectName": "openclaw",
          "workspaceName": "default",
          // optional advanced configuration
          "tags": ["openclaw"],
          "toolResultPersistSanitizeEnabled": false,
          "staleTraceCleanupEnabled": true,
          "staleTraceTimeoutMs": 300000,
          "staleSweepIntervalMs": 60000,
          "flushRetryCount": 2,
          "flushRetryBaseDelayMs": 250
        }
      }
    }
  }
}

Plugin trust allowlist

OpenClaw warns when plugins.allow is empty and a community plugin is discovered. Pin trusted plugins explicitly:

{
  "plugins": {
    "allow": ["opik-openclaw"]
  }
}

Because Opik traces LLM prompts, responses, tools, and agent finalization events, non-bundled installs also need explicit conversation hook access:

{
  "plugins": {
    "entries": {
      "opik-openclaw": {
        "hooks": {
          "allowConversationAccess": true
        }
      }
    }
  }
}

Environment fallbacks

  • OPIK_API_KEY
  • OPIK_URL_OVERRIDE
  • OPIK_PROJECT_NAME
  • OPIK_WORKSPACE

Transcript safety default

toolResultPersistSanitizeEnabled is disabled by default. When enabled, the plugin rewrites local image refs in persisted tool transcript messages via tool_result_persist.

CLI commands

CommandDescription
openclaw plugins install @opik/opik-openclawInstall plugin package
openclaw opik configureInteractive setup wizard
openclaw opik statusPrint effective Opik configuration

Event mapping

OpenClaw eventOpik entityNotes
llm_inputtrace + llm spanstarts trace and llm span
llm_outputllm span update/endwrites usage/output and closes span
before_tool_calltool span startcaptures tool name + input
after_tool_calltool span update/endcaptures output/error + duration
subagent_spawningsubagent span startstarts subagent lifecycle span on requester trace
subagent_spawnedsubagent span updateenriches subagent span with run metadata
subagent_endedsubagent span update/endfinalizes subagent span with outcome/error
agent_endtrace finalizecloses pending spans and trace

Known limitation

No OpenClaw core changes are included in this repository and relies on native hooks within the OpenClaw ecosystem.

Development

Prerequisites:

  • Node.js >=22.12.0
  • npm >=10
npm ci
npm run build
npm run lint
npm run typecheck
npm run test
npm run smoke

Packaging

The package publishes built JavaScript for installed OpenClaw runtime loads while keeping TypeScript source metadata for development and older OpenClaw fallback loads. openclaw.extensions points at ./index.ts; openclaw.runtimeExtensions points at ./dist/index.js. ClawHub also requires explicit openclaw.compat.pluginApi and openclaw.build.openclawVersion metadata. npm pack and npm publish run npm run build through prepack, and npm run pack:check verifies the tarball contract. Pull requests also dry-run the ClawHub package publish workflow, and GitHub releases publish the validated package to both npm and ClawHub.

Optional live gateway E2E:

npm run test:live

Notes:

  • uses an isolated .artifacts/live-e2e/<run-id>/home/.openclaw so it does not touch your normal OpenClaw config
  • OPIK_API_KEY, OPIK_URL_OVERRIDE, OPIK_PROJECT_NAME, and OPIK_WORKSPACE win if set in env
  • otherwise it reuses ~/.openclaw/openclaw.json -> plugins.entries.opik-openclaw.config for apiUrl / apiKey / project / workspace
  • set OPENCLAW_LIVE_USE_HOST_OPIK_CONFIG=0 to disable reading host plugin config and require explicit env-only Opik settings
  • still requires OPENAI_API_KEY in env for the real model call
  • packs and installs the current plugin build into a fresh OpenClaw home
  • falls back to npx openclaw@${OPENCLAW_LIVE_OPENCLAW_VERSION:-latest} when openclaw is not already on your PATH
  • override the live model with OPENCLAW_LIVE_MODEL if gpt-4o-mini is not what you want to exercise

Contributing

Read CONTRIBUTING.md before opening a PR.

License

Apache-2.0