Code Pluginsource linked

@qverisai/qverisv2026.3.23

OpenClaw QVeris plugin — capability discovery, tool inspection, and tool calling

@qverisai/qveris·runtime qveris·by @qverisai
Community code plugin. Review compatibility and verification before install.
openclaw plugins install clawhub:@qverisai/qveris
Latest release: v2026.3.23Download zip

Compatibility

Built With Open Claw Version
2026.3.24
Min Gateway Version
>=2026.3.22
Plugin Api Range
>=2026.3.22
Security Scan
VirusTotalVirusTotal
stale
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The code, README, and plugin metadata all center on three QVeris tools: discover, inspect, and call. Network access to qveris.ai/qveris.cn, a QVeris API key, session IDs, caching, and optional result file materialization are consistent with that purpose.
Instruction Scope
The SKILL.md/README instructions stay within setup, configuration, verification, and troubleshooting for the QVeris plugin. They reference only the plugin's own OpenClaw config and QVERIS_API_KEY. The tool code sends discovery/call/inspect requests to the configured QVeris API and does not visibly collect unrelated local files or environment variables.
Install Mechanism
There is no separate install script, binary download, archive extraction, or arbitrary URL install mechanism. The package is an npm/OpenClaw plugin with one small runtime dependency, @sinclair/typebox. The registry summary says no install spec/instruction-only, but the bundle clearly contains plugin code; this looks like packaging metadata wording rather than suspicious behavior.
Credentials
The plugin uses a QVeris API key from plugin config or QVERIS_API_KEY, which is proportionate for a QVeris API integration. The top-level requirements summary says no env vars, while openclaw.plugin.json and the README disclose QVERIS_API_KEY; users should be aware an API key is needed even if the registry requirements section did not surface it.
Persistence & Privilege
The skill is not marked always-on, does not request broad system privileges, and only asks the user to enable its own plugin entry and allow its own qveris tools. Autonomous model invocation is the normal default for skills and is not a concern by itself.
Assessment
This appears internally coherent, but it is a broad integration: installing it lets your agent send tool queries and tool parameters to QVeris, and QVeris may route work to external services. Only use it if you trust QVeris with the data you ask the agent to process. Be careful with the optional baseUrl override, and only point it at endpoints you control or trust. If you enable full-content materialization, the plugin may download QVeris-provided result files into the workspace; treat those files as untrusted data.
src/qveris-tools.ts:114
File appears to expose a hardcoded API secret or token.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Verification

Tier
source linked
Scope
artifact only
Summary
Validated package structure and linked the release to source metadata.
Commit
14e4cc60dcaf
Tag
main
Provenance
No
Scan status
clean

Tags

latest
2026.3.23

QVeris Plugin for OpenClaw

npm version OpenClaw License: MIT TypeScript

OpenClaw plugin that gives agents dynamic capability discovery and tool calling via the QVeris API.

What it does

Three tools are registered into the agent's context once the plugin is loaded:

ToolDescription
qveris_discoverSearch for tools by natural language query (e.g. "weather", "currency exchange")
qveris_callExecute a discovered tool with parameters
qveris_inspectLook up detailed schema and examples for known tool IDs

The typical agent workflow is: qveris_discoverqveris_inspect (optional) → qveris_call.

Requirements

  • OpenClaw >= 2026.3.22
  • A QVeris API key — sign up at qveris.ai (global) or qveris.cn (China)

Installation

From npm

openclaw plugins install @qverisai/qveris

From local source (development)

# From the repo root
openclaw plugins install -l ./extensions/qveris

Configuration

Add the following to your openclaw.json:

{
  // 1. Allow the plugin and make its tools visible to the agent
  plugins: {
    allow: ["qveris"],
    entries: {
      qveris: {
        enabled: true,
        config: {
          apiKey: "qv-your-api-key-here",  // or use QVERIS_API_KEY env var
          region: "cn"                      // "global" (qveris.ai) or "cn" (qveris.cn)
        }
      }
    }
  },

  // 2. Add QVeris tools to the agent's tool allowlist
  tools: {
    alsoAllow: ["qveris"]
  }
}

Note: tools.alsoAllow is required. Without it, plugin tools are not passed to the LLM even though the plugin is loaded.

API key via environment variable

If you prefer not to store the key in the config file:

export QVERIS_API_KEY=qv-your-api-key-here

The plugin checks plugins.entries.qveris.config.apiKey first, then falls back to QVERIS_API_KEY.

Security: if no API key is found at startup, all three tools are silently omitted — no error is thrown.


Full configuration reference

All fields under plugins.entries.qveris.config:

FieldTypeDefaultDescription
apiKeystringQVeris API key. Sensitive — use env var QVERIS_API_KEY as alternative.
region"global" | "cn""global"API region. globalqveris.ai, cnqveris.cn.
baseUrlstring(derived from region)Override API base URL. Use only when pointing at a private/staging endpoint.
searchTimeoutSecondsnumber5Timeout for qveris_discover calls.
executeTimeoutSecondsnumber60Default timeout for qveris_call. Can be overridden per-call via the timeout_seconds parameter.
searchLimitnumber10Max number of tools returned by qveris_discover.
maxResponseSizenumber20480Max response body size in bytes before truncation.
autoMaterializeFullContentbooleanfalseWhen true, automatically download full-content files referenced in tool results to the agent workspace.
fullContentMaxBytesnumber10485760 (10 MB)Max size for full-content downloads.
fullContentTimeoutSecondsnumber30Timeout for full-content downloads.

Region and base URL

RegionAPI base URLFull-content download domain
globalhttps://qveris.ai/api/v1qveris.ai
cnhttps://qveris.cn/api/v1qveris.cn

Minimal vs full config examples

Minimal (global region, env var key)

export QVERIS_API_KEY=qv-...
{
  plugins: {
    allow: ["qveris"],
    entries: { qveris: { enabled: true } }
  },
  tools: { alsoAllow: ["qveris"] }
}

China region

{
  plugins: {
    allow: ["qveris"],
    entries: {
      qveris: {
        enabled: true,
        config: {
          apiKey: "qv-...",
          region: "cn"
        }
      }
    }
  },
  tools: { alsoAllow: ["qveris"] }
}

With full-content materialization enabled

{
  plugins: {
    allow: ["qveris"],
    entries: {
      qveris: {
        enabled: true,
        config: {
          apiKey: "qv-...",
          region: "global",
          autoMaterializeFullContent: true,
          fullContentMaxBytes: 20971520,    // 20 MB
          fullContentTimeoutSeconds: 60,
          executeTimeoutSeconds: 120         // for slow image/video generation tools
        }
      }
    }
  },
  tools: { alsoAllow: ["qveris"] }
}

Verification

After restarting the gateway, verify the plugin is loaded and tools are registered:

# Restart gateway
openclaw gateway restart

# Inspect plugin
openclaw plugins inspect qveris

Expected output should include:

Status: loaded
Tools:
qveris_discover, qveris_call, qveris_inspect

Troubleshooting

Tools not visible to the agent

Make sure tools.alsoAllow: ["qveris"] is set. Without this, plugin tools are excluded from the tool list sent to the LLM even if the plugin is loaded.

Plugin loaded but tools missing from plugins inspect

The API key is not configured. Check:

openclaw config get plugins.entries.qveris
# or
echo $QVERIS_API_KEY

plugin id mismatch warning on startup

Your npm package name must unscopе to match the plugin id qveris. The correct package name is @qverisai/qveris (not @qverisai/openclaw-qveris-plugin).

Cannot find module '@.../dist/plugin-sdk/root-alias.cjs/plugin-entry'

The OpenClaw host's dist/ is not built. Either:

  • Use the official openclaw npm package as the host, or
  • Run pnpm build in the OpenClaw fork before loading the plugin.

License

MIT