Code Pluginsource linked

ClawLinkv0.3.11

Connect 1,000+ apps (Gmail, Slack, GitHub, Calendar, Notion, and more) to OpenClaw via ClawLink. One skill, 39,000+ tools, managed OAuth.

clawlink-plugin·runtime clawlink-plugin·by @hith3sh
Community code plugin. Review compatibility and verification before install.
openclaw plugins install clawhub:clawlink-plugin
Latest release: v0.3.11Download zip

Compatibility

Built With Open Claw Version
2026.4.5
Min Gateway Version
2026.3.13
Plugin Api Range
>=2026.3.13
Plugin Sdk Version
2026.4.5
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Credentials
Requests target the disclosed ClawLink HTTPS endpoint. Shell uploads are limited to user-attached or task-created files with consent; no broad local indexing or unrelated credential collection was found.
✓
Install Mechanism
The package declares a plain JavaScript plugin, one dependency, and no install scripts. Package identities match the publisher’s [verification page](https://claw-link.dev/verify).
✓
Instruction Scope
Instructions restrict use to the current external-app request, require previews before writes, and require approval for destructive, high-impact, broad, or ambiguous changes.
ℹ
Persistence & Privilege
Pairing persists a device credential in OpenClaw configuration, with a local logout command. No background worker is started. High-impact confirmation enforcement depends on the hosted service; the plugin forwards confirmation only when supplied.
✓
Purpose & Capability
Reading and changing connected apps matches the advertised integration service. Provider credential storage, request routing, and server-side result storage are disclosed.
Scan Findings in Context
[EA2] expected: The advisory concern is not supported by the full artifact: the quoted instruction avoids requesting separate app credentials. The execution workflow explicitly requires user approval for high-impact actions and prohibits setting confirmed:true independently.
Assessment
Install if you trust ClawLink to hold connected-app credentials and process app data, results, and approved uploads. Connect only intended accounts and review the exact action before approving high-impact changes. Local logout removes the saved device credential; it does not delete provider credentials held by ClawLink.

Verification

Tier
source linked
Scope
artifact only
Summary
Validated package structure and linked the release to source metadata.
Commit
8662a6005bca
Tag
openclaw-plugin-v0.3.11
Provenance
No
Scan status
clean

Tags

latest
0.3.11

ClawLink OpenClaw Plugin

ClawLink

Connect 1,000+ apps (Gmail, Slack, GitHub, Calendar, Notion, and more) to OpenClaw via ClawLink.

One skill, 39,000+ tools, managed OAuth.

Use when the user asks to send emails, create issues, post messages, manage calendars, search documents, and more.

Not affiliated with OpenClaw. ClawLink is an independent service. This package is published by the ClawLink team under the npm scope @useclawlink. The published tarball is the source: run npm pack @useclawlink/openclaw-plugin and read package/index.js, which is plain unminified JavaScript. License: AGPL-3.0.

Setup in 3 Steps

Step 1: InstallStep 2: Pair AccountStep 3: Connect Any App
InstallPairConnect
Run the install command in OpenClawSign in and approve the deviceOpen the dashboard and connect an app

How It Works

┌─────────────────┐     ┌──────────────┐     ┌──────────────────┐
│   OpenClaw      │────▶│   ClawLink   │────▶│ 1,000+ SaaS Apps │
│   (User Chat)   │     │   (OAuth)    │     │ (Gmail, Slack...)│
└─────────────────┘     └──────────────┘     └──────────────────┘
         │                       │                       │
         │  1. Install Plugin    │                       │
         │  2. Pair Device       │                       │
         │  3. Connect Any App   │                       │
         │                       │  4. Secure Token      │
         │                       │  5. Proxy Requests    │
         │                       │                       │
         ▼                       ▼                       ▼
   ┌──────────┐           ┌──────────┐           ┌──────────┐
   │  Plugin  │           │ Dashboard│           │ Provider │
   │  README  │           │ Auth     │           │  Data    │
   └──────────┘           └──────────┘           └──────────┘

What it does

ClawLink stores provider OAuth tokens and API credentials on ClawLink servers, encrypted at rest, for a growing catalog of business apps on your behalf. It then exposes a uniform set of tools so OpenClaw can read from and write to those apps without per-provider setup. Today that includes integrations like Google Docs, Google Sheets, Google Calendar, Google Drive, Twilio, and Google Search Console. Setup is browser pairing: OpenClaw opens a ClawLink approval page, you approve the device once, then return to chat and send done so the plugin can store its local ClawLink device credential safely.

Install

openclaw plugins install clawhub:clawlink-plugin

Or directly from npm:

openclaw plugins install @useclawlink/openclaw-plugin

Configure

  1. In OpenClaw, start browser pairing:
    • let the assistant call clawlink_begin_pairing
    • you do not need to restart the Gateway: the install applies to the running Gateway
    • if the tools are not visible, your tool profile may hide plugin tools: the OpenClaw owner adds clawlink-plugin to tools.alsoAllow (on OpenClaw before 2.0, start a new chat with /new)
    • if the tools still do not show, email hello@claw-link.dev
  2. Open the returned ClawLink pairing URL in your browser and approve the device.
  3. Go back to OpenClaw and send done.
  4. Let the assistant call clawlink_get_pairing_status to finish storing the local credential.

The resulting device credential is stored locally in ~/.openclaw/openclaw.json under plugins.entries.clawlink-plugin.config.apiKey and is only sent to claw-link.dev.

Full setup walkthrough: https://docs.claw-link.dev/openclaw

Tools

The plugin registers eleven tools. OpenClaw's assistant discovers available integrations dynamically — you don't need to configure individual apps here.

  • clawlink_begin_pairing — start or resume browser pairing for this OpenClaw install
  • clawlink_get_pairing_status — finish pairing after the user returns from the browser and says done
  • clawlink_start_connection — start a hosted OAuth/connect session for a new app
  • clawlink_get_connection_status — poll an in-progress connect session
  • clawlink_list_integrations — list apps already connected
  • clawlink_list_tools — list callable tools for one connected app
  • clawlink_search_tools — search connected tools by capability or keyword
  • clawlink_describe_tool — fetch schema and usage guidance for one tool
  • clawlink_preview_tool — preview a tool call before execution, especially for writes
  • clawlink_call_tool — execute a tool against a connected app
  • clawlink_get_result — read a large stored result in slices (path / fields / offset / limit / count)

Support Commands

Normal onboarding should happen through tools and browser pairing. These commands remain as support/debug escape hatches:

  • /clawlink pair [deviceLabel] — start or resume browser pairing from the plugin fast path
  • /clawlink pair-status — check whether browser pairing has been approved yet and finish setup after browser approval
  • /clawlink status — show whether the plugin is paired
  • /clawlink logout — remove the saved credential

Security

  • ClawHub package: clawlink-plugin
  • npm package: @useclawlink/openclaw-plugin
  • ClawHub releases carry source-linked release metadata, and ClawHub shows its own security audit and VirusTotal result on the listing.
  • The published tarball is the source: npm pack @useclawlink/openclaw-plugin and read package/index.js.
  • The plugin only makes outbound HTTPS requests to https://claw-link.dev.
  • Browser pairing stores only a local ClawLink device credential under ~/.openclaw/openclaw.json.
  • Provider tokens and API keys are not written to OpenClaw config or shown to the assistant; they stay on ClawLink servers encrypted at rest.
  • The local device credential is sent only as the X-ClawLink-API-Key header to ClawLink.
  • Report security issues to security@claw-link.dev.

Powered by ClawLink — an integration hub for OpenClaw

ClawLink Logo