OpenClaw Gateway - ProvenLog

Connect to the OpenClaw Gateway WebSocket and capture all agent events into a tamper-evident audit trail.

Setup

plog openclaw --gateway ws://127.0.0.1:18789

How it works

The observer connects to the OpenClaw Gateway WebSocket and captures all agent events — tool calls, LLM responses, lifecycle transitions — into the ProvenLog audit trail. Auth tokens are auto-discovered from ~/.openclaw/openclaw.json.

What gets captured

Event	Action Type	Details
Tool calls	`TOOL_CALL` / `TOOL_RESULT`	Tool name, inputs, outputs
LLM responses	`LLM_CALL` / `LLM_RESPONSE`	Model, content, token usage
Lifecycle events	`CUSTOM`	Agent start, stop, state transitions

Configuration

plog openclaw --gateway ws://127.0.0.1:18789   # Custom gateway URL
plog openclaw --db /tmp/openclaw-audit.db       # Custom database path
plog openclaw --server http://localhost:7600    # Send to server instead