// SCAN REPORT

OpenClaw

129 tools. 92 can modify or destroy data without limits.

3 destructive tools with no built-in limits. Policy required.

Last updated: 3 Sept 2026

92 can modify or destroy data

37 read-only

129 tools total

Verified publisher · catalogue entry checked 06/06/2026

How to control OpenClaw ↓

TOOL MAP

What OpenClaw exposes to your agents

Read (37) Write / Execute (76) Destructive / Financial (3)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous OpenClaw tools

Destructive · High drop The tool removes or deletes a policy, which is an irreversible action that cannot be undone. Destructive · High reset Resetting config/state permanently removes or overwrites locally stored configuration and state data. Destructive · High uninstall This tool performs irreversible deletion of the gateway service and local data. Execute · High action The tool performs operational state changes (start, pause, resume, block, complete, clear) on what appear to be agents or tasks.

92 of OpenClaw's 129 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control OpenClaw

PolicyLayer is an MCP gateway — it sits between your AI agents and OpenClaw, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "drop": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "activation": {
    "limits": [
      {
        "counter": "activation_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "ask": {
    "limits": [
      {
        "counter": "ask_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register OpenClaw — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON OPENCLAW →

Instant setup, no code required.

FULL CATALOGUE

All 129 OpenClaw tools

DESTRUCTIVE 3 tools

Destructive drop drop policy Destructive reset Reset local config/state (keeps the CLI installed) Destructive uninstall Uninstall the gateway service + local data (CLI remains)

EXECUTE 35 tools

Execute abort Abort active run Execute acp Run and manage ACP-backed coding agents Execute action status, start, pause, resume, complete, block, clear Execute agent Run one agent turn via the Gateway Execute auth Run provider auth/login flow Execute bash Run a host command (if enabled). Execute browser Manage OpenClaw Execute capability Run provider capability commands (fallback alias: infer) Execute chat Open a local terminal UI (alias for tui --local) Execute command Shell command Execute completion Generate shell completion script Execute crestodian Open the interactive setup and repair assistant Execute cron Schedule and inspect Gateway background jobs Execute daemon Manage the Gateway service (legacy alias) Execute doctor Diagnose and repair config, Gateway, plugin, and channel problems Execute elevated Toggle elevated mode (on|off). Execute events_wait Wait for the next queued OpenClaw conversation event. Execute gateway Run, inspect, and query the OpenClaw Gateway Execute infer Run provider-backed model, media, search, and embedding commands Execute new Reset the session (/reset). Execute node Run and manage the headless node host service Execute nodes Pair nodes and run node-host commands through the Gateway Execute permissions_respond Allow or deny one pending OpenClaw exec or plugin approval request. Execute phone Arm/disarm high-risk phone node commands (camera/screen/writes). Execute plugins Install, enable, disable, and inspect plugins Execute proxy Run the OpenClaw debug proxy and inspect captured traffic Execute qa Run QA scenarios and launch the private QA debugger UI Execute restart Restart the gateway (if enabled). Execute sandbox Manage sandbox containers for agent isolation Execute security Security tools and local config audits Execute session Switch session (or open picker) Execute stop Stop the current run. Execute target Run id, index, or session key Execute terminal Open a local terminal UI (alias for tui --local) Execute tui Open a terminal UI connected to the Gateway

WRITE 41 tools

Write activation Set group activation (mention|always). Write active-memory Enable, disable, or inspect Active Memory for this session. Write agents Manage isolated agents (workspaces, auth, routing) Write approvals Manage exec approvals (gateway or node host) Write backup Create and verify local backup archives for OpenClaw state Write card Send a rich card message (LINE). Write channels Add, remove, login, and inspect messaging channels Write commitments List and manage inferred follow-up commitments Write compact Compact the session history. Write config Non-interactive config helpers (get/set/unset/file/validate). Default: starts guided setup. Write configure Interactive configuration for credentials, channels, gateway, and agent defaults Write debug Set runtime-only overrides (owner-only). Write devices Device pairing + token management Write dreaming Enable or disable memory dreaming. Write fast Set fast mode on/off Write hooks Manage internal agent hooks Write matrix Manage Matrix accounts, verification, devices, and profile state Write mcp Manage OpenClaw MCP config and channel bridge Write message Send, read, and manage channel messages Write messages_send Send a message back through the same OpenClaw conversation route. Write migrate Import state from another agent system Write note Optional note for Codex feedback upload Write onboard Interactive onboarding for gateway, workspace, and skills Write pair Generate setup codes and approve device pairing requests. Write pairing Secure DM pairing (approve inbound requests) Write path Inspect and edit workspace files via oc:// paths Write queue Adjust queue mode and options. Write reasoning Toggle reasoning output (on|off|stream). Write send Set send mode (on|off|inherit). Write settings Open settings Write setup Initialize local config and an agent workspace Write skills List, inspect, and install agent skills Write text Goal objective or note Write think Set thinking level (off|minimal|low|medium|high|xhigh). Write trace Set plugin trace mode (on|off). Write update Update OpenClaw and inspect update channel status Write usage Toggle usage footer (off|tokens|full). Write verbose Set verbose mode (on|full|off). Write webhooks Webhook helpers and integrations Write wiki Inspect and initialize the memory wiki vault Write workboard List, create, inspect, and dispatch Workboard cards.

READ 37 tools

Read ask off, on-miss, or always Read attachments_fetch List non-text attachments for a message in one OpenClaw conversation. Read canvas Capture or render canvas content from a paired node Read commands List available commands. Read context Explain context usage (list|detail|json). Read conversation_get Get one OpenClaw conversation by session key. Read conversations_list List OpenClaw channel-backed conversations available through session routes. Read dashboard Open the Control UI with your current token Read directory Lookup contact and group IDs (self, peers, groups) for supported chat channels Read dns DNS helpers for wide-area discovery (Tailscale + CoreDNS) Read docs Search the live OpenClaw docs Read echo Echo input text. Read events_poll Poll queued OpenClaw conversation events since a cursor. Read exec-policy Show or synchronize requested exec policy with host approvals Read gateway-status Show gateway status summary Read gwstatus Alias for /gateway-status Read health Fetch detailed health from the running Gateway Read help Show help and common commands. Read id Alias for /whoami. Read instructions Extra compaction instructions Read logs Tail Gateway logs locally or via RPC Read memory Search, inspect, and reindex memory files Read messages_read Read recent messages for one OpenClaw conversation. Read model Select a model (list|status|<name>). Read models List, scan, and set model providers Read name Skill name Read permissions_list_open List open OpenClaw exec or plugin approval requests visible through the Gateway. Read ping Return OK. Read policy Check policy requirements and emit audit evidence Read secrets Audit, apply, and reload SecretRef-backed credentials Read sessions List stored conversation sessions Read status Show Gateway, channel, model, and recent-session status Read subagents List or manage sub-agents. Read system System events, heartbeat, and presence Read tasks Inspect durable background tasks and flows Read transcripts Inspect stored transcripts Read whoami Show sender id (alias: /id).

OTHER 13 tools

Other cap queue cap Other channel Voice channel to join Other clawbot Legacy clawbot command aliases Other debounce debounce duration (e.g. 500ms, 2s) Other elev Alias for /elevated Other exit Exit the TUI Other host sandbox, gateway, or node Other input Skill input Other level Thinking level Other mode compact or verbose Other qr Generate mobile pairing QR/setup code Other quit Exit the TUI Other value Provider, limit, or text

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about OpenClaw

Can an AI agent delete data through the OpenClaw MCP server? +

Yes. The OpenClaw server exposes 3 destructive tools including drop, reset, uninstall. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through OpenClaw? +

The OpenClaw server has 41 write tools including activation, active-memory, agents. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach OpenClaw.

How many tools does the OpenClaw MCP server expose? +

129 tools across 4 categories: Destructive, Execute, Read, Write. 37 are read-only. 92 can modify, create, or delete data.

How do I enforce a policy on OpenClaw? +

Register the OpenClaw MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every OpenClaw tool call.

Deterministic rules across all 129 OpenClaw tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON OPENCLAW →

Instant setup, no code required.

129 OpenClaw tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from OpenClaw's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →