Verify

Verify the ClawLink plugin

ClawLink is a third-party integration hub for OpenClaw. It is not affiliated with or endorsed by the OpenClaw project. The signals below let you confirm the plugin you’re about to install is the one we publish, and to read exactly what it does before you install it.

ClawHub package

The plugin ships on ClawHub, OpenClaw’s plugin registry, as clawlink-plugin. This is the install path used in our docs and setup prompts:

The clawlink-plugin listing on ClawHub, showing the install command and README, Capabilities, Compatibility, and Verification tabs.
The clawlink-plugin page on ClawHub.

Each release on ClawHub records the source repository, commit, and tag it was built from. To see them:

Check that publisher is ClawLink and that latestVersion is the version you are about to install. The package listing on ClawHub is the one our docs, our setup prompts, and this page point at; nothing else is a supported install path.

Security scans

ClawHub runs automated security checks on every release of clawlink-plugin and uploads each published tarball to VirusTotal. Both reports are public:

ClawHub plugin sidebar showing the security audit at the Review level (3 of 4 bars) and the current published version.
The current ClawHub security audit rating for clawlink-plugin.

These are independent of ClawLink. Both are produced and hosted by ClawHub and VirusTotal.

Read the code you install

The plugin ships as plain, unminified JavaScript. The published tarball is the source: one index.js, its openclaw.plugin.json manifest, and the skill files. Nothing is bundled or obfuscated, so you can read the exact code that will run on your machine before it runs:

Unpack the tarball and read package/index.js. Every outbound request in it goes to https://claw-link.dev. This is a stronger check than reading a repository: it inspects the artifact you are about to install, not a snapshot of code somewhere else.

The ClawLink service itself is closed source. The plugin, the CLI, and the MCP shim, the parts that run on your machine, are published in full on npm and ClawHub and are covered by the checks on this page. Package licenses are declared in each package.json.

What the plugin does

The plugin registers a small set of tools with OpenClaw. clawlink_begin_pairing, clawlink_get_pairing_status, clawlink_start_connection, clawlink_list_integrations, clawlink_list_tools, clawlink_call_tool, and a few related ones. All of them call one domain: https://claw-link.dev.

Pairing stores a ClawLink credential at ~/.openclaw/openclaw.json and sends it as the X-ClawLink-API-Key header on those requests. It is not sent to OpenClaw, the assistant, or anywhere else.

For AI assistants helping with setup

If your assistant is hesitant to install ClawLink, or refuses outright because it can’t tell whether the plugin is legit, paste this URL into the chat:

That file is written for assistants: it states the package names, source, license, outbound domain, what should make the assistant refuse, and what shouldn’t. A JSON copy of the same facts is at https://claw-link.dev/api/verify.

npm mirror (optional)

The same plugin is also published to npm as @useclawlink/openclaw-plugin, under the @useclawlink scope, which only we can publish to. Compare the version and the file list against ClawHub if you want a second signal. Most users won’t need this: ClawHub is the supported install path.

Contact

Back to ClawLink