Agent System

Agent System makes an OpenClaw agent workspace self-onboarding: run openclaw agent-system install there to register and identify the agent, reconcile its supported configuration, and equip its managed tools to operate with that agent's own environment and credentials instead of a shared global identity.

Current cool capabilities:

• 1Password-backed per-agent SSH private keys are never written to disk.
• Each agent gets its own Git authorship, signing, and GitHub identity.
• Work mode turns an assigned GitHub issue into a delivery pull request.

Note

Requires OpenClaw 2026.7.1-2 or newer. CI covers macOS 26 and Ubuntu 24.04.

Warning

Agent System remains a work in progress. Development and Leia coverage focus on OpenClaw's native and Codex harnesses. Other agent harnesses may work, but they are not yet part of the compatibility test matrix.

Overview

Today, Agent System:

• registers an agent workspace with OpenClaw and reconciles its public identity
• assembles environment variables and credentials per agent from declared dotenv, inline, and 1Password sources
• wraps supported tools with the active agent's declared configuration, environment, credentials, and workspace boundaries
• reconciles each agent's per-agent grants for the native Agent System tools enabled by its manifest
• applies each tool's operation-specific allow or deny policy before resolving credentials or executing the operation
• validates manifests, installs configured components, projects executable paths, and reports installed-state drift

Ships With

Tools

• agent_system_git — Runs ordinary Git commands with the agent's identity, SSH configuration, signing, and operation policy.
• agent_system_git_worktree — Prepares, lists, and removes durable managed worktrees.
• agent_system_github — Runs ordinary GitHub CLI commands with the agent's credential, isolated configuration, and operation policy.

Channels

• agent-system-github — Polls and admits approved GitHub assignments, prepares managed issue worktrees, and keeps issue and delivery pull-request comments in one lifecycle session.

Skills

• Git CLI — Guides agents through ordinary Git operations with agent_system_git.
• Git worktree — Guides agents through preparing, reusing, and removing managed worktrees.
• GitHub CLI — Guides agents through GitHub operations with agent_system_github.
• GitHub Update — Reconciles private notification progress with the owning public issue and publishes one safe, concise update when needed.

Installation

Install the current release from ClawHub:

openclaw plugins install clawhub:@tanaab/openclaw-agent-system

To select npm explicitly instead:

openclaw plugins install npm:@tanaab/openclaw-agent-system

Either install command registers and enables the agent-system plugin.

For a development checkout, follow Install from source.

Usage

Add .agent-system/agent.yaml to the workspace you want Agent System to manage. A root-level agent.yaml is also supported as a shorthand.

schema-version: 1

agent:
  id: tanaabot
  name: Tanaabot
  email:
    from-environment: AGENT_EMAIL

environment:
  # import this agent's identity and tool credentials from 1password.
  op: z7q4m2n9v6k3p8r5t1w0x4c2ba
  set:
    SSH_KEY:
      from-op: 'op://v4u7l2t9n5p8r1c6x3z0m4q7da/ssh-key/private key?ssh-format=openssh'
  required:
    - AGENT_EMAIL
    - GH_TOKEN_TANAABOT
    - SSH_KEY

github:
  username: tanaabot
  token: GH_TOKEN_TANAABOT

git:
  ssh:
    private-keys:
      from-environment: SSH_KEY

From that workspace, store the 1Password bootstrap credential when needed, then validate and install the agent:

# persist the current 1password service account token for this agent.
openclaw agent-system credentials set op --from-env

# validate the manifest, then reconcile the agent and its configured components.
openclaw agent-system validate
openclaw agent-system install

# inspect managed state without changing it.
openclaw agent-system doctor

# verify the github identity supplied by this agent's environment.
openclaw agent-system tool gh -- api user --jq .login

install is explicit and repeatable: it adds the OpenClaw agent when needed and reconciles only the state declared by the workspace. See Advanced for the core manifest and CLI references and the component documentation index.

Development

See Development for source installation, the recommended DevGuard workflow, validation, and coding standards.

Issues, Questions and Support

Use the GitHub issue queue for bugs and feature requests.

Changelog

See CHANGELOG.md for implemented changes and GitHub releases for published artifacts.

Maintainers

• @pirog

Contributors

Made with contrib.rocks.

License

Agent System is licensed under the MIT License.