OpenClaw Integration

Admina ships with a ready-to-use OpenClaw skill that routes all MCP tool calls from your agent through the Admina governance proxy. Once installed, every tool your agent uses is automatically governed — no code changes needed.

Option 1 — Skill install (recommended)

The fastest way to add governance to your OpenClaw agent. The setup script rewrites your ~/.openclaw/mcp.json to route all MCP traffic through Admina.

# 1. Make sure Admina is running (see Quick Start)
docker compose up --build

# 2. Install the Admina skill
cd openclaw-skill
chmod +x setup.sh
./setup.sh

# 3. Restart OpenClaw gateway to pick up new routing
openclaw gateway restart

# 4. Verify governance is active
openclaw skills list   # → admina: active

What the skill does

The setup script modifies your ~/.openclaw/mcp.json to proxy all server URLs through the Admina governance layer:

# Before (direct connection)
{
  "mcpServers": {
    "github": { "url": "https://api.githubmcp.com/sse" }
  }
}

# After (governed via Admina)
{
  "mcpServers": {
    "github": {
      "url": "http://localhost:8080/mcp",
      "headers": { "X-Upstream": "https://api.githubmcp.com/sse" }
    }
  }
}

Option 2 — Adapter (manual / advanced)

For fine-grained control, use the openclaw-adapter directly. This is useful for custom deployment scenarios or when you need multi-upstream routing.

cd openclaw-adapter

# Rewrite mcp.json to use Admina as proxy
python adapter.py rewrite --config ~/.openclaw/mcp.json

# Restore original mcp.json
python adapter.py restore --config ~/.openclaw/mcp.json

Option 3 — stdio bridge

For MCP servers that use the stdio transport (filesystem, npx-based servers), Admina provides a stdio bridge that wraps the server process:

# In mcp.json, wrap stdio servers with the bridge
{
  "mcpServers": {
    "filesystem": {
      "command": "python",
      "args": [
        "/path/to/admina/openclaw-adapter/stdio_bridge.py",
        "--",
        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/home"
      ]
    }
  }
}

The stdio bridge intercepts all JSON-RPC messages on stdin/stdout and routes them through the Admina proxy before forwarding to the actual MCP server process.

Multi-upstream routing

Admina supports multiple MCP servers simultaneously through its multi-upstream router. Set ROUTING_CONFIG_PATH to a JSON config file:

# routing.json
{
  "upstreams": [
    { "name": "github", "url": "https://api.githubmcp.com/sse" },
    { "name": "filesystem", "url": "http://localhost:9001" },
    { "name": "slack", "url": "https://mcp.slack.com/sse" }
  ],
  "default": "filesystem"
}

# .env
ROUTING_CONFIG_PATH=/path/to/routing.json

Verifying governance

After installing the skill, send a test request and check the response headers:

# Headers added by Admina to every governed response:
X-Admina-Decision: ALLOW
X-Admina-Risk-Level: LOW
X-Admina-Latency-Us: 14
X-Admina-Pillars: loop_breaker,firewall,pii,otel,forensic,eu_ai_act
X-Admina-Version: 0.2.0

SSE streaming

Admina passes through SSE (Server-Sent Events) streams transparently. OpenClaw uses SSE on many MCP servers (GitHub, Slack, databases). All SSE events are governed inline as they arrive — no buffering.

SSE passthrough is fully supported as of v0.2.0.