gate-oc-audit

Purpose

gate-oc-audit is a tamper-evident audit trail plugin for AI coding agent activity, running as an OpenClaw plugin. It records every session, every tool call, and prompt exchanges to a local SQLite database, and uses SHA-256 hash chain integrity so that you can verify that events have not been modified or deleted after the fact.

Main capabilities

• Event recording: Automatically records audit events, covering sessions, tool calls, and prompt and agent lifecycle events such as prompt.input, prompt.response, agent.end (the latter three require the corresponding opt-in to be enabled).
• Integrity verification: Provides SMT proof verification and Digital Evidence (DE) checkpoint consistency checks,openclaw audit verify with exit code 0 when all proofs and checkpoints are valid, and 1 if any verification fails. Proof verification checks both internal consistency (sibling node hashes can be reduced to the declared root) and root legitimacy; a proof that is self-consistent but has an unknown root is rejected.
• Status viewing:openclaw audit status Outputs information such as storage (database size and limit, event count, earliest event, next cleanup), integrity (sequence head, SMT tree and root, last checkpoint, session hook status), DE anchoring, file monitoring, manifest, recent security scans, and supports --json outputting a single-line machine-readable snapshot.
• Activity reports:openclaw audit report Generates daily or weekly activity summaries, covering sections such as Activity, Cron schedule, Top tools, LLM spend, Outbound messaging, Anomalies, Integrity, and can output human-readable text, single-line JSON, or a self-contained HTML document. Built-in anomaly detectors include R5a duplicate outbound (the same content hash sent to the same channel and recipient within a window) and R5b first-seen tool (a tool name that appears within the window but did not appear in the preceding lookback window).
• Cost statistics:openclaw audit spend Aggregates token and cost information from prompt.response metadata by provider, model, day, or session, and supports configuration of the time window and grouping method.
• Event export: Supports export by format json/csv and by conditions such as time, type, category, and session; output is streamed in fixed batches via a sequence cursor, avoiding missing rows caused by retention policy cleanup during export. Each row carries the DE anchoring reference covering its sequence (null if none).
• Cron summary:openclaw audit report cron <job-id> Projects the audit trail with one row per cron execution (latest first), pairing cron.executed with its matching agent.end, and attributing the tool, LLM, and outbound message activity of the same session between the two timestamps; supports --last N(default 20, maximum 1000) to limit the number of rows, outputting truncated: true when exceeded.
• HTTP endpoints and SPA: Every SPA route has an HTTP endpoint backing it under /plugins/audit/api/ , with JSON on the wire and CLI --json output being byte-for-byte identical, making it easy for dashboards to pin the schema.

How to use

After installation, the plugin automatically starts recording audit events while the agent is running. It is recommended to configure using the installation wizard: the wizard adds gate-oc-audit to plugins.allow, enables hooks.allowConversationAccess to capture prompt.input / prompt.response / agent.end events, optionally collects the Digital Evidence API key and org/tenant UUID and adjusts the anchoring threshold, and finally runs openclaw audit status to confirm that the trail is in effect. Manual configuration is also possible, and the two key items require operator policy opt-in: adding gate-oc-audit to plugins.allow, and setting allowConversationAccess. After installation, you can use openclaw audit status to quickly confirm the recording status;--json Can be piped to jq. All commands open the audit database read-only via SQLite WAL, so there is no lock contention with a running gateway.

Use cases

Suitable for operators and teams that need verifiable auditing, integrity proofs, activity summaries, overhead statistics, or event export for AI coding agent behavior.

Limitations

• Requires openclaw >= 2026.4.24 as a peer dependency, and Node.js ≥ 22.13 (uses the built-in node:sqlite module).
• When allowConversationAccess is not set, the three important event types prompt.input, prompt.response, and agent.end will not appear in the audit trail.
• HTTP endpoints such as reports and exports depend on loopback binding by default; when bound to a non-loopback address they return 403, unless allowExportOnNonLoopback: true is set, or requireGatewayAuth: true is set so the gateway authenticates every request.
• redactPromptText and redactToolArgs do not cover tool.result content; if both are enabled and audit export --include-contentis executed, prompts and message bodies are hashed, but tool output is still emitted as-is.
• In an active system, after the tree advances from root R1 to R2, if a checkpoint did not capture R1, there is a brief window between the tree advancing and the next checkpoint during which newly generated proofs cannot be verified.
• Other details such as fees, pricing, and platform support scope are not provided in the materials.