Open source

Tools, given away

Everything here is MIT-licensed and free, including the parts that were annoying to build. A guardrail you cannot read the source of is not a guardrail.

Belay

v0.7.0 MIT

A seatbelt for OpenClaw agents.

OpenClaw has no spend cap, no model-call rate limit, no cross-session budget and no graceful pause. The default agent runtime timeout is 48 hours. Belay is the layer that notices and steps in — gradually.

warn → block a tool call → end the run

Enforcement lands between calls, not mid-call. Your agent doesn't get killed; it gets caught, with its context intact.

One caveat worth stating up front: the ladder's final rung — pausing the account outright — is not available on OpenClaw 2026.8.2, which refuses channels.stop from a hook handler. On that version the ladder tops out at ending the run.

Guards: Spend caps, request-size limits, model-call and tool-call rate limits, identical-call limit, tool-error rate, pause ladder, flight recorder
Runtime deps: Zero
Requires: OpenClaw 2026.8.2+, Node 20+

GitHub → npm →

Not affiliated with the OpenClaw Foundation.

How these are built

No telemetry

Nothing phones home. The only network calls are to alert endpoints you configure yourself.
No prompts stored

Guardrails read usage numbers and call metadata. Never transcripts, never credentials.
Auditable in an afternoon

Zero runtime dependencies, pinned build deps, no postinstall scripts, npm provenance.
Fails open on bugs

A crash inside the plugin must never take down the thing it protects.

Tools, given away

Belay

How these are built

No telemetry

No prompts stored

Auditable in an afternoon

Fails open on bugs