@raglab-cloud/openclaw-inflect-plugin

OpenClaw plugin for activating and enforcing governance profiles via govern.raglab.cloud.

Part of the RAGLab governance ecosystem. Provides /profile slash commands that load policy snapshots, enforce rule gates, and keep your agent sessions operating within defined guardrails — directly from your governance service.

Features

• Activate a governance profile — /profile activate <name> [policies:tag1,tag2]
• View active profile — /profile status renders policies and rules with severity icons
• Refresh snapshot — /profile refresh re-fetches the latest policies and rules
• Enforce rules — /profile enforce <scenario> tests rules against a given action
• Debug rule behavior — /profile debug <scenario> [policy-ids:a,b] [rule-ids:c,d]
• Deactivate — /profile deactivate

Requirements

• OpenClaw 2026.6.5 or later
• A govern.raglab.cloud account with at least one profile configured
• A governance MCP server configured in your OpenClaw config (local or remote)

Quick Start

1. Install the plugin

openclaw plugins install @raglab-cloud/openclaw-inflect-plugin
openclaw gateway restart

2. Configure the MCP server

The plugin reads its connection URL and API key from your existing mcp.servers config. Make sure you have a governance MCP server entry:

{
  "mcp": {
    "servers": {
      "governance": {
        "url": "https://govern.raglab.cloud/api/mcp/sse",
        "headers": {
          "Authorization": "Bearer govern_..."
        }
      }
    }
  }
}

By default, the plugin looks for a server named "governance". To use a different name, set mcpServer in the plugin config:

{
  "plugins": {
    "entries": {
      "@raglab-cloud/openclaw-inflect-plugin": {
        "config": {
          "mcpServer": "my-governance-server"
        }
      }
    }
  }
}

3. (Optional) Set a default profile

If you want /profile activate without arguments to use a specific profile:

{
  "plugins": {
    "entries": {
      "@raglab-cloud/openclaw-inflect-plugin": {
        "config": {
          "profileRef": "raglab"
        }
      }
    }
  }
}

4. Activate a profile

/profile activate raglab
/profile status

Command Reference

Flag Syntax

All flags use key:value syntax to avoid issues with auto-corrected dashes (macOS and other platforms convert -- to em-dashes —):

| Syntax | Description | |---|---| | policies:tag1,tag2 | Comma-separated tag names to filter policies | | policy-ids:uuid1,uuid2 | Comma-separated policy UUIDs for debug | | rule-ids:uuid1,uuid2 | Comma-separated rule UUIDs for debug/enforce | | category:name | Filter by rule category for enforce | | pending | Include pending (unapproved) rules in enforce |

Legacy --key=value syntax is also supported as a fallback.

/profile activate

Activate a governance profile and load its policies/rules into the session.

/profile activate <profile-name-or-uuid> [policies:tag1,tag2]

Examples:

/profile activate raglab policies:engineering,coding
/profile activate raglab
/profile activate policies:devops,config

When no profile name is given, uses the profileRef from plugin config.

/profile status

Display the active profile's policies, rules, tags, and snapshot timestamp.

/profile status

/profile refresh

Re-fetch the governance snapshot from the MCP server, keeping the same profile and tags.

/profile refresh

/profile enforce

Test whether a proposed action would be blocked by any active rules.

/profile enforce <action description> [category:name] [pending] [rule-ids:uuid1,uuid2]

Examples:

/profile enforce "Push code to the main branch"
/profile enforce "Deploy to production" category:infrastructure
/profile enforce "Delete an IAM user" pending

/profile debug

Run an LLM-powered analysis of a scenario against specific policies and rules.

/profile debug <scenario> [policy-ids:uuid1,uuid2] [rule-ids:uuid1,uuid2]

Examples:

/profile debug "Create a new VPC in us-east-1"
/profile debug "Modify IAM role permissions" rule-ids:abc-123,def-456

/profile deactivate

Remove the active governance profile from the current session.

/profile deactivate

Auto-Activation

If your workspace has an IDENTITY.md file with a profileId in the front-matter, the plugin will automatically activate that profile on startup using the tags from the tags field:

---
profileId: 054f040d-af55-43a4-9bc9-7b9d276ae942
tags:
  - engineering
  - coding
---

Published Package

| Package | Version | | --------------------------------------- | ------- | | @raglab-cloud/openclaw-inflect-plugin | 1.0.1 |

Development

# Build
npm run build

# Install dev link
openclaw plugins install --link .

# Publish
bun publish --access=public

Part of the RAGLab governance ecosystem.