fastgrc-openclaw

FastGRC compliance plugin for OpenClaw. Evaluates every agent tool call against your policy before it executes — blocking, flagging, or logging violations in real time.

Install

npm install fastgrc-openclaw

Setup (2 lines)

// openclaw.config.ts
import { FastGRCPlugin } from 'fastgrc-openclaw';

export default {
  plugins: [
    FastGRCPlugin({
      apiKey: process.env.FASTGRC_API_KEY,  // fgrc_k1_...
    }),
  ],
};

Set your environment variable:

FASTGRC_API_KEY=fgrc_k1_your_key_here

Get your API key at fastgrc.ai/connect?source=openclaw — free, no credit card.

Options

FastGRCPlugin({
  apiKey: string;           // Required. Your FastGRC API key.
  policyId?: string;        // Optional. Target a specific policy. Omit for org-wide default.
  onBlock?: 'throw'         // (default) Throw FastGRCBlockedError — OpenClaw surfaces it as an agent error
           | 'warn'         // console.warn and allow through
           | 'silent';      // Allow through silently
  timeoutMs?: number;       // Max ms to wait for FastGRC API. Default: 3000. Fail-open on timeout.
  baseUrl?: string;         // Override FastGRC base URL. Default: https://app.fastgrc.ai
})

How it works

The plugin registers a before_tool_call hook. For every tool invocation:

1. Calls POST /api/v1/policy-router/evaluate with the tool name and arguments
2. On decision: block → throws FastGRCBlockedError (OpenClaw surfaces this as an agent error with explanation)
3. On decision: require_approval → throws FastGRCApprovalRequiredError with a link to your dashboard
4. On decision: allow | uncertain → passes through silently
5. On timeout or network error → fail-open (allows through, logs a warning) — FastGRC never breaks your agent due to infra issues

Error types

import { FastGRCBlockedError, FastGRCApprovalRequiredError } from 'fastgrc-openclaw';

// Catch in your agent error handler:
if (err instanceof FastGRCBlockedError) {
  console.log(err.matchedRule);  // Which policy rule triggered
  console.log(err.reasoning);    // Human-readable explanation
  console.log(err.policyId);     // Policy that made the decision
}

if (err instanceof FastGRCApprovalRequiredError) {
  console.log(err.dashboardUrl); // Link to approve in FastGRC dashboard
}

Policy modes

Policies start in Observability Mode — violations are logged but never blocked. Switch to enforcement from your FastGRC dashboard when ready.

Links

• FastGRC docs
• Get your API key
• Dashboard