#8108 feat: set up OpenClaw MCP and hooks from the agent install command

Fixes DNO-1419

Why

Connecting an agent to OpenClaw took manual steps. The Plugins page plugin carries an org hooks key, and a cached sign-in could outrank any key, so sessions were not recorded under the agent.

What changed

Before: the agent install command configured other MCP clients only. OpenClaw needed the gateway added by hand and the plugin downloaded separately.

After: on a machine with openclaw, the same curl … | sh:

• adds the agent gateway as the speakeasy MCP server, keeping the key out of process arguments;
• installs the observability plugin with the agent's own key (agent_key: true, mode 600), using --force and --accept-capabilities when the CLI lists them;
• sets allowConversationAccess, sends one test hook, prints PASS or FAIL, and says to restart the Gateway.

The Manual tab gains an OpenClaw command. The hooks binary now prefers a key marked as an agent's to a cached personal sign-in. An agent with no project gets the gateway only. Hooks from a dashboard-issued key also need #8015, which grants org:hooks_ingest.

Gutternote review steps

1. Sidebar → Identity → Agents → New (/<org>/projects/<project>/identities/agents/new). Pick a server, then Create agent.
2. The install step shows the command, a trusted-shell note, and a separate OpenClaw follow-up message with no code or key.
3. Deny clipboard access. Copy shows Copy failed.
4. Open Manual. The OpenClaw block runs openclaw mcp add speakeasy with the key from $SPEAKEASY_AGENT_KEY.

Recording

Local stack, OpenClaw 2026.10.6 in Docker: install, chat through the gateway, read the session.

https://github.com/user-attachments/assets/7ed1a10c-a3d6-443d-b399-f6accc4d6d26

---

🚀 Preview Environment (PR #8108)

Preview URL: https://pr-8108.dev.getgram.ai

Component	Status	Details	Updated (UTC)
✅ Database	Ready	Existing database reused	2026-10-28 21:03:01.
✅ Images	Available	Container images ready	2026-10-28 21:07:01.

_{Gram Preview Bot}