by Enderfga
OpenClaw plugin — turn Claude Code CLI into a programmable, headless coding engine with plenty of tools, agent teams, and multi-model proxy
# Add to your Claude Code skills
git clone https://github.com/Enderfga/openclaw-claude-codeGuides for using ai agents skills like openclaw-claude-code.
Last scanned: 5/20/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@anthropic-ai/sdk: Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@aws-sdk/xml-builder: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server: Middleware bypass via repeated slashes in serveStatic",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "basic-ftp: basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Large numeric range defeats documented `max` DoS protection",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-xml-builder: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-xml-parser: fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "hono: Hono missing validation of cookie name on write path in setCookie()",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "openclaw: OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-20T07:44:04.909Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}openclaw-claude-code is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by Enderfga. OpenClaw plugin — turn Claude Code CLI into a programmable, headless coding engine with plenty of tools, agent teams, and multi-model proxy. It has 429 GitHub stars.
openclaw-claude-code failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/Enderfga/openclaw-claude-code" and add it to your Claude Code skills directory (see the Installation section above).
openclaw-claude-code is primarily written in TypeScript. It is open-source under Enderfga on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh openclaw-claude-code against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Programmable bridge that turns coding CLIs into headless, agentic engines — persistent sessions, multi-engine orchestration, multi-agent council, and dynamic runtime control.
Claude Code and Codex are powerful coding CLIs, but they're designed for interactive use. If you want AI agents to programmatically drive coding sessions — start them, send tasks, manage context, coordinate teams, switch models mid-conversation — you need a control layer.
This project wraps coding CLIs and exposes their capabilities as a clean, tool-based API. Your agents get persistent sessions, real-time streaming, multi-model routing, multi-engine support, and multi-agent council orchestration.
Why not just use the Claude API directly? The API gives you completions. This gives you a fully managed coding agent — file editing, tool use, git awareness, context management, and multi-turn conversations — all without building the orchestration yourself.
One-line install (recommended):
curl -fsSL https://raw.githubusercontent.com/Enderfga/openclaw-claude-code/main/install.sh | bash
This installs via npm, registers the plugin in openclaw.json, and restarts the gateway automatically.
Standalone (no OpenClaw):
npm install -g @enderfga/openclaw-claude-code
claude-code-skill serve
import { SessionManager } from '@enderfga/openclaw-claude-code';
const manager = new SessionManager();
await manager.startSession({ name: 'task', cwd: '/project' });
const result = await manager.sendMessage('task', 'Fix the failing tests');
See Getting Started for full setup guide.
Drive Claude Code, OpenAI Codex, Google Gemini, Cursor Agent, or any custom coding CLI through a unified ISession interface. Each engine manages its own subprocess, events, and cost tracking.
// Claude Code engine (default)
await manager.startSession({ name: 'claude-task', engine: 'claude', model: 'opus' });
// Codex engine
await manager.startSession({ name: 'codex-task', engine: 'codex', model: 'gpt-5.4' });
// Gemini engine
await manager.startSession({ name: 'gemini-task', engine: 'gemini', model: 'gemini-3.1-pro-preview' });
// Cursor Agent engine
await manager.startSession({ name: 'cursor-task', engine: 'cursor', model: 'sonnet-4' });
// Custom engine — any coding agent CLI via config
await manager.startSession({
name: 'my-task',
engine: 'custom',
cwd: '/project',
customEngine: {
name: 'my-agent',
bin: 'my-agent',
persistent: true, // or false for one-shot
args: { print: '-p', outputFormat: '--output-format', outputFormatValue: 'stream-json', /* ... */ },
},
});
See Multi-Engine for architecture and adding new engines.
Multiple agents collaborate in parallel on the same codebase with git worktree isolation, consensus voting, and a two-phase protocol (plan then execute).
const session = manager.councilStart('Build a REST API with auth', {
agents: [
{ name: 'Planner', emoji: '🟠', persona: 'Requirements & architecture', engine: 'claude', model: 'opus' },
{ name: 'Generator', emoji: '🟢', persona: 'Implementation per plan', engine: 'codex', model: 'gpt-5.4' },
{ name: 'Evaluator', emoji: '🔵', persona: 'Independent verification', engine: 'claude', model: 'sonnet' },
],
maxRounds: 10,
projectDir: '/tmp/api-project',
});
See Council for the full collaboration protocol.
| Category | Tools |
|---|---|
| Session Lifecycle | claude_session_start, send, stop, list, overview |
| Session Operations | status, grep, compact, update_tools, switch_model |
| Inbox | session_send_to, session_inbox, session_deliver_inbox |
| Agent Teams | agents_list, team_list, team_send |
| Council | council_start, council_status, council_abort, council_inject, council_review, council_accept, council_reject |
| Ultraplan | ultraplan_start, ultraplan_status |
| Ultrareview | ultrareview_start, ultrareview_status |
See Tools Reference for complete API.
Cross-session messaging: sessions can send messages to each other. Idle sessions receive immediately; busy sessions queue for later delivery.
await manager.sessionSendTo('planner', 'coder', 'The auth module needs rate limiting');
await manager.sessionSendTo('monitor', '*', 'Build failed!'); // broadcast
Dedicated Opus planning session that explores your project for up to 30 minutes and produces a detailed implementation plan.
const plan = manager.ultraplanStart('Add OAuth2 support with Google and GitHub providers', {
cwd: '/project',
});
// Poll: manager.ultraplanStatus(plan.id)
Fleet of 5-20 bug-hunting agents that review your codebase in parallel, each from a different angle (security, performance, logic, types, etc.).
const review = manager.ultrareviewStart('/project', {
agentCount: 10,
maxDurationMinutes: 15,
});
// Poll: manager.ultrareviewStatus(review.id)
Drop-in backend for any OpenAI-compatible webchat frontend. Stateful sessions maximize Anthropic prompt caching (90% discount on cached tokens).
# Start the server
claude-code-skill serve
# Use with any OpenAI client
curl http://127.0.0.1:18796/v1/chat/completions \
-H "Content-Type: application/json" \
-d '{"model":"claude-sonnet-4-6","messages":[{"role":"user","content":"Hello!"}],"stream":true}'
Works with ChatGPT-Next-Web, Open WebUI, LobeChat, and any app that speaks the OpenAI API format. Set the API base URL to http://127.0.0.1:18796/v1 and use any API key (or leave blank).
See CLI Reference for configuration options.
low to max thinking depth per message--resumegraph TD
A[OpenClaw / Your Code] -->|tool calls| B[Plugin Entry<br/>index.ts]
B --> C[SessionManager]
C --> D[Claude Engine<br/>persistent-session.ts]
C --> E[Codex Engine<br/>persistent-codex-session.ts]
C --> K[Gemini Engine<br/>persistent-gemini-session.ts]
C --> L[Cursor Engine<br/>persistent-cursor-session.ts]
C --> M[Custom Engine<br/>persistent-custom-session.ts]
C --> F[Council<br/>council.ts]
C --> G[Inbox / Ultraplan / Ultrareview]
F -->|git worktree per agent| D
B --> H[Proxy Handler]
H -->|Anthropic format| I[Gemini / GPT / Gateway]
B --> J[Embedded HTTP Server]
src/
├── index.ts # Plugin entry — 27 tools + proxy route
├── models.ts # Centralized model registry (pricing, aliases, engines)
├── types.ts # Shared types, ISession interface, re-exports from models
├── constants.ts # Shared constants (timeouts, limits, thresholds)
├── logger.ts # Structured Logger interface + console implementation
├── base-oneshot-session.ts # Abstract base class for one-shot engines (Codex/Gemini/Cursor)
├── persistent-session.ts # Claude Code engine (ISession)
├── persistent-codex-session.ts # Codex engine (extends BaseOneShotSession)
├── persistent-gemini-session.ts # Gemini engine (extends BaseOneShotSession)
├── persistent-cursor-session.ts # Cursor Agent engine (extends BaseOneShotSession)
├── persistent-custom-session.ts # Custom engine — any CLI via config (ISession)
├── session-manager.ts # Multi-session orchestration + council management
├── circuit-breaker.ts # Engine failure tracking with exponential backoff
├── inbox-manager.ts # Cross-session messaging (inbox)
├── council.ts # Multi-agent council orchestration
├── consensus.ts # Consensus vote parsing
├── openai-compat.ts # OpenAI-compatible /v1/chat/completions
├── embedded-server.ts # HTTP server for standalone mode
└── proxy/
├── handler.ts # Provider detection + routing
├── anthropic-adapter.ts # Anthropic ↔ OpenAI conversion
├── schema-cleaner.ts # Gemini schema compatibility
└── thought-cache.ts # Gemini thought caching
skills/
├── SKILL.md # OpenClaw skill definition (triggers + metadata)
└── references/ # All documentation (progressive disclosure)
├── getting-started.md # Installation, configuration, first session
├── sessions.md # Persistent sessions, resume, cost tracking
├── multi-engine.md # Claude + Codex + Gemini + Cursor + Custom engines
├── council.md # Multi-agent collaboration protocol
├── tools.md # Complete 27-tool API reference
├── inbox.md # Cross-session messaging