You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+5Lines changed: 5 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,10 @@
1
1
# Changelog
2
2
3
+
## 0.1.13 - 2026-05-26
4
+
5
+
- Polished the ClawHub-facing README with a clearer product overview, quick-start path, capability summary, and streamlined safety sections.
6
+
- Kept the same conservative runtime behavior: no broad console access, no workspace access unless explicitly enabled, and HTTPS enforcement for routable authenticated API calls.
7
+
3
8
## 0.1.12 - 2026-05-26
4
9
5
10
- Enforced transport safety for authenticated Mautic API requests: routable plain-HTTP `baseUrl` values now fail before credentials are sent.
Copy file name to clipboardExpand all lines: README.md
+67-85Lines changed: 67 additions & 85 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,65 +1,79 @@
1
1
# Mautic Control for OpenClaw
2
2
3
-
Operate Mautic from OpenClaw with typed, policy-gated tools for API work, webhook discovery, safe console maintenance, and guarded workspace file staging.
3
+
Controlled Mautic CRM operations from OpenClaw: typedAPI tools, webhook discovery, conservative console maintenance, and guarded workspace staging.
After installation, set the Mautic connection values in OpenClaw plugin settings and provide API credentials through environment variables or your platform secret store.
17
+
After installation, configure the non-secret connection settings in OpenClaw and provide Mautic credentials through environment variables or your platform secret store.
22
18
23
-
## Compatibility
19
+
## What You Can Do
24
20
25
-
This release was verified against Mautic Community `7.1.1`, the latest GitHub release checked on 2026-05-26. Mautic's own release page lists Mautic 7 as the actively supported series.
21
+
| Workflow | Tools | Default Safety |
22
+
| --- | --- | --- |
23
+
| Check Mautic reachability and policy |`mautic_status`| Read-only status check |
24
+
| Work with Mautic API resources |`mautic_request`, `mautic_entity`| Credentials required, API paths only |
25
+
| Discover webhook trigger names |`mautic_webhook_triggers`| No credentials required |
26
+
| Run maintenance commands |`mautic_console`| Optional bridge, allowlisted commands only |
27
+
| Stage import/export files |`mautic_workspace_file`| Off by default, bounded to one workspace root |
26
28
27
-
Expected production target:
29
+
## Good Fits
28
30
29
-
| Component | Supported Target |
30
-
| --- | --- |
31
-
| OpenClaw Gateway |`2026.5.22` or newer |
32
-
| Mautic | Mautic 7.x, tested with `7.1.1`|
33
-
| Mautic API | Legacy `/api` routes and `/api/v2` where available |
34
-
| Console bridge | Optional, private network only |
- Inspect Mautic health before generating CRM workflow documents.
32
+
- Read or update contacts, companies, segments, campaigns, emails, forms, webhooks, and related API entities through policy-gated calls.
33
+
- Confirm available webhook events before designing automations.
34
+
- Run narrow Mautic maintenance or automation jobs from a private console bridge when an operator enables them.
35
+
- Stage CSV, JSON, or Markdown files in a dedicated workspace directory.
36
36
37
-
Validate against your exact Mautic instance before broad rollout, especially if custom plugins, nonstandard API routing, or reverse proxies are involved.
37
+
## Conservative by Default
38
+
39
+
The plugin starts narrow. API access requires credentials, maintenance commands are off, automation jobs are off, and workspace read/write are off until explicitly enabled.
40
+
41
+
| Capability | Default | Enable Only When |
42
+
| --- | --- | --- |
43
+
| Mautic API | Available after credentials | The agent is allowed to operate this Mautic instance |
| Automation jobs | Off | Campaign, segment, or webhook jobs are intentional |
46
+
| Workspace read/write | Off | A dedicated staging directory is configured |
47
+
| Filesystem boundary | Always on | Every path must remain under `allowedWorkspaceRoot`|
48
+
49
+
## Production Setup
50
+
51
+
| Step | Setting | Guidance |
52
+
| --- | --- | --- |
53
+
| Connect Mautic |`baseUrl`| Use the internal URL OpenClaw should call. Use HTTPS for hosted or routed deployments. |
54
+
| Add API credentials |`MAUTIC_API_USERNAME`, `MAUTIC_API_PASSWORD`| Store secrets outside plugin UI and source control. |
55
+
| Choose API routing |`defaultApiVersion`| Use `legacy` for `/api` or `v2` for `/api/v2` where available. |
56
+
| Keep console private |`consoleUrl`, `MAUTIC_CONSOLE_TOKEN`| Deploy the bridge only on a private network and only if console commands are needed. |
57
+
| Guard file staging |`workspaceRoot`, `allowedWorkspaceRoot`| Use a dedicated staging directory, not a home directory or secrets path. |
58
+
| Limit agent exposure | OpenClaw profiles | Prefer explicit tool allowlists for agents that process untrusted input. |
59
+
60
+
## Secure Transport
61
+
62
+
Authenticated tools send Mautic API credentials with each request. Use `https://` for production, hosted, routed, or cross-host deployments.
63
+
64
+
Plain `http://` is acceptable only for a trusted loopback address or private container network such as `http://mautic_web`. The plugin reports a transport warning for non-HTTPS `baseUrl` values, and authenticated API tools refuse to send credentials to routable plain-HTTP hosts.
38
65
39
66
## Tools
40
67
41
68
| Tool | What It Does | Requires |
42
69
| --- | --- | --- |
43
-
|`mautic_status`| Checks dashboard reachability, API auth, resolved config, command policy, and workspace policy. | API credentials |
70
+
|`mautic_status`| Checks dashboard reachability, API auth, resolved config, transport policy, command policy, and workspace policy. | API credentials for auth check|
44
71
|`mautic_request`| Sends authenticated requests to Mautic paths under `/api` or `/api/v2`. | API credentials |
45
72
|`mautic_entity`| Lists, reads, creates, updates, and deletes supported Mautic resources. | API credentials |
|`mautic_console`| Runs allowlisted Mautic console commands through the private bridge. | Console bridge and token |
48
75
|`mautic_workspace_file`| Lists, reads, writes, or deletes files under a guarded workspace root. | Workspace toggles |
49
76
50
-
## Production Setup
51
-
52
-
Use these production defaults unless a trusted operator needs broader access.
53
-
54
-
| Step | Action | Guidance |
55
-
| --- | --- | --- |
56
-
| Connect Mautic | Set baseUrl | Use the internal URL OpenClaw should call, not a public browser URL unless required by your deployment. |
57
-
| Add credentials | Provide API username and password | Load them from a secret store or runtime environment, not from plugin UI config. |
58
-
| Protect transport | Use HTTPS outside private networks | Basic auth credentials are sent on every Mautic API request. Plain HTTP is acceptable only on a trusted local or private Docker network. |
59
-
| Keep access narrow | Leave optional controls disabled | Enable maintenance, automation, or workspace access only for trusted operators. |
60
-
| Add console access only if needed | Deploy the console bridge | The bridge is required only for console commands. All other tools can run without it. |
61
-
| Limit agent exposure | Use restrictive OpenClaw profiles | Prefer explicit tool allowlists for agents that process untrusted input. |
62
-
63
77
## Required Secrets
64
78
65
79
Never store these values in the plugin UI, README, or source control.
@@ -72,12 +86,6 @@ Never store these values in the plugin UI, README, or source control.
72
86
73
87
OAuth2 is preferred for external production integrations where available. The local verification stack uses Basic auth only for loopback automation.
74
88
75
-
## Transport Warning
76
-
77
-
`mautic_request`, `mautic_entity`, `mautic_webhook_triggers`, and `mautic_status` send Mautic API credentials with each request. If `baseUrl` uses plain HTTP, those credentials can be intercepted anywhere between OpenClaw and Mautic.
78
-
79
-
Use `https://` for production, hosted, routed, or cross-host Mautic deployments. Use plain `http://` only for a trusted loopback address or private container network such as `http://mautic_web`. The `mautic_status` tool reports a transport warning when the configured `baseUrl` is not HTTPS, and authenticated API tools refuse to send credentials to a routable plain-HTTP host.
80
-
81
89
## Plugin Settings
82
90
83
91
These settings are non-secret and can be configured in OpenClaw.
@@ -110,36 +118,9 @@ MAUTIC_ALLOW_WORKSPACE_READ
110
118
MAUTIC_ALLOW_WORKSPACE_WRITE
111
119
```
112
120
113
-
## Security Defaults
114
-
115
-
The plugin starts in a conservative mode. API access becomes available only after credentials are provided, and operational controls stay off until an operator enables them.
116
-
117
-
### Default Access
118
-
119
-
| Capability | Default | What That Means |
120
-
| --- | --- | --- |
121
-
| Mautic API | Available after credentials | Requests are limited to Mautic API routes only: /api and /api/v2. |
122
-
| Console status | On | Only migration status is allowed, so OpenClaw can check health without changing Mautic. |
123
-
| Maintenance commands | Off | Cache clearing and plugin reloads require an explicit toggle. |
124
-
| Automation jobs | Off | Campaign, segment, and webhook job execution requires a separate explicit toggle. |
125
-
| Workspace read | Off | File listing and reading are disabled until enabled for a dedicated staging directory. |
126
-
| Workspace write | Off | File writes and deletes are disabled until enabled for a dedicated staging directory. |
127
-
| Filesystem boundary | Always on | Every workspace path must stay inside the configured allowed workspace root. |
128
-
129
-
### Optional Command Groups
130
-
131
-
| Setting | Enables | Intended Use |
132
-
| --- | --- | --- |
133
-
| allowMaintenanceCommands | cache:clear; mautic:cache:clear; plugins:reload| Routine maintenance after config, plugin, or cache changes. |
Console requests are checked twice: first by the plugin allowlist, then by the optional bridge allowlist. For agents that process untrusted input, use restrictive OpenClaw profiles or explicit tool allowlists.
137
-
138
121
## Console Bridge
139
122
140
-
The console bridge is optional. It is needed only for the console-command tool; API, entity, webhook, status, and workspace tools can run without it.
141
-
142
-
Use the included bridge file only as a private internal endpoint between OpenClaw and Mautic.
123
+
The console bridge is optional. It is needed only for `mautic_console`; API, entity, webhook, status, and workspace tools can run without it.
143
124
144
125
| Requirement | Production Guidance |
145
126
| --- | --- |
@@ -149,11 +130,9 @@ Use the included bridge file only as a private internal endpoint between OpenCla
149
130
| Public access | Do not expose the bridge directly to the public internet. |
150
131
| Command scope | Keep execution limited to the plugin and bridge allowlists. |
151
132
152
-
Without the bridge, disable or ignore `mautic_console`; the rest of the plugin remains usable.
153
-
154
133
## Local Docker Stack
155
134
156
-
The companion Docker stack uses explicit local settings to preserve the development workflow:
135
+
The companion Docker stack uses explicit local settings:
157
136
158
137
```text
159
138
baseUrl=http://mautic_web
@@ -170,19 +149,26 @@ allowWorkspaceWrite=true
170
149
171
150
These are local-stack defaults, not production defaults. Do not expose the local stack's loopback credentials or Basic auth settings publicly.
172
151
173
-
## Verify
152
+
## Compatibility
174
153
175
-
Package checks:
154
+
This release was verified against Mautic Community `7.1.1`, the latest GitHub release checked on 2026-05-26. Mautic's own release page lists Mautic 7 as the actively supported series.
155
+
156
+
| Component | Supported Target |
157
+
| --- | --- |
158
+
| OpenClaw Gateway |`2026.5.22` or newer |
159
+
| Mautic | Mautic 7.x, tested with `7.1.1`|
160
+
| Mautic API | Legacy `/api` routes and `/api/v2` where available |
161
+
| Console bridge | Optional, private network only |
Validate against your exact Mautic instance before broad rollout, especially if custom plugins, nonstandard API routing, or reverse proxies are involved.
The package is published on ClawHub as `@completetech/openclaw-mautic-plugin`.
201
187
202
-
Releases are published as a ClawPack npm-pack artifact, not the older legacy zip artifact.
203
-
Trusted publishing uses GitHub Actions OIDC; no long-lived ClawHub token is stored in repository secrets.
204
-
The GitHub workflow publishes the checked-in `clawpack/` tarball through ClawHub's official reusable workflow so the release can use both official OIDC and the `npm-pack` artifact path.
205
-
206
-
Current ClawHub behavior: the release is source-linked to the GitHub commit and passes ClawHub's source provenance readiness check, but community ClawPack bundle releases still display `artifact-only` verification with `hasProvenance=false`.
188
+
Releases are published as a ClawPack npm-pack artifact. Trusted publishing uses GitHub Actions OIDC; no long-lived ClawHub token is stored in repository secrets.
0 commit comments