Openclaw Bridge

bench get-app https://github.com/UniVenture-Solutions/openclaw_bridge

[![Listed on Frappe Gems](https://frappegems.com/api/method/frappe_gems.seo.badge?app=UniVenture-Solutions%2Fopenclaw_bridge)](https://frappegems.com/gems/apps/UniVenture-Solutions/openclaw_bridge)

OpenClaw Bridge

openclaw_bridge is a reusable Frappe app that exposes a readonly MCP-compatible analytics interface for external AI clients such as OpenClaw.

Instead of adding custom nginx routes or standalone sidecar services, this app uses standard Frappe API method routes. That makes it portable across benches and easier to install, update, and maintain.

Purpose

This app lets an external MCP client query analytics data from a Frappe / ERPNext MariaDB database while adding guardrails around how that data is accessed.

It is designed for:

• readonly analytics access
• remote MCP clients that speak JSON-RPC over HTTP
• deployment on ordinary Frappe benches without custom reverse-proxy edits

It is not intended for:

• write operations
• unrestricted SQL execution
• bypassing Frappe or database security controls

Features

• MCP-compatible endpoints exposed through /api/method/...
• HMAC-based request authentication
• nonce replay protection
• rate limiting
• concurrent query limiting
• SQL validation that allows SELECT / WITH only
• readonly transaction execution
• table discovery and schema inspection tools
• audit logging for MCP requests and SQL activity
• install-time secret generation
• install-time readonly DB user provisioning when DB privileges allow it

MCP Tools

The server exposes these tools:

• list_tables Lists queryable tables and views in the configured site database.
• describe_table Returns column metadata for a requested table.
• run_sql_readonly Executes validated readonly SQL with optional parameters and row limit.
• health_check Returns bridge and policy health information.

Public API Routes

No custom nginx or supervisor wiring is required. Once the app is installed on a site, the public endpoints are:

• POST /api/method/openclaw_bridge.api.mcp
• GET /api/method/openclaw_bridge.api.mcp_sse
• GET /api/method/openclaw_bridge.api.health_check

There is also an admin-only helper:

• GET /api/method/openclaw_bridge.api.bridge_config_summary

Authentication

Every MCP request must include these headers:

• X-Key-Id
• X-Timestamp
• X-Nonce
• X-Signature

The signature is lowercase hex HMAC-SHA256 over:

```text \n