This content originally appeared on DEV Community and was authored by Lars
Originally published at moltrust.ch/blog/openclaw-plugin.html
OpenClaw crossed 188,000 GitHub stars in roughly sixty days. Agents can now hold wallets, execute payments, install skills autonomously, and communicate with each other across platforms.
But there's a structural gap no amount of malware scanning fixes: OpenClaw has no agent identity system.
- 341 malicious skills found on ClawHub (Koi Security, Jan 2026)
- 13.4% of scanned ClawHub skills had critical security issues (Snyk)
- 135,000 exposed instances running with default configuration
Today we're releasing @moltrust/openclaw — W3C DID verification and reputation scoring as a native OpenClaw plugin.
Install
openclaw plugins install @moltrust/openclaw
Then restart your gateway.
What it does
| Feature | Details |
|---|---|
moltrust_verify |
Verify any agent's W3C DID — returns VC details + trust score |
moltrust_trust_score |
0–100 reputation by DID or EVM wallet address |
/trust <did> |
Slash command in any OpenClaw channel |
/trustscore 0x... |
Free, no API key needed |
openclaw moltrust |
CLI subcommand |
| Self-verify on start | Your own DID checked at every gateway boot |
Trust scores
🟢 80–100 (A) — trusted, safe to delegate
🟡 60–79 (B) — generally trustworthy
🟠40–59 (C) — proceed with caution
🔴 0–39 (D) — high risk, do not delegate
Scores combine: on-chain transaction history, DID registration age, Verifiable Credential portfolio, sybil cluster analysis, funding trace.
Configuration
{
"plugins": {
"entries": {
"moltrust": {
"enabled": true,
"config": {
"apiKey": "mt_live_...",
"minTrustScore": 40,
"verifyOnStart": true,
"agentDid": "did:moltrust:..."
}
}
}
}
}
Free tier available — wallet scoring requires no API key.
Why this matters: KYA
This plugin is the entry point for Know Your Agent (KYA) — the agent-economy equivalent of KYC, but cryptographic and decentralized.
OpenClaw agents interact autonomously. They pay for services, delegate tasks, install skills. The question "who is this agent and can I trust it?" is not philosophical — it's an operational requirement with financial consequences.
Email shipped without authentication — we got phishing. Social media shipped without identity verification — we got bot armies. Package managers shipped without code signing — we got supply chain attacks. OpenClaw is following the same trajectory.
MolTrust provides the infrastructure: W3C DIDs anchored on Base L2, Verifiable Credentials signed with Ed25519, and a reputation layer that aggregates signals into a single trust score.
Links
- 📦 npm: npmjs.com/package/@moltrust/openclaw
- đź’» GitHub: github.com/MoltyCel/moltrust-openclaw
- 🔑 Free API key: api.moltrust.ch/auth/signup
- đź“„ KYA Whitepaper: moltrust.ch/MolTrust_KYA_Whitepaper.pdf
RFC coming to openclaw/openclaw discussions — feedback welcome.
This content originally appeared on DEV Community and was authored by Lars
Lars | Sciencx (2026-03-18T18:42:50+00:00) 🦞 OpenClaw has 188k stars. It has no trust layer. We built it.. Retrieved from https://www.scien.cx/2026/03/18/%f0%9f%a6%9e-openclaw-has-188k-stars-it-has-no-trust-layer-we-built-it-2/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.