MuHaven RWA Portfolio — OpenClaw skill

This skill bundles a curated subset of @muhaven/mcp plus an OpenClaw-shaped config bundle. It runs in OpenClaw's NemoClaw runtime (or any MCP host that honours the manifest's permissions block) and connects to the live MuHaven backend at https://api.muhaven.app.

What it does

• Reads your encrypted RWA portfolio — balances stay encrypted with Fhenix CoFHE; the skill never sees plaintext.
• Stages buy + claim intents for the OpenClaw surface — the skill never auto-submits. Every intent emits a structured confirmation request to one of three tiers based on amount.
• Surfaces audit log for compliance / forensics.
• /pause kill-switch uninstalls the on-chain @zerodev/permissions validator within one Arb block.

What it intentionally cannot do

• Move funds without your passkey. The skill issues unsigned UserOp envelopes; signing happens in the muhaven-broker daemon (≤$200 inline callback) or in your dashboard / Mini App (>$200 tiers).
• Speak to anything outside the egress allowlist. manifest.json's network.deny_default: true means a tampered binary cannot exfiltrate to a third party.
• Read or write your filesystem. permissions.filesystem.{read,write}: [].
• Spawn child processes. permissions.process.spawn: [].
• Store any secret. JWT lives in muhaven-broker's OS-keychain entry; the skill calls the broker over Unix-socket / named-pipe IPC.

How to install

1. Install plain OpenClaw + ClawHub CLI globally:

   npm install -g openclaw@latest clawhub
   openclaw --version    # confirm install
   clawhub --version
   

   (Runtime decision 2026-05-11: plain OpenClaw under sandbox.fallback: host_native. NemoClaw remains the preferred runtime claim in manifest.json for forward-compat; today's deploy targets plain OpenClaw.)
2. Install the broker daemon separately as a global so its bin lands on $PATH regardless of ClawHub's bin-handling:

   npm install -g @muhaven/[email protected]
   muhaven-broker --version    # sanity check
   

   (The skill itself bundles @muhaven/mcp inline since 0.1.1 via tsup noExternal, so no separate npm install --omit=dev is needed after clawhub install. The global install of @muhaven/mcp is still useful because it puts the muhaven-broker daemon bin on $PATH — the skill's bundled copy of @muhaven/mcp only exposes the MCP server, not the daemon CLI.)
3. Install the skill:

   clawhub install [email protected]
   

4. Start the broker daemon: muhaven-broker (see @muhaven/mcp README).
5. Authenticate: muhaven-broker login — opens browser to https://muhaven.app/link?code=XXXX-XXXX, complete passkey.
6. Optional: link your Telegram account for the /agent/openclaw/* confirmation surface. From the dashboard /agent page → Telegram tab → "Link Telegram" → message the bot at @muhaven_bot with the one-time link code.

Confirmation tiers

The skill never executes a state-mutating action without a confirmation. Three tiers based on intent notional (USDC):

Tier boundaries are audit-logged in agent_audit_events with the amount-bucket the intent fell into. Investors can lower the boundaries in the dashboard /agent policy tab; they cannot raise them above the hardcoded ceilings (regulatory + Reg BI Care Obligation).

Hardening invariants (do NOT relax without audit)

• permissions.network.deny_default: true — every new endpoint requires a manifest update + signed re-publish.
• permissions.secrets.storage: os_keychain — paste-token UX is forbidden.
• runtime.type: node — no shell, no Python, no JIT-compiled blob.
• mcp.toolset_subset is the only set of tools the skill will dispatch to — additions require an ADR + signed re-publish.
• Sigstore signing + GitHub OIDC trusted publishing — long-lived ClawHub tokens are not used. ClawHavoc (Feb 2026) precedent.
• required_reviewers: 2 — single-maintainer publish is rejected at the policy gate. Two-maintainer release is the lesson from the Anthropic MCP SDK STDIO arbitrary-command CVEs (Apr 2026).

Tool inventory (subset of @muhaven/mcp)

See manifest.json and the upstream descriptors in @muhaven/mcp/src/tools/descriptions.ts. The skill only re-advertises the mcp.toolset_subset listed in this frontmatter; descriptor SHA-256 hashes are pinned in tool-hashes.json and verified on every skill load (mcp-context-protector pattern, post-MCPoison).

Reference docs

• ADR-C in development/research-docs/WAVE_4_AGENTIC_RESEARCH_RESULT.md
• development/DEV_WAVE_4/TOOL_NAMESPACE.md for the full naming surface
• development/DEV_WAVE_4/THREAT_MODEL_P0.md for OWASP LLM + Agentic mappings

License

MIT. See LICENSE in the repository root.