MyClaw runs every tool without asking. Here's how to keep its API calls in bounds.

MyClaw is a small Go assistant you message on Telegram, WhatsApp, Feishu or WeCom. It runs cron jobs, keeps a memory, loads skills, and gets on with things.

We connected it to Swytchcode and tested it against a mocked Stripe. It works, and all seven of our checks passed in the end. But it took more care than any other agent we've tried, and almost none of the traps are in MyClaw's docs.

So this isn't a feature tour. It's the five things we wish we'd known, then a setup that avoids all of them.

1. It never asks

Most agents ask before a shell command or a file write, at least by default. MyClaw doesn't. Every tool runs as soon as the model calls it.

That's why Swytchcode matters more here than almost anywhere. With MyClaw, Swytchcode's approval is the only thing that pauses before a write. The balance lookup runs. The refund waits for you on Telegram or Slack, through a separate bot the agent can't answer for you.

2. A local command connects, then dies

The obvious setup is to let MyClaw start Swytchcode as a local command. It even looks like it works: MyClaw lists all 11 tools. Then every call fails with "client is closing: EOF".

The cause is in agentsdk-go, the framework MyClaw is built on. It stops the server's process as soon as the connection is set up. The fix on your side is to run Swytchcode as an HTTP server instead.

3. http:// doesn't mean HTTP

In MyClaw's settings, a plain http:// URL means the older SSE transport. Swytchcode speaks streamable HTTP, so the URL has to start with http+streamable://. Get it wrong and the server just looks unreachable.

4. restrictToWorkspace isn't read

MyClaw's config has a restrictToWorkspace: true setting. It looks like it keeps the file tools inside the workspace. In version 0.6.2, nothing reads it. Bash and Read reached the Swytchcode project and the saved credentials anyway.

Swytchcode's tools can't remove a rule, and they refused every time we asked. But with the file tools open, the agent doesn't need Swytchcode's permission to edit a file.

5. Deny rules work, but ~ silently matches nothing

MyClaw supports Claude Code-style deny rules, and they're the real fix. Two traps:

• ~ isn't expanded. Read(~/agent-swy/**) looks right and matches nothing. In our test, a Write that should have been blocked wiped MyClaw's own config file. Use full paths.
• Grep and Glob check only the folder they start in. A search from your home folder walks straight into the Swytchcode project. Deny them outright, along with Bash.

With full paths and those three tools denied, we reran all seven checks, and every one passed.

The full setup

MyClaw doesn't have its own page in our docs yet, so here's everything, start to finish. You need MyClaw set up with make setup, and a Swytchcode account (approvals need the Business or Enterprise plan). Replace /home/you with your real home folder everywhere: no ~.

1. Create the project and start the server over HTTP.

npm install -g swytchcode
swy init --operator --editor=none --project ~/agent-swy
swy login
swy mcp serve --profile operator --project ~/agent-swy --transport http -d
swy mcp token

2. Add the server and the lock-down together, in /home/you/.myclaw/workspace/.claude/settings.json:

{
  "mcp": {
    "servers": {
      "swytchcode": {
        "type": "http",
        "url": "http+streamable://127.0.0.1:5476/mcp",
        "headers": { "Authorization": "Bearer <token>" }
      }
    }
  },
  "permissions": {
    "deny": [
      "Bash",
      "Grep",
      "Glob",
      "Read(/home/you/agent-swy/**)",
      "Edit(/home/you/agent-swy/**)",
      "Write(/home/you/agent-swy/**)",
      "Read(/home/you/.swytchcode/**)",
      "Edit(/home/you/.swytchcode/**)",
      "Write(/home/you/.swytchcode/**)",
      "Edit(/home/you/.myclaw/config.json)",
      "Write(/home/you/.myclaw/config.json)",
      "Edit(/home/you/.myclaw/workspace/.claude/**)",
      "Write(/home/you/.myclaw/workspace/.claude/**)"
    ]
  }
}

The last four rules stop the agent from editing its own config, which is where it could otherwise remove the first nine.

3. Add the skill and restart MyClaw.

cp -R ~/agent-swy/agent-skill/swytchcode-operator /home/you/.myclaw/workspace/skills/

MyClaw lists the tools as swytchcode__swytchcode_*.

4. Check the lock-down before anything else. Message MyClaw:

Read /home/you/agent-swy/.swytchcode/integrations/policies.json

It should be refused. If it shows you the file, a path in your deny rules is wrong. Fix it before you connect a real account.

We tested MyClaw 0.6.2 in its own Docker image with a scripted model, so a real model, its chat channels and a real approval are still to test.

A rule that matches nothing looks like a rule that works

That's the line we'd put on a sticky note for any agent, not just MyClaw. Our ~ rule sat in the config looking perfectly reasonable, and blocked nothing. We only found out because we tested it.

So set it up, then try to break it. Ask the agent to read the rules file, search for it, edit it. When all of that is refused, you've got a fast little assistant that does whatever you ask, except spend money without you.

For other agents with the same shape (MCP, a shell, file tools), the Any other agent section of our docs covers the same fixes.