
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@ontos-ai/knowhere-claw
Advanced tools
OpenClaw plugin for Knowhere-powered document ingestion and automatic grounding.
Knowhere is an OpenClaw plugin that parses documents and URLs with Knowhere, stores extracted Knowhere files in OpenClaw state, and gives agents a browse-first toolset for grounded document work.
Quick mental model:
plugins.entries."knowhere-claw".configknowhere and knowhere_memory skills steer the agent toward the right toolsThis plugin runs inside the OpenClaw Gateway process.
If your agents talk to a remote Gateway, install and configure the plugin on the machine running that Gateway, then restart that Gateway.
session, agent, or global scopeknowhere and knowhere_memory skills so agents prefer this
toolchain for document-heavy tasks and knowledge-base lookupsopenclaw plugins install @ontos-ai/knowhere-claw
Restart the Gateway afterwards.
Set config under plugins.entries."knowhere-claw".config:
{
plugins: {
allow: ["knowhere-claw"],
entries: {
"knowhere-claw": {
enabled: true,
config: {
// apiKey is optional
},
},
},
},
}
Config notes:
apiKey: optional Knowhere API key. If omitted, the plugin falls back to
KNOWHERE_API_KEY and any API key previously stored with
knowhere_set_api_key.https://knowhereto.ai/api-keys.baseUrl: optional Knowhere API base URL. Falls back to
KNOWHERE_BASE_URL and defaults to https://api.knowhereto.ai.storageDir: optional directory for persisted parsed documents. By default,
the plugin stores data under the OpenClaw state directory for
knowhere-claw.scopeMode: document sharing boundary. Supported values are session,
agent, and global. If omitted, the plugin defaults to session.pollIntervalMs, pollTimeoutMs, requestTimeoutMs, uploadTimeoutMs:
optional tuning for job polling, API calls, and large uploads.storageDir such as
/home/<user>/.openclaw/plugin-state/knowhere makes stored documents
easier to inspect, back up, or clean up.Once the plugin is enabled, you can ask an OpenClaw agent to:
The bundled knowhere skill teaches agents to use the knowhere_* tools
instead of raw file reads when document parsing matters.
The bundled knowhere_memory skill teaches agents to treat previously parsed
Knowhere content as a knowledge base when users ask to search their materials,
look something up, or summarize what data they already have.
If you use skill filters or allowlists in OpenClaw, keep the bundled
knowhere and knowhere_memory skills enabled or the tools will load without
their intended usage guidance.
If your agent runtime uses a tool allowlist, include knowhere_* so agents can
actually call the plugin tools.
scopeMode controls who can reuse parsed documents:
session: only the current session can reuse the stored documentsagent: all conversations for the same agent can reuse themglobal: all agents on the same Gateway can reuse themWithin each scope, the plugin keeps:
index.json cache of stored document summariesmetadata/ directory with one JSON record per stored documentknowhere_ingest_document with blockUntilComplete: true.knowhere_read_chunks now treats [images/...] and [tables/...] path references in chunks.json content as the primary media enrichment path.image and table chunks resolve their real asset locations from metadata.file_path.metadata.file_path are ignored by the runtime enrichment and delivery pipeline.apiKey config is optional. You can set
plugins.entries."knowhere-claw".config.apiKey, export
KNOWHERE_API_KEY, or let the plugin guide the user to
https://knowhereto.ai/api-keys and store the key with
knowhere_set_api_key.scopeMode from
session to agent or global.knowhere skill is not filtered out.pollTimeoutMs or uploadTimeoutMs.Contributor-oriented architecture, workflow, and packaging notes live in
DEVELOPMENT.md at the repository root.
Release-process details for maintainers live in
docs/release-workflow.md.
FAQs
OpenClaw plugin for Knowhere-powered document ingestion and automatic grounding.
The npm package @ontos-ai/knowhere-claw receives a total of 59 weekly downloads. As such, @ontos-ai/knowhere-claw popularity was classified as not popular.
We found that @ontos-ai/knowhere-claw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.