Your agent needs a skill whitelist — here's how to stop it from installing random tools

Your agent just installed a "stock ticker" MCP server from GitHub. You didn't ask for it. You're not even trading stocks. But your agent decided it needed real-time market data to answer a question about business metrics, found some random repository, and now has access to... who knows what.

This is happening everywhere. Agents are discovering and installing MCP skills on their own, treating your system like their personal app store. Most of the time it's harmless. Sometimes it's not.

The solution isn't to disable skill discovery — that kills the magic. The solution is a skill whitelist that lets your agent explore safely.

A skill whitelist is a pre-approved list of MCP servers your agent can install and use. Think of it like a corporate app store — curated, tested, and safe.

Here's how to set one up:

// ~/.openclaw/config/skills-whitelist.json
{
  "approved_repositories": [
    "github.com/openclaw/mcp-*",
    "github.com/anthropic/mcp-*",
    "github.com/your-org/*"
  ],
  "approved_skills": [
    "file-operations",
    "web-search",
    "calendar-access",
    "email-sender"
  ],
  "auto_install": true,
  "require_approval": [
    "*database*",
    "*payment*",
    "*admin*"
  ]
}

Add this to your agent's system prompt:

SKILL INSTALLATION RULES:
- Only install skills from your approved whitelist
- If you need a skill not on the whitelist, ask for permission first
- Never install skills with database, payment, or admin capabilities without explicit approval
- When installing, explain why you need the skill and what it does

The magic happens in the require_approval section. Any skill matching those patterns triggers a confirmation prompt instead of auto-installing. Your agent will say something like:

"I found a PostgreSQL MCP server that could help with your database query, but it requires approval because it has database access. Should I install it?"

Much better than discovering your agent installed a database admin tool while you were getting coffee.

You can also set up repository patterns. The github.com/openclaw/mcp-* pattern means your agent can auto-install any official OpenClaw MCP server, but needs permission for random GitHub repositories.

Warning: Don't make your whitelist too restrictive. If your agent can't find the tools it needs, it'll either give up or try to reinvent them badly. Start permissive and tighten based on what you see.

The whitelist isn't about preventing your agent from getting new capabilities — it's about making sure those capabilities come from sources you trust. Your agent should still be able to discover and use new tools. It just shouldn't be able to install a random "system optimizer" from some sketchy repository.

This pattern works because it preserves the exploratory nature of agents while adding a safety net. Your agent can still say "I need a PDF parser" and go find one — it just has to pick from the approved list.

Most people either give their agent zero installation permissions (boring) or full installation permissions (dangerous). The whitelist gives you the middle path: supervised autonomy.