OpenClaw is easy to talk about incorrectly. A normal API connector is usually not a native OpenClaw harness. It is an MCP server or plugin/config bundle that lets an agent runtime call the API as tools.
That distinction matters for product safety.
Connector, not harness
A native harness owns low-level agent execution concerns: runtime behavior, session control, transcript handling, tool policy, and approvals.
An API connector does not need to replace that. Sourced exposes API tools through MCP and lets the agent runtime keep control of the rest.
For most OpenAPI specs, the right generated artifact is:
- a TypeScript MCP server
- an OpenClaw MCP/plugin manifest
- a safe default tool list
- sensitive and destructive tool notes
- tests proving the defaults
What OpenAPI contributes
OpenAPI tells the generator:
- which operations exist
- what inputs they accept
- where the API lives
- what auth the upstream API expects
- which operation IDs are stable
Sourced adds a safety pass and emits the OpenClaw bundle as a config surface, not as a claim that the API is an agent runtime.
What the generated bundle says
The generated OpenClaw bundle is explicit:
agentHarness: false- the MCP server command or hosted URL
- default-enabled tools
- sensitive read tools
- destructive tools
- auth environment variables
- maintainer review notes
That prevents the biggest UX failure: making a user think they generated a full harness when they actually generated API tools.
Approval path
OpenClaw-facing API tools follow the same owner approval path as other agent connectors:
- Generate the pack from OpenAPI.
- Review the agent-readiness report.
- Run local tests.
- Keep sensitive reads and destructive tools out of defaults.
- Add mutating tools only after reviewing side effects and audit behavior.
The generated PR_PLAN.md explains exactly what would be added to the customer's repo and makes clear that Sourced will not merge or approve its own work.
Better product behavior
The interface avoids repo URL paste work when a connected repo flow can do the job. It asks for a hosted MCP URL only after the user has a deployable pack, and it shows one missing thing at a time.
That is how generated connector setup stays understandable even when the ecosystem names are new.