# pREST for OpenClaw
Official OpenClaw plugin for building PostgreSQL-backed APIs with [pREST](https://github.com/prest/prest).
**Package:** `@prest/prest-openclaw`
This plugin helps OpenClaw agents generate pREST configs, create SQL template routes, review security risks, and set up MCP workflows — without replacing pREST itself.
## What it does
- **Skills** — guided workflows for config generation, SQL routes, security review, MCP setup, and project explanation
- **Examples** — `prest.toml`, Docker Compose, read-only Postgres roles, and MCP config samples
- **Security guidance** — least-privilege defaults, env-based secrets, MCP exposure warnings
## What it does not do
- Does **not** run pREST or PostgreSQL
- Does **not** implement MCP tools — pREST serves HTTP MCP at `/_mcp`; the [`prest-mcp`](https://github.com/prest/prest-mcp-adapter) adapter bridges stdio clients to that endpoint
## Related projects
| Project | Role |
|---------|------|
| [prest/prest](https://github.com/prest/prest) | PostgreSQL REST API server (HTTP MCP at `/_mcp`) |
| [prest/prest-mcp-adapter](https://github.com/prest/prest-mcp-adapter) | stdio MCP bridge (`prest-mcp`) |
| [prest/prest-cursor](https://github.com/prest/prest-cursor) | Cursor marketplace plugin (separate repo) |
| [prest/homebrew-tap](https://github.com/prest/homebrew-tap) | Homebrew packages including `prest-mcp` |
## Install from ClawHub
```bash
openclaw plugins install clawhub:@prest/prest-openclaw
openclaw plugins inspect prest
```
Enable the plugin in your OpenClaw config if it is not enabled by default, then restart the gateway:
```bash
openclaw gateway restart
```
## Skills included
| Skill | Purpose |
|-------|---------|
| `generate-config` | Generate `prest.toml`, `.env.example`, optional Docker Compose |
| `generate-sql-route` | Parameterized SQL under `/_QUERIES/` |
| `review-security` | Audit configs, SQL, auth, and MCP exposure |
| `setup-mcp` | Wire `prest-mcp` and read-only Postgres for agents |
| `explain-config` | Plain-language `prest.toml` walkthrough |
| `prest-core-guidance` | Core pREST development rules |
| `prest-security-guidance` | Security defaults and warnings |
| `prest-mcp-guidance` | MCP and `prest-mcp` connection patterns |
| `agent-prompts` | Copy-paste prompts for common tasks |
## MCP setup
pREST exposes HTTP MCP at `/_mcp`. For stdio MCP clients:
```bash
brew install prest/tap/prest-mcp
export PREST_MCP_URL='http://localhost:3000/_mcp'
# export PREST_MCP_TOKEN='...' # when auth is required
prest-mcp
```
| Variable | Required | Description |
|----------|----------|-------------|
| `PREST_MCP_URL` | Yes | Full MCP URL, e.g. `http://localhost:3000/_mcp` |
| `PREST_MCP_TOKEN` | No | Bearer token for authenticated MCP |
| `PREST_MCP_TIMEOUT_MS` | No | Request timeout override |
MCP Registry name: `io.github.prest/prest`
See `examples/mcp-readonly/openclaw-mcp.example.json` for an OpenClaw MCP config template.
## Security recommendations
- Never expose `/_mcp`, Postgres, or pREST publicly without authentication
- Prefer read-only PostgreSQL users for AI/agent workflows
- Use environment variables for secrets — never commit real credentials
- Set `access.restrict = true` with explicit `[[access.tables]]` in production
- Avoid `debug = true` outside local development (disables JWT enforcement)
- Do not use write-capable database roles in MCP configs
## Local development
Clone and validate before publishing:
```bash
git clone https://github.com/prest/prest-openclaw.git
cd prest-openclaw
clawhub package validate .
npm pack --dry-run
```
Install locally for testing:
```bash
openclaw plugins install ./prest-openclaw
```
## Troubleshooting
### Package scope must match owner
If publish fails with a scope/owner mismatch, publish as owner `prest` or file an [Org / Namespace Claim](https://docs.openclaw.ai/clawhub/publishing#plugins) — do not publish under a personal namespace without approval.
### Validation errors
Run `clawhub package validate .` and see [Plugin validation fixes](https://docs.openclaw.ai/clawhub/plugin-validation-fixes).
### MCP connection fails
- Confirm pREST is running: `curl http://localhost:3000/_health`
- Verify `PREST_MCP_URL` ends with `/_mcp`
- Set `PREST_MCP_TOKEN` if the endpoint requires auth
- Ensure `prest-mcp` is on `PATH` (`brew install prest/tap/prest-mcp`)
### Skills not appearing
- Confirm the plugin is enabled in OpenClaw config
- Restart the gateway after install
- Run `openclaw plugins inspect prest`
## Examples
| Example | Description |
|---------|-------------|
| `examples/basic-rest/` | Docker Compose + minimal `prest.toml` |
| `examples/sql-template-route/` | Custom query under `/_QUERIES/` |
| `examples/multi-database/` | Multi-DB `[[databases]]` config |
| `examples/mcp-readonly/` | Read-only role + `prest-mcp` wiring |
## License
MIT — see [LICENSE](LICENSE).
قراءة الملف الأصلي