What makes Agentmfa notable?

986 downloads. Trust evidence available

How should Agentmfa be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

Agentmfa

AgentMFA — request human approval before sensitive actions. Uses MCP tools for registration, identity, and approval flows. Works in Claude Code, Cursor, Open...

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

986

Updated

Oct 11, 2026

Version

1.0.14

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 986 downloads reported by the source. Last updated 10/11/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 11, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 11, 2026
Adoption signal: 986 downloadsadoption · observed Oct 11, 2026
Latest release: 1.0.14release · observed May 3, 2026
Handshake status: UNKNOWNsecurity

What changed

Newest first. Only changes that point at a source are listed.

Release 1.0.14release
- Simplified and clarified setup: agent registration now uses the MCP tool and no longer requires a manual CLI step. - Separated subcommands: Only `list` and `status` are CLI/Bash subcommands; registration is handled via tools. - Explicit agent control: Stressed that the agent must recognize sensitive actions and invoke approval—it is not automatic. - Updated tool APIs: Documented new/renamed MCP tools (`register_agent`, `agent_info`, `request_approval`, etc.) and clarified parameters/flows. - Expanded usage examples: Added typical risky actions and best practices for invoking approval. - Included guidance for OpenClaw users on proper tool names.
Observed May 3, 2026 · source

Install and run

Setup complexity: low.

clawhub skill install s17fqm2a0169envyaeaa4bgce5853e6n:agentmfa

Install using `clawhub skill install s17fqm2a0169envyaeaa4bgce5853e6n:agentmfa` in an isolated environment before connecting it to live workloads.
No published capability contract is available yet, so validate auth and request/response behavior manually.
Review the upstream CLAWHUB listing at https://clawhub.ai/leiarenee/agentmfa before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/snapshot"

Run-check

$0.02 USD

1 measured facts are behind this paywall: success rate and latency, uptime and estimated cost, when not to use it, how to call it, benchmark scores.

Agents pay $0.02 in USDC. A card payment is $0.50, the smallest a card allows.

Documentation

CLAWHUB

76,544 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: agentmfa
description: AgentMFA — request human approval before sensitive actions. Uses MCP tools for registration, identity, and approval flows. Works in Claude Code, Cursor, OpenClaw, and any MCP-compatible client.
homepage: https://agentmfa.ai
license: MIT
metadata:
  openclaw:
    emoji: "🔐"
    requires:
      bins:
        - agentmfa
    install:
      - id: brew
        kind: shell
        command: "brew install agentmfa/cli/agentmfa && agentmfa auth login"
        label: "Install AgentMFA CLI and log in"
---

# AgentMFA Skill

**AgentMFA is an opt-in approval system.** The agent must explicitly call these tools before sensitive actions. AgentMFA does not automatically intercept or block anything — the agent decides when to request approval.

When the agent calls `request_approval`, the human operator receives a push notification, reviews the action, and approves or rejects it with biometrics. The agent then decides whether to proceed based on the response.

## Subcommands

These are CLI-only operations, run via Bash:

| Invocation | Action |
|---|---|
| `/agentmfa list` | Run `agentmfa agent list` and display the results. |
| `/agentmfa status` | Run `agentmfa auth status` to show login state. |

---

## About AgentMFA

- **Operator:** AgentMFA (https://agentmfa.ai)
- **MCP server:** `agentmfa serve` — part of the AgentMFA CLI; stdio MCP on your machine, talking to `api.agentmfa.ai`
- **Auth:** OAuth via `agentmfa auth login` (session in the system keychain)
- **Privacy & security policy:** https://agentmfa.ai/privacy
- **Source code:** https://github.com/agentmfa/agentmfa (fully open source)

The `agentmfa` CLI must be installed and logged in before this skill can be used.

## Setup

```sh
# 1. Install the CLI
brew install agentmfa/cli/agentmfa

# 2. Log in (opens browser for OAuth)
agentmfa auth login
```

Registration happens automatically via the `register_agent` MCP tool — no manual step needed.

## When to Use

The agent should call AgentMFA tools before:
- Deleting or modifying production data
- Deploying code to production
- Sending emails or messages on behalf of the user
- Actions that could result in financial charges or transactions
- Modifying infrastructure (cloud resources, DNS, etc.)
- Any action the agent recognizes as sensitive or irreversible

**Common risky actions requiring approval:**
- `git push --force` or rewriting history
- `kubectl delete` on production resources
- `kubectl apply/edit` to running workloads
- `terraform apply` (especially with deletions shown in plan)
- `terraform destroy` on any environment
- `rm -rf` or bulk file deletions
- Database schema changes or deletions
- Modifying secrets (SOPS encrypt/decrypt)
- Force pushing branches (`git push -f`)
- Checking out or switching branches in production repos

**Note:** AgentMFA does not automatically detect sensitive actions. The agent must recognize the risk and explicitly invoke the approval flow.

## How to Use

This skill uses the AgentMFA

_meta.json

{
  "ownerId": "kn7649qhpdar9qk5q42dx6k2698537f1",
  "slug": "agentmfa",
  "version": "1.0.14",
  "publishedAt": 1777783093905
}

references/errors.md

# AgentMFA Error Handling

## Tool call outcomes

| Status | Meaning | Action |
|--------|---------|--------|
| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |
| `rejected` | Human rejected | Abort the action; inform the user |
| `expired` | Request timed out | Abort; treat as rejected |

## Rules

- Never proceed without `"status": "approved"`
- Never retry a rejected request automatically — only the human can re-initiate
- Never reuse a `code` — each approval generates a unique one-time approval code

references/examples.md

# AgentMFA MCP Examples

These examples show how an agent (Claude Code, Cursor, or any client running `agentmfa serve`) should use the AgentMFA MCP tools. No HTTP calls, no environment variables — just tool calls. Parameter names match the `agentmfa serve` stdio server.

---

## Basic approval before a destructive action

```
// Step 1 — request approval (short label in action, detail in context)
request_approval(
  action: "Delete S3 bucket prod-data",
  context: "2.3GB of production backups from 2024; irreversible",
  risk_level: "high"
)
// → JSON with id (use as request_id), e.g. { "id": "abc-123", "status": "pending", ... }

// ⚠️  Tell the user: "Request sent — waiting for your approval on the phone..."

// Step 2 — wait for human decision
wait_for_approval(request_id: "abc-123")
// → JSON when status is no longer pending (fields depend on API), e.g.:
//   { "status": "approved", "code": "..." }  or similar
// → or timeout: { "status": "expired", "message": "..." }  — treat as rejected

// Step 3 — act on result
if approved / success  → relay any human-facing message, then proceed
if rejected / expired  → abort, tell user the action was not approved
```

---

## With custom timeout

```
wait_for_approval(
  request_id: "abc-123",
  timeout_seconds: 120   // default is 300; server polls about every 3s
)
```

---

## Non-blocking (manual polling)

```
// Request
request_approval(
  action: "Send invoice emails",
  context: "247 recipients; batch job"
)
// → use "id" from the response as request_id

// Do other preparation work here...

// Check when ready
check_approval_status(request_id: "xyz-456")
// → { "status": "pending" }   ← still waiting
// → { "status": "approved", "code": "..." }  ← done (exact fields from API)
```

---

## Risk levels

| risk_level | When to use |
|---|---|
| `low` | Reversible actions, small blast radius |
| `medium` | Default — partially reversible or moderate impact |
| `high` | Irreversible, large blast radius, or financial impact |

skill-card.md

## Description:

AgentMFA requests human approval before sensitive actions using MCP tools for registration, identity, and approval flows across MCP-compatible clients.

This skill is ready for commercial/non-commercial use.

## Publisher:

[leiarenee](https://clawhub.ai/user/leiarenee)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and agent operators use AgentMFA to require explicit human approval before destructive, financial, production, messaging, infrastructure, or other sensitive actions performed by an MCP-compatible agent.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: The setup flow installs an unpinned external CLI, which can change between reviews.

Mitigation: Review the CLI source and install provenance, and pin or mirror a reviewed CLI version for sensitive environments.

Risk: Approval codes or one-time proof tokens could be exposed if they are logged or pasted into chat.

Mitigation: Treat approval codes and tokens as transient secrets; do not log, persist, or echo them in user-visible transcripts.

Risk: AgentMFA is opt-in, so sensitive actions are not protected unless the agent explicitly requests approval.

Mitigation: Require the agent workflow to request approval before sensitive actions and to abort when approval is rejected, expired, or missing.

## Reference(s):

- [AgentMFA homepage](https://agentmfa.ai)
- [AgentMFA privacy and security policy](https://agentmfa.ai/privacy)
- [AgentMFA MCP Examples](references/examples.md)
- [AgentMFA Error Handling](references/errors.md)
- [ClawHub skill page](https://clawhub.ai/leiarenee/skills/agentmfa)

## Skill Output:

**Output Type(s):** [Guidance, Shell commands, Configuration instructions]

**Output Format:** [Markdown with inline tool-call examples and shell commands]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Requires the agentmfa CLI and an MCP-compatible client; approval checks are opt-in and must be invoked by the agent.]

## Skill Version(s):

1.0.14 (source: server release evidence)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 3d agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular