{"id":"5dc93ff7-70b9-4abf-9323-2949d8888e8c","entityType":"agent","slug":"clawhub-leiarenee-agentmfa","name":"Agentmfa","canonicalUrl":"https://www.xpersona.co/agent/clawhub-leiarenee-agentmfa","canonicalPath":"/agent/clawhub-leiarenee-agentmfa","generatedAt":"2026-10-12T12:43:53.647Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:16:56.179Z","emptyReason":null},"description":"AgentMFA — request human approval before sensitive actions. Uses MCP tools for registration, identity, and approval flows. Works in Claude Code, Cursor, Open...","descriptionLabel":"Source description","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 986 downloads reported by the source. Last updated 10/11/2026.","installCommand":"clawhub skill install s17fqm2a0169envyaeaa4bgce5853e6n:agentmfa","sourceUrl":"https://clawhub.ai/leiarenee/agentmfa","homepage":"https://clawhub.ai/leiarenee/skills/agentmfa","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/leiarenee/agentmfa","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/leiarenee/skills/agentmfa","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":60,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Agentmfa technical dossier on Xpersona with agent coverage, OPENCLEW support, and live trust metadata."},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:16:56.179Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:16:56.179Z","emptyReason":null},"stars":null,"forks":null,"downloads":986,"likes":null,"task":null,"library":null,"packageName":null,"latestVersion":"1.0.14","tractionLabel":"986 downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:16:56.166Z","emptyReason":null},"lastUpdatedAt":"2026-10-11T22:16:56.179Z","lastCrawledAt":"2026-10-11T22:16:56.166Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-12T22:16:56.166Z","lastVerifiedAt":null,"highlights":[{"version":"1.0.14","createdAt":"2026-05-03T04:38:13.905Z","changelog":"- Simplified and clarified setup: agent registration now uses the MCP tool and no longer requires a manual CLI step. - Separated subcommands: Only `list` and `status` are CLI/Bash subcommands; registration is handled via tools. - Explicit agent control: Stressed that the agent must recognize sensitive actions and invoke approval—it is not automatic. - Updated tool APIs: Documented new/renamed MCP tools (`register_agent`, `agent_info`, `request_approval`, etc.) and clarified parameters/flows. - Expanded usage examples: Added typical risky actions and best practices for invoking approval. - Included guidance for OpenClaw users on proper tool names.","fileCount":5,"zipByteSize":5799},{"version":"1.0.13","createdAt":"2026-05-02T22:27:19.842Z","changelog":"AgentMFA skill v1.0.13 - Added CLI subcommands: /agentmfa register, list, and status — now supports agent registration and management directly via Bash. - Expanded documentation for setup, install instructions, and specific guidance for Cursor and Claude Code. - Clarified how to use MCP tools for requesting and waiting for approvals. - Updated metadata: includes homepage, command-line requirements, and improved installation directions. - Enhanced security and usage notes: tokens/approval codes are not to be logged or pasted into chat.","fileCount":4,"zipByteSize":4629},{"version":"1.0.12","createdAt":"2026-05-02T19:43:25.298Z","changelog":"- Added _meta.json file with skill metadata. - SKILL.md: Streamlined setup instructions, removing environment variable and install details. - Documentation now reflects that no HTTP calls or environment variables are needed to use the skill. - Clarified logging requirements for approval codes. - Minor copyedits and updated examples for clarity and brevity.","fileCount":4,"zipByteSize":3305},{"version":"1.0.11","createdAt":"2026-04-19T00:47:23.801Z","changelog":"- Added security best practices for production use, recommending MCP server version pinning instead of using latest. - Included instructions to verify the MCP server binary hash against published checksums before installing. - No code changes; documentation updates only.","fileCount":4,"zipByteSize":3681},{"version":"1.0.10","createdAt":"2026-04-19T00:36:44.608Z","changelog":"- Minor update to rules language: clarified that the approval code is a sensitive one-time token and should not be written to logs or external systems. - No functional or interface changes.","fileCount":4,"zipByteSize":3485},{"version":"1.0.9","createdAt":"2026-04-19T00:29:33.061Z","changelog":"- Updated skill metadata format to streamline environment and installation requirements. - Now explicitly defines AGENTMFA_API_KEY as the primary environment variable in metadata. - Modernized the structure under the \"openclaw\" key for clarity and compatibility. - No functional or file changes to skill behavior.","fileCount":4,"zipByteSize":3501},{"version":"1.0.8","createdAt":"2026-04-18T23:15:12.596Z","changelog":"- Added skill homepage URL to metadata for easier reference. - No other changes to functionality or documentation.","fileCount":4,"zipByteSize":3666},{"version":"1.0.7","createdAt":"2026-04-18T22:57:20.768Z","changelog":"- Added structured metadata under the \"openclaw\" key, specifying required binaries, install instructions for npm, and required environment variables. - No changes to the core functionality or usage documentation of the skill.","fileCount":4,"zipByteSize":3657}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s17fqm2a0169envyaeaa4bgce5853e6n:agentmfa","setupComplexity":"low","setupSteps":["Install using `clawhub skill install s17fqm2a0169envyaeaa4bgce5853e6n:agentmfa` in an isolated environment before connecting it to live workloads.","No published capability contract is available yet, so validate auth and request/response behavior manually.","Review the upstream CLAWHUB listing at https://clawhub.ai/leiarenee/agentmfa before using production credentials."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-12T12:43:53.646Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-leiarenee-agentmfa/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T22:16:56.179Z","emptyReason":null},"readme":"Skill: Agentmfa\n\nOwner: leiarenee\n\nSummary: AgentMFA — request human approval before sensitive actions. Uses MCP tools for registration, identity, and approval flows. Works in Claude Code, Cursor, Open...\n\nTags: latest:1.0.14\n\nVersion history:\n\nv1.0.14 | 2026-05-03T04:38:13.905Z | auto\n\n- Simplified and clarified setup: agent registration now uses the MCP tool and no longer requires a manual CLI step.\n- Separated subcommands: Only `list` and `status` are CLI/Bash subcommands; registration is handled via tools.\n- Explicit agent control: Stressed that the agent must recognize sensitive actions and invoke approval—it is not automatic.\n- Updated tool APIs: Documented new/renamed MCP tools (`register_agent`, `agent_info`, `request_approval`, etc.) and clarified parameters/flows.\n- Expanded usage examples: Added typical risky actions and best practices for invoking approval.\n- Included guidance for OpenClaw users on proper tool names.\n\nv1.0.13 | 2026-05-02T22:27:19.842Z | auto\n\nAgentMFA skill v1.0.13\n\n- Added CLI subcommands: /agentmfa register, list, and status — now supports agent registration and management directly via Bash.\n- Expanded documentation for setup, install instructions, and specific guidance for Cursor and Claude Code.\n- Clarified how to use MCP tools for requesting and waiting for approvals.\n- Updated metadata: includes homepage, command-line requirements, and improved installation directions.\n- Enhanced security and usage notes: tokens/approval codes are not to be logged or pasted into chat.\n\nv1.0.12 | 2026-05-02T19:43:25.298Z | auto\n\n- Added _meta.json file with skill metadata.\n- SKILL.md: Streamlined setup instructions, removing environment variable and install details.\n- Documentation now reflects that no HTTP calls or environment variables are needed to use the skill.\n- Clarified logging requirements for approval codes.\n- Minor copyedits and updated examples for clarity and brevity.\n\nv1.0.11 | 2026-04-19T00:47:23.801Z | user\n\n- Added security best practices for production use, recommending MCP server version pinning instead of using latest.\n- Included instructions to verify the MCP server binary hash against published checksums before installing.\n- No code changes; documentation updates only.\n\nv1.0.10 | 2026-04-19T00:36:44.608Z | user\n\n- Minor update to rules language: clarified that the approval code is a sensitive one-time token and should not be written to logs or external systems.\n- No functional or interface changes.\n\nv1.0.9 | 2026-04-19T00:29:33.061Z | user\n\n- Updated skill metadata format to streamline environment and installation requirements.\n- Now explicitly defines AGENTMFA_API_KEY as the primary environment variable in metadata.\n- Modernized the structure under the \"openclaw\" key for clarity and compatibility.\n- No functional or file changes to skill behavior.\n\nv1.0.8 | 2026-04-18T23:15:12.596Z | user\n\n- Added skill homepage URL to metadata for easier reference.\n- No other changes to functionality or documentation.\n\nv1.0.7 | 2026-04-18T22:57:20.768Z | user\n\n- Added structured metadata under the \"openclaw\" key, specifying required binaries, install instructions for npm, and required environment variables.\n- No changes to the core functionality or usage documentation of the skill.\n\nv1.0.6 | 2026-04-18T22:47:44.443Z | user\n\n- Added documentation for the required environment variable AGENTMFA_API_KEY, including details and description.\n- Updated metadata to include the required environment variable section.\n- Enhanced documentation to clarify open source status of MCP server source code.\n- Minor wording improvements and clarification in usage and rules sections.\n\nv1.0.5 | 2026-04-18T22:38:31.812Z | user\n\n- Clarified that AgentMFA pauses the agent and does not execute actions directly.\n- Added an \"About AgentMFA\" section detailing the MCP server, API key setup, privacy policy, and source code links.\n- Provided clear MCP server requirements and setup instructions.\n- Updated guidance on handling the TOTP code, emphasizing its sensitivity and not logging it unnecessarily.\n- Improved instructions for usage, environment variable requirements, and tool flows.\n\nv1.0.4 | 2026-04-18T22:03:40.437Z | user\n\n- Improved documentation with detailed usage instructions, standard flows, and best practices\n- Clarified use cases for requesting biometric approval on sensitive actions\n- Added comprehensive guidelines for handling approval, rejection, and expiry scenarios\n- Provided MCP tool descriptions for better integration and understanding\n\nArchive index:\n\nArchive v1.0.14: 5 files, 5799 bytes\n\nFiles: _meta.json (128b), references/errors.md (545b), references/examples.md (2041b), skill-card.md (2335b), SKILL.md (5963b)\n\nFile v1.0.14:SKILL.md\n\n---\nname: agentmfa\ndescription: AgentMFA — request human approval before sensitive actions. Uses MCP tools for registration, identity, and approval flows. Works in Claude Code, Cursor, OpenClaw, and any MCP-compatible client.\nhomepage: https://agentmfa.ai\nlicense: MIT\nmetadata:\n  openclaw:\n    emoji: \"🔐\"\n    requires:\n      bins:\n        - agentmfa\n    install:\n      - id: brew\n        kind: shell\n        command: \"brew install agentmfa/cli/agentmfa && agentmfa auth login\"\n        label: \"Install AgentMFA CLI and log in\"\n---\n\n# AgentMFA Skill\n\n**AgentMFA is an opt-in approval system.** The agent must explicitly call these tools before sensitive actions. AgentMFA does not automatically intercept or block anything — the agent decides when to request approval.\n\nWhen the agent calls `request_approval`, the human operator receives a push notification, reviews the action, and approves or rejects it with biometrics. The agent then decides whether to proceed based on the response.\n\n## Subcommands\n\nThese are CLI-only operations, run via Bash:\n\n| Invocation | Action |\n|---|---|\n| `/agentmfa list` | Run `agentmfa agent list` and display the results. |\n| `/agentmfa status` | Run `agentmfa auth status` to show login state. |\n\n---\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** `agentmfa serve` — part of the AgentMFA CLI; stdio MCP on your machine, talking to `api.agentmfa.ai`\n- **Auth:** OAuth via `agentmfa auth login` (session in the system keychain)\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa (fully open source)\n\nThe `agentmfa` CLI must be installed and logged in before this skill can be used.\n\n## Setup\n\n```sh\n# 1. Install the CLI\nbrew install agentmfa/cli/agentmfa\n\n# 2. Log in (opens browser for OAuth)\nagentmfa auth login\n```\n\nRegistration happens automatically via the `register_agent` MCP tool — no manual step needed.\n\n## When to Use\n\nThe agent should call AgentMFA tools before:\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action the agent recognizes as sensitive or irreversible\n\n**Common risky actions requiring approval:**\n- `git push --force` or rewriting history\n- `kubectl delete` on production resources\n- `kubectl apply/edit` to running workloads\n- `terraform apply` (especially with deletions shown in plan)\n- `terraform destroy` on any environment\n- `rm -rf` or bulk file deletions\n- Database schema changes or deletions\n- Modifying secrets (SOPS encrypt/decrypt)\n- Force pushing branches (`git push -f`)\n- Checking out or switching branches in production repos\n\n**Note:** AgentMFA does not automatically detect sensitive actions. The agent must recognize the risk and explicitly invoke the approval flow.\n\n## How to Use\n\nThis skill uses the AgentMFA MCP tools exposed by **`agentmfa serve`**. Your agent uses **only MCP tool calls** — no direct HTTP.\n\nTool parameter names must match the MCP schema your client shows (see table below). Put the **short label** in `action` and **full detail** in `context` so the operator sees enough to decide.\n\n### Standard flow\n\n```\n1. Call register_agent()\n   → Checks if already registered — returns immediately if so\n   → If not registered, registers and waits for approval (auto or mobile)\n   → Returns: { status, tool, remote, message }\n   ⚠️ Relay the message to the user\n\n2. Call request_approval(action, description, context?)\n   → Returns: { request_id, message }\n   ⚠️ Relay the message so the user knows to check their phone\n\n3. Call wait_for_approval(request_id)\n   → Blocks until decided (polls every 1s, default 300s timeout)\n   → Approved: { approved: true, totp_verified, token, agent_totp,\n                  server_time, approved_by, approved_from, message }\n   → Rejected: { approved: false, reason }\n   ⚠️ On approval, relay the message field verbatim\n\n4a. approved == true  → proceed\n4b. approved == false → abort and inform the user\n```\n\n### Identity check\n\nCall `agent_info()` to see the locally detected identity — tool name, repository, branch, machine, code signature, verification mode, and registration status. Useful for debugging.\n\n### Non-blocking check\n\nUse `check_approval_status(request_id)` to poll once without blocking.\n\n## Rules\n\n- **The agent decides when to call AgentMFA** — nothing forces automatic approval checks\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle tokens carefully** — one-time proofs of approval should not be logged or pasted into chat\n\n## MCP Tools\n\n| Tool | Parameters | Purpose |\n|---|---|---|\n| `agent_info` | _(none)_ | Local identity data — tool, repo, branch, machine, signature, registration status |\n| `register_agent` | `role` (optional), `force` (optional boolean) | Register this agent. Checks first, blocks until decided |\n| `request_approval` | `action` (required), `description` (required), `context` (optional), `services` (optional array) | Submit approval request; returns `request_id` + `message` |\n| `wait_for_approval` | `request_id` (required), `timeout` (optional, default 300s) | Block until decided |\n| `check_approval_status` | `request_id` (required) | Single non-blocking poll |\n\n### OpenClaw Users\n\nIn OpenClaw, MCP tools are namespaced with the server name prefix. Use these exact tool names:\n- `agentmfa__agent_info`\n- `agentmfa__register_agent`\n- `agentmfa__request_approval`\n- `agentmfa__wait_for_approval`\n- `agentmfa__check_approval_status`\n\nFile v1.0.14:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.14\",\n  \"publishedAt\": 1777783093905\n}\n\nFile v1.0.14:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code\n\nFile v1.0.14:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how an agent (Claude Code, Cursor, or any client running `agentmfa serve`) should use the AgentMFA MCP tools. No HTTP calls, no environment variables — just tool calls. Parameter names match the `agentmfa serve` stdio server.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval (short label in action, detail in context)\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"2.3GB of production backups from 2024; irreversible\",\n  risk_level: \"high\"\n)\n// → JSON with id (use as request_id), e.g. { \"id\": \"abc-123\", \"status\": \"pending\", ... }\n\n// ⚠️  Tell the user: \"Request sent — waiting for your approval on the phone...\"\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → JSON when status is no longer pending (fields depend on API), e.g.:\n//   { \"status\": \"approved\", \"code\": \"...\" }  or similar\n// → or timeout: { \"status\": \"expired\", \"message\": \"...\" }  — treat as rejected\n\n// Step 3 — act on result\nif approved / success  → relay any human-facing message, then proceed\nif rejected / expired  → abort, tell user the action was not approved\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // default is 300; server polls about every 3s\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(\n  action: \"Send invoice emails\",\n  context: \"247 recipients; batch job\"\n)\n// → use \"id\" from the response as request_id\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done (exact fields from API)\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nFile v1.0.14:skill-card.md\n\n## Description:\n\nAgentMFA requests human approval before sensitive actions using MCP tools for registration, identity, and approval flows across MCP-compatible clients.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[leiarenee](https://clawhub.ai/user/leiarenee)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and agent operators use AgentMFA to require explicit human approval before destructive, financial, production, messaging, infrastructure, or other sensitive actions performed by an MCP-compatible agent.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: The setup flow installs an unpinned external CLI, which can change between reviews.\n\nMitigation: Review the CLI source and install provenance, and pin or mirror a reviewed CLI version for sensitive environments.\n\nRisk: Approval codes or one-time proof tokens could be exposed if they are logged or pasted into chat.\n\nMitigation: Treat approval codes and tokens as transient secrets; do not log, persist, or echo them in user-visible transcripts.\n\nRisk: AgentMFA is opt-in, so sensitive actions are not protected unless the agent explicitly requests approval.\n\nMitigation: Require the agent workflow to request approval before sensitive actions and to abort when approval is rejected, expired, or missing.\n\n## Reference(s):\n\n- [AgentMFA homepage](https://agentmfa.ai)\n- [AgentMFA privacy and security policy](https://agentmfa.ai/privacy)\n- [AgentMFA MCP Examples](references/examples.md)\n- [AgentMFA Error Handling](references/errors.md)\n- [ClawHub skill page](https://clawhub.ai/leiarenee/skills/agentmfa)\n\n## Skill Output:\n\n**Output Type(s):** [Guidance, Shell commands, Configuration instructions]\n\n**Output Format:** [Markdown with inline tool-call examples and shell commands]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Requires the agentmfa CLI and an MCP-compatible client; approval checks are opt-in and must be invoked by the agent.]\n\n## Skill Version(s):\n\n1.0.14 (source: server release evidence)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nArchive v1.0.13: 4 files, 4629 bytes\n\nFiles: _meta.json (128b), references/errors.md (545b), references/examples.md (2041b), SKILL.md (5965b)\n\nFile v1.0.13:SKILL.md\n\n---\nname: agentmfa\ndescription: AgentMFA skill — request human approval before sensitive actions, or manage agent registration. Subcommands: \"register\" (register this agent), \"list\" (list registered agents), \"status\" (check login status). Without a subcommand, use the MCP tools to request approval. Works in Cursor, Claude Code, and any client that spawns the AgentMFA MCP server (`agentmfa serve`).\nhomepage: https://agentmfa.ai\nlicense: MIT\nmetadata:\n  openclaw:\n    emoji: \"🔐\"\n    requires:\n      bins:\n        - agentmfa\n    install:\n      - id: brew\n        kind: shell\n        command: \"brew install agentmfa/cli/agentmfa && agentmfa auth login && agentmfa agent register\"\n        label: \"Install AgentMFA CLI and register this agent\"\n---\n\n# AgentMFA Skill\n\n**AgentMFA does not execute actions.** It pauses your agent and requests biometric approval from the human operator's mobile app. The agent only proceeds — or aborts — based on the human's decision.\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## Subcommands\n\nWhen invoked with a subcommand, handle it immediately using Bash — do not use MCP tools:\n\n| Invocation | Action |\n|---|---|\n| `/agentmfa register` | Run `agentmfa agent register` via Bash. The parent app names the agent (e.g. `claude` in **Claude Code**, `cursor` in **Cursor**). Wait for the user to approve on their phone. |\n| `/agentmfa list` | Run `agentmfa agent list` and display the results. |\n| `/agentmfa status` | Run `agentmfa auth status` to show login state. |\n\nExample — when the user types `/agentmfa register`, execute:\n```bash\nagentmfa agent register\n```\n\n---\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** `agentmfa serve` — part of the AgentMFA CLI; stdio MCP on your machine, talking to `api.agentmfa.ai`\n- **Auth:** OAuth via `agentmfa auth login` (session in the system keychain)\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa (fully open source)\n\nThe `agentmfa` CLI must be installed and the agent registered before this skill can be used. See setup below.\n\n## Setup\n\n```sh\n# 1. Install the CLI\nbrew install agentmfa/cli/agentmfa\n\n# 2. Log in (opens browser for OAuth)\nagentmfa auth login\n\n# 3. Register this agent (requires approval on your phone)\nagentmfa agent register\n```\n\n### Claude Code\n\nUse the AgentMFA plugin from this marketplace (or your usual install path). The plugin declares MCP with command `agentmfa`, args `serve` — so **`agentmfa serve` starts when the client connects**. No extra env vars for typical OAuth login.\n\n### Cursor\n\nInstall/enable the AgentMFA **Cursor plugin** for this repo (or add MCP manually with the same command: `agentmfa` + arg `serve`). In **Cursor Settings → MCP**, confirm the AgentMFA server is listed and not erroring — that process **is** `agentmfa serve`. If `agent register` works in the terminal but MCP tools are missing, the CLI is fine; fix MCP/plugin startup in Cursor.\n\nAfter MCP is connected, `agentmfa serve` runs only while the client has a session — same as Claude Code.\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP tools exposed by **`agentmfa serve`**. Your agent uses **only MCP tool calls** — no direct HTTP.\n\nTool parameter names must match the MCP schema your client shows (see table below). Put the **short label** in `action` and **full detail** in `context` so the operator sees enough to decide.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context?, risk_level?)\n   → returns JSON including a request id (often `id`) — use that value as request_id in step 2.\n\n   ⚠️  Relay any user-facing message from the tool result so they know to check their phone.\n\n2. Call wait_for_approval(request_id: <id from step 1>, timeout_seconds?)\n   → blocks until decided (polls about every 3s; default timeout 300s)\n   → returns JSON when no longer pending (shape depends on API; treat non-success / timeout as rejected)\n\n   ⚠️  On approval, relay human-readable message fields to the user when present.\n\n3a. Approved / success path   → proceed; any one-time token or code is a proof of approval — do not log unnecessarily\n3b. Rejected / expired / timeout  → abort and inform the user\n```\n\n### Non-blocking check\n\nUse `check_approval_status(request_id)` to poll once without blocking.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle tokens carefully** — one-time proofs of approval should not be logged or pasted into chat\n\n## MCP Tools\n\nYour client may show slightly different optional fields — prefer the **tool schema** Cursor or Claude Code displays. Pass extra parameters only when listed there (e.g. some builds add service-scoped TOTP). Minimal shape for `agentmfa serve`:\n\n| Tool | Parameters | Purpose |\n|---|---|---|\n| `request_approval` | `action` (required), `context` (optional), `risk_level` (optional: `low` / `medium` / `high`) | Submit request; returns id for polling/wait |\n| `wait_for_approval` | `request_id` (required), `timeout_seconds` (optional, default 300) | Block until decided (~3s poll interval) |\n| `check_approval_status` | `request_id` (required) | Single non-blocking status poll |\n\nFile v1.0.13:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.13\",\n  \"publishedAt\": 1777760839842\n}\n\nFile v1.0.13:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code\n\nFile v1.0.13:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how an agent (Claude Code, Cursor, or any client running `agentmfa serve`) should use the AgentMFA MCP tools. No HTTP calls, no environment variables — just tool calls. Parameter names match the `agentmfa serve` stdio server.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval (short label in action, detail in context)\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"2.3GB of production backups from 2024; irreversible\",\n  risk_level: \"high\"\n)\n// → JSON with id (use as request_id), e.g. { \"id\": \"abc-123\", \"status\": \"pending\", ... }\n\n// ⚠️  Tell the user: \"Request sent — waiting for your approval on the phone...\"\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → JSON when status is no longer pending (fields depend on API), e.g.:\n//   { \"status\": \"approved\", \"code\": \"...\" }  or similar\n// → or timeout: { \"status\": \"expired\", \"message\": \"...\" }  — treat as rejected\n\n// Step 3 — act on result\nif approved / success  → relay any human-facing message, then proceed\nif rejected / expired  → abort, tell user the action was not approved\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // default is 300; server polls about every 3s\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(\n  action: \"Send invoice emails\",\n  context: \"247 recipients; batch job\"\n)\n// → use \"id\" from the response as request_id\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done (exact fields from API)\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nArchive v1.0.12: 4 files, 3305 bytes\n\nFiles: _meta.json (128b), references/errors.md (1188b), references/examples.md (1641b), SKILL.md (2649b)\n\nFile v1.0.12:SKILL.md\n\n---\nname: agentmfa\ndescription: Request human approval via biometric auth before performing sensitive actions. Use this skill whenever an action is irreversible, destructive, or requires human sign-off (e.g. deleting data, deploying to production, sending emails, making payments).\nlicense: MIT\nmetadata:\n  author: agentmfa\n  version: \"1.0.4\"\n  abstract: AgentMFA pauses an agent before a sensitive action and requires the human operator to approve it on their phone using biometrics. Uses the AgentMFA MCP server — call request_approval, then wait_for_approval.\n---\n\n# AgentMFA Skill\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Making payments or financial transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP server tools. No HTTP calls or environment variables needed.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context, risk_level)\n   → returns { id, status: \"pending\", expires_at, ... }\n\n2. Call wait_for_approval(request_id: <id from step 1>)\n   → blocks until human decides (polls every 3s)\n   → returns { status: \"approved\", code: \"...\" }\n          or { status: \"rejected\" }\n          or { status: \"expired\" }\n\n3a. status == \"approved\"  → proceed; log the code as proof\n3b. status == \"rejected\"  → abort; inform the user\n3c. status == \"expired\"   → abort; treat as rejected\n```\n\n### Non-blocking check\n\nIf you need to do other work while waiting, use `check_approval_status(request_id)` to poll manually instead of `wait_for_approval`.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Log the code** — the TOTP code returned on approval is proof; pass it to downstream systems if required\n\n## MCP Tools\n\n| Tool | Purpose |\n|---|---|\n| `request_approval(action, context?, risk_level?)` | Submit approval request, returns request ID |\n| `wait_for_approval(request_id, timeout_seconds?)` | Block until decided, returns status + code |\n| `check_approval_status(request_id)` | Single non-blocking poll |\n\nFile v1.0.12:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.12\",\n  \"publishedAt\": 1777751005298\n}\n\nFile v1.0.12:references/errors.md\n\n# AgentMFA Error Handling\n\n## HTTP Errors\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `401 Unauthorized` | API key is invalid or missing | Check `AGENTMFA_API_KEY` |\n| `400 Bad Request` | Missing `action_type` | Ensure the field is set |\n| `404 Not Found` | Approval ID doesn't exist | Do not retry; abort |\n| `500 Internal Server Error` | Backend error | Retry once after 5s; if it persists, abort |\n\n## Status Outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `pending` | Human hasn't decided yet | Keep polling every 3s |\n| `approved` | Human approved with biometrics | Proceed; use `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n\n## Expiry\n\nIf the current time exceeds `expires_at` from the initial response and status is still `pending`, treat it as rejected and abort. Do not continue polling after expiry.\n\n## Never Do\n\n- Do not proceed with a sensitive action without receiving `\"status\": \"approved\"`\n- Do not retry a rejected request automatically — only the human can re-initiate\n- Do not cache or reuse a TOTP `code` — each approval generates a unique code valid for one 30-second TOTP window\n\nFile v1.0.12:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how Claude should use the AgentMFA MCP tools.\nNo HTTP calls, no environment variables — just tool calls.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"Bucket contains 2.3GB of production backups from 2024\",\n  risk_level: \"high\"\n)\n// → { \"id\": \"abc-123\", \"status\": \"pending\", \"expires_at\": \"...\" }\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → { \"status\": \"approved\", \"code\": \"483920\" }\n//   or { \"status\": \"rejected\" }\n\n// Step 3 — act on result\nif status == \"approved\"  → proceed with deletion, log code \"483920\" as proof\nif status == \"rejected\"  → abort, tell user the action was rejected\nif status == \"expired\"   → abort, tell user the request timed out\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // give operator 2 minutes instead of default 5\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(action: \"Send invoice emails\", context: \"247 recipients\")\n// → id: \"xyz-456\"\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nArchive v1.0.11: 4 files, 3681 bytes\n\nFiles: references/errors.md (545b), references/examples.md (1641b), SKILL.md (4301b), _meta.json (128b)\n\nFile v1.0.11:SKILL.md\n\n---\nname: agentmfa\ndescription: Request human approval via biometric auth before performing sensitive actions. Use this skill whenever an action is irreversible, destructive, or requires human sign-off (e.g. deleting data, deploying to production, sending emails, making payments).\nhomepage: https://agentmfa.ai\nlicense: MIT\nmetadata:\n  openclaw:\n    emoji: \"🔐\"\n    requires:\n      env:\n        - AGENTMFA_API_KEY\n      bins:\n        - npx\n    primaryEnv: AGENTMFA_API_KEY\n    install:\n      - id: npm\n        kind: node\n        package: \"@agentmfa/mcp\"\n        bins:\n          - agentmfa-mcp\n        label: \"Install AgentMFA MCP server (npm)\"\n---\n\n# AgentMFA Skill\n\n**AgentMFA does not execute actions.** It pauses your agent and requests biometric approval from the human operator's mobile app. The agent only proceeds — or aborts — based on the human's decision.\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** Local binary (`@agentmfa/mcp`) that runs on your machine and makes outbound HTTPS calls to `api.agentmfa.ai`\n- **Auth:** Requires `AGENTMFA_API_KEY` set in your shell environment — obtain from the AgentMFA dashboard after signing up\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa-integrations (fully open source — MCP server source is in `mcp/`)\n\nThe MCP server must be configured in your agent runtime before this skill can be used. See the setup instructions at https://github.com/agentmfa/agentmfa-integrations.\n\nFor production use, pin the MCP server to a specific version rather than using `latest`:\n```\nnpx @agentmfa/mcp@1.0.0\n```\nReview the package source at https://github.com/agentmfa/agentmfa-integrations/tree/main/mcp before installing. To verify the binary matches the published source, check the SHA256 hash against `checksums.txt` in the [GitHub release](https://github.com/agentmfa/agentmfa-integrations/releases):\n```\nsha256sum $(which agentmfa-mcp)\n```\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP server tools. The MCP server handles all API communication — your agent code makes only tool calls, no direct HTTP calls. The MCP server requires `AGENTMFA_API_KEY` to be set in your shell environment.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context, risk_level)\n   → returns { id, status: \"pending\", expires_at, ... }\n\n2. Call wait_for_approval(request_id: <id from step 1>)\n   → blocks until human decides (polls every 3s)\n   → returns { status: \"approved\", code: \"...\" }\n          or { status: \"rejected\" }\n          or { status: \"expired\" }\n\n3a. status == \"approved\"  → proceed; treat the code as a sensitive one-time token\n3b. status == \"rejected\"  → abort; inform the user\n3c. status == \"expired\"   → abort; treat as rejected\n```\n\n### Non-blocking check\n\nIf you need to do other work while waiting, use `check_approval_status(request_id)` to poll manually instead of `wait_for_approval`.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle the code carefully** — the one-time approval code returned on approval is a sensitive one-time token; do not write it to logs or external systems\n\n## MCP Tools\n\n| Tool | Purpose |\n|---|---|\n| `request_approval(action, context?, risk_level?)` | Submit approval request, returns request ID |\n| `wait_for_approval(request_id, timeout_seconds?)` | Block until decided, returns status + code |\n| `check_approval_status(request_id)` | Single non-blocking poll |\n\nFile v1.0.11:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.11\",\n  \"publishedAt\": 1776559643801\n}\n\nFile v1.0.11:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code\n\nFile v1.0.11:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how Claude should use the AgentMFA MCP tools.\nNo HTTP calls, no environment variables — just tool calls.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"Bucket contains 2.3GB of production backups from 2024\",\n  risk_level: \"high\"\n)\n// → { \"id\": \"abc-123\", \"status\": \"pending\", \"expires_at\": \"...\" }\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → { \"status\": \"approved\", \"code\": \"483920\" }\n//   or { \"status\": \"rejected\" }\n\n// Step 3 — act on result\nif status == \"approved\"  → proceed with deletion, log code \"483920\" as proof\nif status == \"rejected\"  → abort, tell user the action was rejected\nif status == \"expired\"   → abort, tell user the request timed out\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // give operator 2 minutes instead of default 5\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(action: \"Send invoice emails\", context: \"247 recipients\")\n// → id: \"xyz-456\"\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nArchive v1.0.10: 4 files, 3485 bytes\n\nFiles: references/errors.md (545b), references/examples.md (1641b), SKILL.md (3845b), _meta.json (128b)\n\nFile v1.0.10:SKILL.md\n\n---\nname: agentmfa\ndescription: Request human approval via biometric auth before performing sensitive actions. Use this skill whenever an action is irreversible, destructive, or requires human sign-off (e.g. deleting data, deploying to production, sending emails, making payments).\nhomepage: https://agentmfa.ai\nlicense: MIT\nmetadata:\n  openclaw:\n    emoji: \"🔐\"\n    requires:\n      env:\n        - AGENTMFA_API_KEY\n      bins:\n        - npx\n    primaryEnv: AGENTMFA_API_KEY\n    install:\n      - id: npm\n        kind: node\n        package: \"@agentmfa/mcp\"\n        bins:\n          - agentmfa-mcp\n        label: \"Install AgentMFA MCP server (npm)\"\n---\n\n# AgentMFA Skill\n\n**AgentMFA does not execute actions.** It pauses your agent and requests biometric approval from the human operator's mobile app. The agent only proceeds — or aborts — based on the human's decision.\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** Local binary (`@agentmfa/mcp`) that runs on your machine and makes outbound HTTPS calls to `api.agentmfa.ai`\n- **Auth:** Requires `AGENTMFA_API_KEY` set in your shell environment — obtain from the AgentMFA dashboard after signing up\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa-integrations (fully open source — MCP server source is in `mcp/`)\n\nThe MCP server must be configured in your agent runtime before this skill can be used. See the setup instructions at https://github.com/agentmfa/agentmfa-integrations.\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP server tools. The MCP server handles all API communication — your agent code makes only tool calls, no direct HTTP calls. The MCP server requires `AGENTMFA_API_KEY` to be set in your shell environment.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context, risk_level)\n   → returns { id, status: \"pending\", expires_at, ... }\n\n2. Call wait_for_approval(request_id: <id from step 1>)\n   → blocks until human decides (polls every 3s)\n   → returns { status: \"approved\", code: \"...\" }\n          or { status: \"rejected\" }\n          or { status: \"expired\" }\n\n3a. status == \"approved\"  → proceed; treat the code as a sensitive one-time token\n3b. status == \"rejected\"  → abort; inform the user\n3c. status == \"expired\"   → abort; treat as rejected\n```\n\n### Non-blocking check\n\nIf you need to do other work while waiting, use `check_approval_status(request_id)` to poll manually instead of `wait_for_approval`.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle the code carefully** — the one-time approval code returned on approval is a sensitive one-time token; do not write it to logs or external systems\n\n## MCP Tools\n\n| Tool | Purpose |\n|---|---|\n| `request_approval(action, context?, risk_level?)` | Submit approval request, returns request ID |\n| `wait_for_approval(request_id, timeout_seconds?)` | Block until decided, returns status + code |\n| `check_approval_status(request_id)` | Single non-blocking poll |\n\nFile v1.0.10:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.10\",\n  \"publishedAt\": 1776559004608\n}\n\nFile v1.0.10:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code\n\nFile v1.0.10:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how Claude should use the AgentMFA MCP tools.\nNo HTTP calls, no environment variables — just tool calls.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"Bucket contains 2.3GB of production backups from 2024\",\n  risk_level: \"high\"\n)\n// → { \"id\": \"abc-123\", \"status\": \"pending\", \"expires_at\": \"...\" }\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → { \"status\": \"approved\", \"code\": \"483920\" }\n//   or { \"status\": \"rejected\" }\n\n// Step 3 — act on result\nif status == \"approved\"  → proceed with deletion, log code \"483920\" as proof\nif status == \"rejected\"  → abort, tell user the action was rejected\nif status == \"expired\"   → abort, tell user the request timed out\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // give operator 2 minutes instead of default 5\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(action: \"Send invoice emails\", context: \"247 recipients\")\n// → id: \"xyz-456\"\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nArchive v1.0.9: 4 files, 3501 bytes\n\nFiles: references/errors.md (545b), references/examples.md (1641b), SKILL.md (3860b), _meta.json (127b)\n\nFile v1.0.9:SKILL.md\n\n---\nname: agentmfa\ndescription: Request human approval via biometric auth before performing sensitive actions. Use this skill whenever an action is irreversible, destructive, or requires human sign-off (e.g. deleting data, deploying to production, sending emails, making payments).\nhomepage: https://agentmfa.ai\nlicense: MIT\nmetadata:\n  openclaw:\n    emoji: \"🔐\"\n    requires:\n      env:\n        - AGENTMFA_API_KEY\n      bins:\n        - npx\n    primaryEnv: AGENTMFA_API_KEY\n    install:\n      - id: npm\n        kind: node\n        package: \"@agentmfa/mcp\"\n        bins:\n          - agentmfa-mcp\n        label: \"Install AgentMFA MCP server (npm)\"\n---\n\n# AgentMFA Skill\n\n**AgentMFA does not execute actions.** It pauses your agent and requests biometric approval from the human operator's mobile app. The agent only proceeds — or aborts — based on the human's decision.\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** Local binary (`@agentmfa/mcp`) that runs on your machine and makes outbound HTTPS calls to `api.agentmfa.ai`\n- **Auth:** Requires `AGENTMFA_API_KEY` set in your shell environment — obtain from the AgentMFA dashboard after signing up\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa-integrations (fully open source — MCP server source is in `mcp/`)\n\nThe MCP server must be configured in your agent runtime before this skill can be used. See the setup instructions at https://github.com/agentmfa/agentmfa-integrations.\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP server tools. The MCP server handles all API communication — your agent code makes only tool calls, no direct HTTP calls. The MCP server requires `AGENTMFA_API_KEY` to be set in your shell environment.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context, risk_level)\n   → returns { id, status: \"pending\", expires_at, ... }\n\n2. Call wait_for_approval(request_id: <id from step 1>)\n   → blocks until human decides (polls every 3s)\n   → returns { status: \"approved\", code: \"...\" }\n          or { status: \"rejected\" }\n          or { status: \"expired\" }\n\n3a. status == \"approved\"  → proceed; treat the code as a sensitive one-time token\n3b. status == \"rejected\"  → abort; inform the user\n3c. status == \"expired\"   → abort; treat as rejected\n```\n\n### Non-blocking check\n\nIf you need to do other work while waiting, use `check_approval_status(request_id)` to poll manually instead of `wait_for_approval`.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle the code carefully** — the one-time approval code returned on approval is sensitive; do not write it to plain logs or external systems unless strictly necessary\n\n## MCP Tools\n\n| Tool | Purpose |\n|---|---|\n| `request_approval(action, context?, risk_level?)` | Submit approval request, returns request ID |\n| `wait_for_approval(request_id, timeout_seconds?)` | Block until decided, returns status + code |\n| `check_approval_status(request_id)` | Single non-blocking poll |\n\nFile v1.0.9:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.9\",\n  \"publishedAt\": 1776558573061\n}\n\nFile v1.0.9:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code\n\nFile v1.0.9:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how Claude should use the AgentMFA MCP tools.\nNo HTTP calls, no environment variables — just tool calls.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"Bucket contains 2.3GB of production backups from 2024\",\n  risk_level: \"high\"\n)\n// → { \"id\": \"abc-123\", \"status\": \"pending\", \"expires_at\": \"...\" }\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → { \"status\": \"approved\", \"code\": \"483920\" }\n//   or { \"status\": \"rejected\" }\n\n// Step 3 — act on result\nif status == \"approved\"  → proceed with deletion, log code \"483920\" as proof\nif status == \"rejected\"  → abort, tell user the action was rejected\nif status == \"expired\"   → abort, tell user the request timed out\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // give operator 2 minutes instead of default 5\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(action: \"Send invoice emails\", context: \"247 recipients\")\n// → id: \"xyz-456\"\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nArchive v1.0.8: 4 files, 3666 bytes\n\nFiles: references/errors.md (545b), references/examples.md (1641b), SKILL.md (4467b), _meta.json (127b)\n\nFile v1.0.8:SKILL.md\n\n---\nname: agentmfa\ndescription: Request human approval via biometric auth before performing sensitive actions. Use this skill whenever an action is irreversible, destructive, or requires human sign-off (e.g. deleting data, deploying to production, sending emails, making payments).\nhomepage: https://agentmfa.ai\nlicense: MIT\nmetadata:\n  {\n    \"author\": \"agentmfa\",\n    \"version\": \"1.0.4\",\n    \"abstract\": \"AgentMFA pauses an agent before a sensitive action and requires the human operator to approve it on their phone using biometrics. Uses the AgentMFA MCP server — call request_approval, then wait_for_approval.\",\n    \"openclaw\":\n      {\n        \"emoji\": \"🔐\",\n        \"requires\": { \"bins\": [\"npx\"] },\n        \"install\":\n          [\n            {\n              \"id\": \"npm\",\n              \"kind\": \"node\",\n              \"package\": \"@agentmfa/mcp\",\n              \"bins\": [\"agentmfa-mcp\"],\n              \"label\": \"Install AgentMFA MCP server (npm)\",\n            },\n          ],\n        \"env\":\n          [\n            {\n              \"name\": \"AGENTMFA_API_KEY\",\n              \"description\": \"API key for the AgentMFA service — obtain from https://agentmfa.ai after signing up\",\n              \"required\": true,\n            },\n          ],\n      },\n  }\n---\n\n# AgentMFA Skill\n\n**AgentMFA does not execute actions.** It pauses your agent and requests biometric approval from the human operator's mobile app. The agent only proceeds — or aborts — based on the human's decision.\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** Local binary (`@agentmfa/mcp`) that runs on your machine and makes outbound HTTPS calls to `api.agentmfa.ai`\n- **Auth:** Requires `AGENTMFA_API_KEY` set in your shell environment — obtain from the AgentMFA dashboard after signing up\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa-integrations (fully open source — MCP server source is in `mcp/`)\n\nThe MCP server must be configured in your agent runtime before this skill can be used. See the setup instructions at https://github.com/agentmfa/agentmfa-integrations.\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP server tools. The MCP server handles all API communication — your agent code makes only tool calls, no direct HTTP calls. The MCP server requires `AGENTMFA_API_KEY` to be set in your shell environment.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context, risk_level)\n   → returns { id, status: \"pending\", expires_at, ... }\n\n2. Call wait_for_approval(request_id: <id from step 1>)\n   → blocks until human decides (polls every 3s)\n   → returns { status: \"approved\", code: \"...\" }\n          or { status: \"rejected\" }\n          or { status: \"expired\" }\n\n3a. status == \"approved\"  → proceed; treat the code as a sensitive one-time token\n3b. status == \"rejected\"  → abort; inform the user\n3c. status == \"expired\"   → abort; treat as rejected\n```\n\n### Non-blocking check\n\nIf you need to do other work while waiting, use `check_approval_status(request_id)` to poll manually instead of `wait_for_approval`.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle the code carefully** — the one-time approval code returned on approval is sensitive; do not write it to plain logs or external systems unless strictly necessary\n\n## MCP Tools\n\n| Tool | Purpose |\n|---|---|\n| `request_approval(action, context?, risk_level?)` | Submit approval request, returns request ID |\n| `wait_for_approval(request_id, timeout_seconds?)` | Block until decided, returns status + code |\n| `check_approval_status(request_id)` | Single non-blocking poll |\n\nFile v1.0.8:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.8\",\n  \"publishedAt\": 1776554112596\n}\n\nFile v1.0.8:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code\n\nFile v1.0.8:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how Claude should use the AgentMFA MCP tools.\nNo HTTP calls, no environment variables — just tool calls.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"Bucket contains 2.3GB of production backups from 2024\",\n  risk_level: \"high\"\n)\n// → { \"id\": \"abc-123\", \"status\": \"pending\", \"expires_at\": \"...\" }\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → { \"status\": \"approved\", \"code\": \"483920\" }\n//   or { \"status\": \"rejected\" }\n\n// Step 3 — act on result\nif status == \"approved\"  → proceed with deletion, log code \"483920\" as proof\nif status == \"rejected\"  → abort, tell user the action was rejected\nif status == \"expired\"   → abort, tell user the request timed out\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // give operator 2 minutes instead of default 5\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(action: \"Send invoice emails\", context: \"247 recipients\")\n// → id: \"xyz-456\"\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nArchive v1.0.7: 4 files, 3657 bytes\n\nFiles: references/errors.md (545b), references/examples.md (1641b), SKILL.md (4437b), _meta.json (127b)\n\nFile v1.0.7:SKILL.md\n\n---\nname: agentmfa\ndescription: Request human approval via biometric auth before performing sensitive actions. Use this skill whenever an action is irreversible, destructive, or requires human sign-off (e.g. deleting data, deploying to production, sending emails, making payments).\nlicense: MIT\nmetadata:\n  {\n    \"author\": \"agentmfa\",\n    \"version\": \"1.0.4\",\n    \"abstract\": \"AgentMFA pauses an agent before a sensitive action and requires the human operator to approve it on their phone using biometrics. Uses the AgentMFA MCP server — call request_approval, then wait_for_approval.\",\n    \"openclaw\":\n      {\n        \"emoji\": \"🔐\",\n        \"requires\": { \"bins\": [\"npx\"] },\n        \"install\":\n          [\n            {\n              \"id\": \"npm\",\n              \"kind\": \"node\",\n              \"package\": \"@agentmfa/mcp\",\n              \"bins\": [\"agentmfa-mcp\"],\n              \"label\": \"Install AgentMFA MCP server (npm)\",\n            },\n          ],\n        \"env\":\n          [\n            {\n              \"name\": \"AGENTMFA_API_KEY\",\n              \"description\": \"API key for the AgentMFA service — obtain from https://agentmfa.ai after signing up\",\n              \"required\": true,\n            },\n          ],\n      },\n  }\n---\n\n# AgentMFA Skill\n\n**AgentMFA does not execute actions.** It pauses your agent and requests biometric approval from the human operator's mobile app. The agent only proceeds — or aborts — based on the human's decision.\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** Local binary (`@agentmfa/mcp`) that runs on your machine and makes outbound HTTPS calls to `api.agentmfa.ai`\n- **Auth:** Requires `AGENTMFA_API_KEY` set in your shell environment — obtain from the AgentMFA dashboard after signing up\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa-integrations (fully open source — MCP server source is in `mcp/`)\n\nThe MCP server must be configured in your agent runtime before this skill can be used. See the setup instructions at https://github.com/agentmfa/agentmfa-integrations.\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP server tools. The MCP server handles all API communication — your agent code makes only tool calls, no direct HTTP calls. The MCP server requires `AGENTMFA_API_KEY` to be set in your shell environment.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context, risk_level)\n   → returns { id, status: \"pending\", expires_at, ... }\n\n2. Call wait_for_approval(request_id: <id from step 1>)\n   → blocks until human decides (polls every 3s)\n   → returns { status: \"approved\", code: \"...\" }\n          or { status: \"rejected\" }\n          or { status: \"expired\" }\n\n3a. status == \"approved\"  → proceed; treat the code as a sensitive one-time token\n3b. status == \"rejected\"  → abort; inform the user\n3c. status == \"expired\"   → abort; treat as rejected\n```\n\n### Non-blocking check\n\nIf you need to do other work while waiting, use `check_approval_status(request_id)` to poll manually instead of `wait_for_approval`.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle the code carefully** — the one-time approval code returned on approval is sensitive; do not write it to plain logs or external systems unless strictly necessary\n\n## MCP Tools\n\n| Tool | Purpose |\n|---|---|\n| `request_approval(action, context?, risk_level?)` | Submit approval request, returns request ID |\n| `wait_for_approval(request_id, timeout_seconds?)` | Block until decided, returns status + code |\n| `check_approval_status(request_id)` | Single non-blocking poll |\n\nFile v1.0.7:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.7\",\n  \"publishedAt\": 1776553040768\n}\n\nFile v1.0.7:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code\n\nFile v1.0.7:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how Claude should use the AgentMFA MCP tools.\nNo HTTP calls, no environment variables — just tool calls.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"Bucket contains 2.3GB of production backups from 2024\",\n  risk_level: \"high\"\n)\n// → { \"id\": \"abc-123\", \"status\": \"pending\", \"expires_at\": \"...\" }\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → { \"status\": \"approved\", \"code\": \"483920\" }\n//   or { \"status\": \"rejected\" }\n\n// Step 3 — act on result\nif status == \"approved\"  → proceed with deletion, log code \"483920\" as proof\nif status == \"rejected\"  → abort, tell user the action was rejected\nif status == \"expired\"   → abort, tell user the request timed out\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // give operator 2 minutes instead of default 5\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(action: \"Send invoice emails\", context: \"247 recipients\")\n// → id: \"xyz-456\"\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nArchive v1.0.6: 4 files, 3495 bytes\n\nFiles: references/errors.md (545b), references/examples.md (1641b), SKILL.md (3939b), _meta.json (127b)\n\nFile v1.0.6:SKILL.md\n\n---\nname: agentmfa\ndescription: Request human approval via biometric auth before performing sensitive actions. Use this skill whenever an action is irreversible, destructive, or requires human sign-off (e.g. deleting data, deploying to production, sending emails, making payments).\nlicense: MIT\nmetadata:\n  author: agentmfa\n  version: \"1.0.4\"\n  abstract: AgentMFA pauses an agent before a sensitive action and requires the human operator to approve it on their phone using biometrics. Uses the AgentMFA MCP server — call request_approval, then wait_for_approval.\n  env:\n    required:\n      - name: AGENTMFA_API_KEY\n        description: API key for the AgentMFA service — obtained from https://agentmfa.ai after signing up\n---\n\n# AgentMFA Skill\n\n**AgentMFA does not execute actions.** It pauses your agent and requests biometric approval from the human operator's mobile app. The agent only proceeds — or aborts — based on the human's decision.\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** Local binary (`@agentmfa/mcp`) that runs on your machine and makes outbound HTTPS calls to `api.agentmfa.ai`\n- **Auth:** Requires `AGENTMFA_API_KEY` set in your shell environment — obtain from the AgentMFA dashboard after signing up\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa-integrations (fully open source — MCP server source is in `mcp/`)\n\nThe MCP server must be configured in your agent runtime before this skill can be used. See the setup instructions at https://github.com/agentmfa/agentmfa-integrations.\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP server tools. The MCP server handles all API communication — your agent code makes only tool calls, no direct HTTP calls. The MCP server requires `AGENTMFA_API_KEY` to be set in your shell environment.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context, risk_level)\n   → returns { id, status: \"pending\", expires_at, ... }\n\n2. Call wait_for_approval(request_id: <id from step 1>)\n   → blocks until human decides (polls every 3s)\n   → returns { status: \"approved\", code: \"...\" }\n          or { status: \"rejected\" }\n          or { status: \"expired\" }\n\n3a. status == \"approved\"  → proceed; treat the code as a sensitive one-time token\n3b. status == \"rejected\"  → abort; inform the user\n3c. status == \"expired\"   → abort; treat as rejected\n```\n\n### Non-blocking check\n\nIf you need to do other work while waiting, use `check_approval_status(request_id)` to poll manually instead of `wait_for_approval`.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle the code carefully** — the one-time approval code returned on approval is sensitive; do not write it to plain logs or external systems unless strictly necessary\n\n## MCP Tools\n\n| Tool | Purpose |\n|---|---|\n| `request_approval(action, context?, risk_level?)` | Submit approval request, returns request ID |\n| `wait_for_approval(request_id, timeout_seconds?)` | Block until decided, returns status + code |\n| `check_approval_status(request_id)` | Single non-blocking poll |\n\nFile v1.0.6:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.6\",\n  \"publishedAt\": 1776552464443\n}\n\nFile v1.0.6:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code\n\nFile v1.0.6:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how Claude should use the AgentMFA MCP tools.\nNo HTTP calls, no environment variables — just tool calls.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"Bucket contains 2.3GB of production backups from 2024\",\n  risk_level: \"high\"\n)\n// → { \"id\": \"abc-123\", \"status\": \"pending\", \"expires_at\": \"...\" }\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → { \"status\": \"approved\", \"code\": \"483920\" }\n//   or { \"status\": \"rejected\" }\n\n// Step 3 — act on result\nif status == \"approved\"  → proceed with deletion, log code \"483920\" as proof\nif status == \"rejected\"  → abort, tell user the action was rejected\nif status == \"expired\"   → abort, tell user the request timed out\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // give operator 2 minutes instead of default 5\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(action: \"Send invoice emails\", context: \"247 recipients\")\n// → id: \"xyz-456\"\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |\n\nArchive v1.0.5: 4 files, 3410 bytes\n\nFiles: references/errors.md (536b), references/examples.md (1641b), SKILL.md (3706b), _meta.json (127b)\n\nFile v1.0.5:SKILL.md\n\n---\nname: agentmfa\ndescription: Request human approval via biometric auth before performing sensitive actions. Use this skill whenever an action is irreversible, destructive, or requires human sign-off (e.g. deleting data, deploying to production, sending emails, making payments).\nlicense: MIT\nmetadata:\n  author: agentmfa\n  version: \"1.0.4\"\n  abstract: AgentMFA pauses an agent before a sensitive action and requires the human operator to approve it on their phone using biometrics. Uses the AgentMFA MCP server — call request_approval, then wait_for_approval.\n---\n\n# AgentMFA Skill\n\n**AgentMFA does not execute actions.** It pauses your agent and requests biometric approval from the human operator's mobile app. The agent only proceeds — or aborts — based on the human's decision.\n\nUse this skill before performing any sensitive or irreversible action. The human operator will receive a push notification, review the action, and approve or reject it with biometrics.\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** Local binary (`@agentmfa/mcp`) that runs on your machine and makes outbound HTTPS calls to `api.agentmfa.ai`\n- **Auth:** Requires `AGENTMFA_API_KEY` set in your shell environment — obtain from the AgentMFA dashboard after signing up\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa-integrations\n\nThe MCP server must be configured in your agent runtime before this skill can be used. See the setup instructions at https://github.com/agentmfa/agentmfa-integrations.\n\n## When to Use\n\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Making payments or financial transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action explicitly marked as requiring human approval\n\n## How to Use\n\nThis skill uses the AgentMFA MCP server tools. The MCP server handles all API communication — your agent code makes only tool calls, no direct HTTP calls. The MCP server requires `AGENTMFA_API_KEY` to be set in your shell environment.\n\n### Standard flow (blocking)\n\n```\n1. Call request_approval(action, context, risk_level)\n   → returns { id, status: \"pending\", expires_at, ... }\n\n2. Call wait_for_approval(request_id: <id from step 1>)\n   → blocks until human decides (polls every 3s)\n   → returns { status: \"approved\", code: \"...\" }\n          or { status: \"rejected\" }\n          or { status: \"expired\" }\n\n3a. status == \"approved\"  → proceed; treat the code as a sensitive one-time token\n3b. status == \"rejected\"  → abort; inform the user\n3c. status == \"expired\"   → abort; treat as rejected\n```\n\n### Non-blocking check\n\nIf you need to do other work while waiting, use `check_approval_status(request_id)` to poll manually instead of `wait_for_approval`.\n\n## Rules\n\n- **Always wait** for approval before proceeding — never skip or assume approval\n- **Abort on rejection** — do not retry the same action without user re-initiation\n- **Abort on expiry** — a timed-out request is treated as rejected\n- **Be specific** — `action` and `context` should give the human enough detail to decide\n- **Handle the code carefully** — the TOTP code returned on approval is a sensitive one-time token; do not write it to plain logs or external systems unless strictly necessary\n\n## MCP Tools\n\n| Tool | Purpose |\n|---|---|\n| `request_approval(action, context?, risk_level?)` | Submit approval request, returns request ID |\n| `wait_for_approval(request_id, timeout_seconds?)` | Block until decided, returns status + code |\n| `check_approval_status(request_id)` | Single non-blocking poll |\n\nFile v1.0.5:_meta.json\n\n{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.5\",\n  \"publishedAt\": 1776551911812\n}\n\nFile v1.0.5:references/errors.md\n\n# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time code\n\nFile v1.0.5:references/examples.md\n\n# AgentMFA MCP Examples\n\nThese examples show how Claude should use the AgentMFA MCP tools.\nNo HTTP calls, no environment variables — just tool calls.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"Bucket contains 2.3GB of production backups from 2024\",\n  risk_level: \"high\"\n)\n// → { \"id\": \"abc-123\", \"status\": \"pending\", \"expires_at\": \"...\" }\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → { \"status\": \"approved\", \"code\": \"483920\" }\n//   or { \"status\": \"rejected\" }\n\n// Step 3 — act on result\nif status == \"approved\"  → proceed with deletion, log code \"483920\" as proof\nif status == \"rejected\"  → abort, tell user the action was rejected\nif status == \"expired\"   → abort, tell user the request timed out\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // give operator 2 minutes instead of default 5\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(action: \"Send invoice emails\", context: \"247 recipients\")\n// → id: \"xyz-456\"\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |","readmeExcerpt":"Skill: Agentmfa Owner: leiarenee Summary: AgentMFA — request human approval before sensitive actions. Uses MCP tools for registration, identity, and approval flows. Works in Claude Code, Cursor, Open... Tags: latest:1.0.14 Version history: v1.0.14 | 2026-05-03T04:38:13.905Z | auto - Simplified and clarified setup: agent registration now uses the MCP tool and no longer requires a manual CLI step. - Separated subcomman","codeSnippets":[],"executableExamples":[{"language":"sh","snippet":"# 1. Install the CLI\nbrew install agentmfa/cli/agentmfa\n\n# 2. Log in (opens browser for OAuth)\nagentmfa auth login"},{"language":"text","snippet":"1. Call register_agent()\n   → Checks if already registered — returns immediately if so\n   → If not registered, registers and waits for approval (auto or mobile)\n   → Returns: { status, tool, remote, message }\n   ⚠️ Relay the message to the user\n\n2. Call request_approval(action, description, context?)\n   → Returns: { request_id, message }\n   ⚠️ Relay the message so the user knows to check their phone\n\n3. Call wait_for_approval(request_id)\n   → Blocks until decided (polls every 1s, default 300s timeout)\n   → Approved: { approved: true, totp_verified, token, agent_totp,\n                  server_time, approved_by, approved_from, message }\n   → Rejected: { approved: false, reason }\n   ⚠️ On approval, relay the message field verbatim\n\n4a. approved == true  → proceed\n4b. approved == false → abort and inform the user"},{"language":"text","snippet":"// Step 1 — request approval (short label in action, detail in context)\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"2.3GB of production backups from 2024; irreversible\",\n  risk_level: \"high\"\n)\n// → JSON with id (use as request_id), e.g. { \"id\": \"abc-123\", \"status\": \"pending\", ... }\n\n// ⚠️  Tell the user: \"Request sent — waiting for your approval on the phone...\"\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → JSON when status is no longer pending (fields depend on API), e.g.:\n//   { \"status\": \"approved\", \"code\": \"...\" }  or similar\n// → or timeout: { \"status\": \"expired\", \"message\": \"...\" }  — treat as rejected\n\n// Step 3 — act on result\nif approved / success  → relay any human-facing message, then proceed\nif rejected / expired  → abort, tell user the action was not approved"},{"language":"text","snippet":"wait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // default is 300; server polls about every 3s\n)"},{"language":"text","snippet":"// Request\nrequest_approval(\n  action: \"Send invoice emails\",\n  context: \"247 recipients; batch job\"\n)\n// → use \"id\" from the response as request_id\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done (exact fields from API)"},{"language":"bash","snippet":"agentmfa agent register"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"---\nname: agentmfa\ndescription: AgentMFA — request human approval before sensitive actions. Uses MCP tools for registration, identity, and approval flows. Works in Claude Code, Cursor, OpenClaw, and any MCP-compatible client.\nhomepage: https://agentmfa.ai\nlicense: MIT\nmetadata:\n  openclaw:\n    emoji: \"🔐\"\n    requires:\n      bins:\n        - agentmfa\n    install:\n      - id: brew\n        kind: shell\n        command: \"brew install agentmfa/cli/agentmfa && agentmfa auth login\"\n        label: \"Install AgentMFA CLI and log in\"\n---\n\n# AgentMFA Skill\n\n**AgentMFA is an opt-in approval system.** The agent must explicitly call these tools before sensitive actions. AgentMFA does not automatically intercept or block anything — the agent decides when to request approval.\n\nWhen the agent calls `request_approval`, the human operator receives a push notification, reviews the action, and approves or rejects it with biometrics. The agent then decides whether to proceed based on the response.\n\n## Subcommands\n\nThese are CLI-only operations, run via Bash:\n\n| Invocation | Action |\n|---|---|\n| `/agentmfa list` | Run `agentmfa agent list` and display the results. |\n| `/agentmfa status` | Run `agentmfa auth status` to show login state. |\n\n---\n\n## About AgentMFA\n\n- **Operator:** AgentMFA (https://agentmfa.ai)\n- **MCP server:** `agentmfa serve` — part of the AgentMFA CLI; stdio MCP on your machine, talking to `api.agentmfa.ai`\n- **Auth:** OAuth via `agentmfa auth login` (session in the system keychain)\n- **Privacy & security policy:** https://agentmfa.ai/privacy\n- **Source code:** https://github.com/agentmfa/agentmfa (fully open source)\n\nThe `agentmfa` CLI must be installed and logged in before this skill can be used.\n\n## Setup\n\n```sh\n# 1. Install the CLI\nbrew install agentmfa/cli/agentmfa\n\n# 2. Log in (opens browser for OAuth)\nagentmfa auth login\n```\n\nRegistration happens automatically via the `register_agent` MCP tool — no manual step needed.\n\n## When to Use\n\nThe agent should call AgentMFA tools before:\n- Deleting or modifying production data\n- Deploying code to production\n- Sending emails or messages on behalf of the user\n- Actions that could result in financial charges or transactions\n- Modifying infrastructure (cloud resources, DNS, etc.)\n- Any action the agent recognizes as sensitive or irreversible\n\n**Common risky actions requiring approval:**\n- `git push --force` or rewriting history\n- `kubectl delete` on production resources\n- `kubectl apply/edit` to running workloads\n- `terraform apply` (especially with deletions shown in plan)\n- `terraform destroy` on any environment\n- `rm -rf` or bulk file deletions\n- Database schema changes or deletions\n- Modifying secrets (SOPS encrypt/decrypt)\n- Force pushing branches (`git push -f`)\n- Checking out or switching branches in production repos\n\n**Note:** AgentMFA does not automatically detect sensitive actions. The agent must recognize the risk and explicitly invoke the approval flow.\n\n## How to Use\n\nThis skill uses the AgentMFA"},{"path":"_meta.json","content":"{\n  \"ownerId\": \"kn7649qhpdar9qk5q42dx6k2698537f1\",\n  \"slug\": \"agentmfa\",\n  \"version\": \"1.0.14\",\n  \"publishedAt\": 1777783093905\n}"},{"path":"references/errors.md","content":"# AgentMFA Error Handling\n\n## Tool call outcomes\n\n| Status | Meaning | Action |\n|--------|---------|--------|\n| `approved` | Human approved with biometrics | Proceed; log the `code` as proof |\n| `rejected` | Human rejected | Abort the action; inform the user |\n| `expired` | Request timed out | Abort; treat as rejected |\n\n## Rules\n\n- Never proceed without `\"status\": \"approved\"`\n- Never retry a rejected request automatically — only the human can re-initiate\n- Never reuse a `code` — each approval generates a unique one-time approval code"},{"path":"references/examples.md","content":"# AgentMFA MCP Examples\n\nThese examples show how an agent (Claude Code, Cursor, or any client running `agentmfa serve`) should use the AgentMFA MCP tools. No HTTP calls, no environment variables — just tool calls. Parameter names match the `agentmfa serve` stdio server.\n\n---\n\n## Basic approval before a destructive action\n\n```\n// Step 1 — request approval (short label in action, detail in context)\nrequest_approval(\n  action: \"Delete S3 bucket prod-data\",\n  context: \"2.3GB of production backups from 2024; irreversible\",\n  risk_level: \"high\"\n)\n// → JSON with id (use as request_id), e.g. { \"id\": \"abc-123\", \"status\": \"pending\", ... }\n\n// ⚠️  Tell the user: \"Request sent — waiting for your approval on the phone...\"\n\n// Step 2 — wait for human decision\nwait_for_approval(request_id: \"abc-123\")\n// → JSON when status is no longer pending (fields depend on API), e.g.:\n//   { \"status\": \"approved\", \"code\": \"...\" }  or similar\n// → or timeout: { \"status\": \"expired\", \"message\": \"...\" }  — treat as rejected\n\n// Step 3 — act on result\nif approved / success  → relay any human-facing message, then proceed\nif rejected / expired  → abort, tell user the action was not approved\n```\n\n---\n\n## With custom timeout\n\n```\nwait_for_approval(\n  request_id: \"abc-123\",\n  timeout_seconds: 120   // default is 300; server polls about every 3s\n)\n```\n\n---\n\n## Non-blocking (manual polling)\n\n```\n// Request\nrequest_approval(\n  action: \"Send invoice emails\",\n  context: \"247 recipients; batch job\"\n)\n// → use \"id\" from the response as request_id\n\n// Do other preparation work here...\n\n// Check when ready\ncheck_approval_status(request_id: \"xyz-456\")\n// → { \"status\": \"pending\" }   ← still waiting\n// → { \"status\": \"approved\", \"code\": \"...\" }  ← done (exact fields from API)\n```\n\n---\n\n## Risk levels\n\n| risk_level | When to use |\n|---|---|\n| `low` | Reversible actions, small blast radius |\n| `medium` | Default — partially reversible or moderate impact |\n| `high` | Irreversible, large blast radius, or financial impact |"},{"path":"skill-card.md","content":"## Description:\n\nAgentMFA requests human approval before sensitive actions using MCP tools for registration, identity, and approval flows across MCP-compatible clients.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[leiarenee](https://clawhub.ai/user/leiarenee)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and agent operators use AgentMFA to require explicit human approval before destructive, financial, production, messaging, infrastructure, or other sensitive actions performed by an MCP-compatible agent.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: The setup flow installs an unpinned external CLI, which can change between reviews.\n\nMitigation: Review the CLI source and install provenance, and pin or mirror a reviewed CLI version for sensitive environments.\n\nRisk: Approval codes or one-time proof tokens could be exposed if they are logged or pasted into chat.\n\nMitigation: Treat approval codes and tokens as transient secrets; do not log, persist, or echo them in user-visible transcripts.\n\nRisk: AgentMFA is opt-in, so sensitive actions are not protected unless the agent explicitly requests approval.\n\nMitigation: Require the agent workflow to request approval before sensitive actions and to abort when approval is rejected, expired, or missing.\n\n## Reference(s):\n\n- [AgentMFA homepage](https://agentmfa.ai)\n- [AgentMFA privacy and security policy](https://agentmfa.ai/privacy)\n- [AgentMFA MCP Examples](references/examples.md)\n- [AgentMFA Error Handling](references/errors.md)\n- [ClawHub skill page](https://clawhub.ai/leiarenee/skills/agentmfa)\n\n## Skill Output:\n\n**Output Type(s):** [Guidance, Shell commands, Configuration instructions]\n\n**Output Format:** [Markdown with inline tool-call examples and shell commands]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Requires the agentmfa CLI and an MCP-compatible client; approval checks are opt-in and must be invoked by the agent.]\n\n## Skill Version(s):\n\n1.0.14 (source: server release evidence)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment."}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":null,"editorialQuality":{"score":100,"threshold":65,"status":"thin","wordCount":1592,"uniquenessScore":43,"reasons":["uniqueness-below-45"]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-11T22:16:56.179Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-11T22:16:56.179Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-12T12:43:53.647Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}