# MeshCentral Read-only OpenClaw plugin

This package exposes a deliberately narrow OpenClaw tool surface for one approved MeshCentral group and device:

- `meshcentral_health`
- `meshcentral_list_groups`
- `meshcentral_list_devices`
- `meshcentral_device_status`

The group and device are configured, not selected by tool parameters. The password is read only from the configured environment-variable name at execution time and is never stored in plugin configuration or returned in results.

## Safety boundary

This plugin is inventory/status only. It does not expose MeshCentral commands, diagnostics, console, remote control, file transfer, power operations, relay, administration, or state-changing actions. TLS certificate validation is enabled, response sizes are bounded, requests time out, and the connection is closed after each operation.

Example configuration values for a trusted runtime:

```json
{
  "url": "https://mesh.ledrew.me",
  "username": "sa_clawdia",
  "passwordEnv": "MESHCENTRAL_READONLY_PASSWORD",
  "groupName": "Servers",
  "deviceName": "PVE3"
}
```

Do not put the password itself in OpenClaw configuration, source, logs, or this repository. This package has been built and statically validated locally; it has not been installed or enabled in the OpenClaw Gateway.