Observability for AI agents that counts dollars before milliseconds

What it does

claw-lens reads the JSONL session logs that OpenClaw already writes to disk, parses them into a local SQLite database, and surfaces the results in a React frontend. It tracks token spend, session health, cron jobs, and memory files, and includes a live WebSocket feed from the OpenClaw Gateway. Everything binds to localhost and stays offline.

The interesting bit

The project rejects the traditional observability premise that latency is king. For AI agents, cost is the dominant signal, and the atomic unit is a session, not a request. The security audit layer is particularly notable: it uses deterministic regex rules and 30-day behavioral baselines to flag file access, shell commands, and prompt injection attempts without invoking any external ML service.

Key highlights

• Cost-first metrics with per-session, per-model, and per-agent USD breakdowns
• Rule-based security scoring with 34 sensitive-data patterns and 9 prompt-injection detectors
• Real-time live monitor via WebSocket proxy to the local OpenClaw Gateway
• Full session timeline, profiler, cache trace replay, and context-window visualization
• Completely local: reads existing OpenClaw logs, writes only its own SQLite file, no telemetry

Caveats

• Requires OpenClaw to be installed and writing logs; the cache trace feature must be explicitly enabled in OpenClaw first
• Only supports English and Chinese interfaces
• The live monitor needs a valid gateway auth token from openclaw.json

Verdict

Operators and founders running OpenClaw agents who need to understand where their money is going and whether their agents are misbehaving should look here. If you are not using OpenClaw, this is not your tool.