One MCP connection. 9,000+ apps. Per-tool permissions. Zero credentials exposed to the agent.
Plugging Gmail, Slack, Notion and HubSpot API keys straight into an autonomous agent feels fast. It's also the move that gets your inbox wiped, your CRM cleared, or a Slack channel posted into at 3am.
One prompt injection inside an email body, a website the agent reads, or a calendar invite, and that agent now has full send-and-delete rights across your stack.
The fix is to put a layer between OpenClaw and your apps. That layer is Zapier MCP.
Zapier's own warning. Anyone with your MCP URL can run every action you've enabled, on your account. Don't share it. Don't paste it into screenshots. Rotate it the moment you suspect a leak.
By the end you'll have a single MCP endpoint exposing only the actions you whitelist (e.g. gmail_create_draft, slack_send_dm, notion_find_page) and zero send-then-delete blast radius.
Head to mcp.zapier.com (sign in with the same Zapier account that holds your app connections).
Click + New MCP Server. In the MCP Client dropdown pick Other (OpenClaw isn't in the preset list, but the connection works the same way). Name it something like openclaw-prod so you can spot it later.
Pro move: spin up two servers. One openclaw-readonly for any agent run that just needs to look around, and one openclaw-write for jobs that need to actually do something. Smaller blast radius per workflow.
In the Configure tab of your new server, search and add the actions for each app. Every action you add becomes a callable tool on the MCP endpoint, so only enable what this server actually needs.
A sane starter set for a business operator running OpenClaw 24/7:
Heads up: every successful tool call burns 2 Zapier tasks. Budget accordingly if you're running an agent on a loop.
This is where most people skip and most people get burned. For each app, decide what the agent is allowed to do, and crucially what it isn't.
Default rule: if the action can't be undone in under 30 seconds, leave it off.
If a prompt injection ever lands inside an email, the worst-case outcome under this config is a draft sitting in your drafts folder. You see it. You delete it. Done.
Open the Connect tab on your server. You'll see a URL that looks like this:
Copy it. This single URL is the only thing OpenClaw needs. Your Gmail OAuth token, Slack token, Notion key and HubSpot key all stay locked inside Zapier — OpenClaw never sees them.
If anything ever feels off, hit the Rotate secret icon on the Connect tab. New URL, old one is dead instantly. One rotation kills access to all 9,000+ apps. Try doing that with twelve separate API keys.
OpenClaw reads its config from ~/.openclaw/openclaw.json. Open it and add a Zapier server under the mcp.servers block:
Or do it from the CLI without touching the file:
Then verify the connection:
You should see your Zapier server listed and the tools you enabled showing up as available.
Don't trust the wiring on day one with anything that writes. Start with something completely safe:
Once OpenClaw returns a clean answer, open History on your Zapier dashboard. Every MCP call is logged there with the exact action, parameters, and result. This is your audit trail forever.
Want an extra layer? Add AI Guardrails by Zapier to your server. It scans for prompt injection attempts, PII leaks and toxic content before the action runs. Free, native, takes 60 seconds to enable.
Zapier MCP is included on every plan, including the free tier. Spin up your first server in five minutes — then come learn the broader system inside AI Systems Lab.
Sign up to Zapier for free Join AI Systems Lab