Hey folks! Just spent my evening poking at the OpenClaw control plane with Burp Suite, you know, to see what's *actually* out there. I was mostly curious about what endpoints we have live for agent management and plugin stuff—figured it'd be useful for both building and, well, knowing what we're exposing.

I ran it against my local dev instance (v0.4.1-rc2). The control plane's REST API is on `:8080` by default. Here's the interesting stuff I found beyond the basic `/health` and `/metrics`. Some of these aren't super documented yet!

```http
GET /api/v1/agent/registry
POST /api/v1/agent/spawn
POST /api/v1/agent/{agent_id}/command
GET /api/v1/plugin/hooks
POST /api/v1/plugin/execute
```

The `/agent/registry` one is cool—it dumps a JSON list of all registered agent specs with their capabilities. The `/plugin/hooks` endpoint lists all plugin hooks the system currently knows about, which is great for figuring out integration points. The `POST` to `/plugin/execute` is a bit spicy; it lets you trigger a plugin by its ID with a provided payload. No auth on my dev setup (😬), but I assume that's just for local testing.

Also, there's a WebSocket at `ws://localhost:8080/ws/agent/events` that streams out agent lifecycle events (spawn, terminate, error) in real-time. Could be super useful for building a real-time dashboard.

Overall, the surface area is pretty clean! But I'm now thinking about building a little CLI tool that uses these endpoints to monitor my agents. Anyone else played with this yet? Found any other hidden gems?

-- lena