diff --git a/docs/guides/cicd-testing.md b/docs/guides/cicd-testing.md index e103008..707dd92 100644 --- a/docs/guides/cicd-testing.md +++ b/docs/guides/cicd-testing.md @@ -292,12 +292,11 @@ The skills watcher picks up skill changes on the next agent turn; config changes openclaw backup create --verify --output ~/Backups openclaw update --dry-run openclaw update --yes -openclaw doctor --fix -openclaw config validate +openclaw doctor --lint openclaw channels status --probe ``` -`openclaw update` rehearses the update, restarts the Gateway, and rolls back if the post-update doctor fails. Run `openclaw doctor --fix` after every upgrade: releases retire config keys and Doctor migrates them. To roll back by hand, restore the backup and install the previous version with `openclaw update --tag `. +`openclaw update` runs the Doctor migrations the new release needs, restarts the Gateway and verifies it. If verification fails, it rolls back to the previous package and config automatically **only when no database schema changed** (a schema-neutral update); otherwise it keeps the new version and its recovery artifacts and reports what to do ([Rollback and recovery](https://docs.openclaw.ai/install/updating/rollback-and-recovery)). Installing an older version does not reverse migrations, so the reliable way back after a migrating update is to restore the verified backup with its matching release. `openclaw update --tag ` only works while the older release can still read your state. ### Docker @@ -327,29 +326,7 @@ The image already has a `HEALTHCHECK` on `/healthz` (liveness). Use `/startupz` ## Triggering the Agent From CI -To have a pipeline wake an agent (for example, "summarize this failed build"), enable Gateway HTTP hooks with a dedicated token: - -```json5 title="~/.openclaw/openclaw.json" -{ - hooks: { - enabled: true, - token: "${OPENCLAW_HOOKS_TOKEN}", - path: "/hooks", - allowedAgentIds: ["main"], - allowRequestSessionKey: false, - }, -} -``` - -```bash -curl -fsS https://agent.example.com/hooks/agent \ - -H "Authorization: Bearer $OPENCLAW_HOOKS_TOKEN" \ - -H 'Content-Type: application/json' \ - -H "Idempotency-Key: build-$GITHUB_RUN_ID" \ - --data '{"message":"Build failed on main. Summarize the log at the attached URL.","agentId":"main","deliver":true}' -``` - -An HTTP 200 means the run was admitted, not that it finished. Expose the Gateway only over HTTPS or a private network, never as plain HTTP on the internet. Treat the message as untrusted input to the agent. See [Inbound webhooks](https://docs.openclaw.ai/automation/cron-jobs/webhooks) and [API & Webhooks](/guides/api-webhooks). +To have a pipeline wake an agent ("summarize this failed build"), enable Gateway HTTP hooks with their own token and `curl` the `/hooks/agent` endpoint from the job, using the run ID as the `Idempotency-Key`. Config, a GitHub Actions example and the security notes are in [API & Webhooks](/guides/api-webhooks#github-actions). Treat the message as untrusted input to the agent, and reach the Gateway only over HTTPS or a private network. For scheduled checks on the agent host itself, use an [Automation](/guides/automation) job, for example `openclaw cron add "0 2 * * *" "Run the nightly health checklist" --name nightly-check`. @@ -371,7 +348,7 @@ For scheduled checks on the agent host itself, use an [Automation](/guides/autom - [ ] `openclaw backup create --verify` - [ ] Release notes read; `openclaw update --dry-run` -- [ ] `openclaw doctor --fix` and `openclaw config validate` after the update +- [ ] `openclaw doctor --lint` after the update; a verified backup kept until you have checked the upgrade - [ ] `openclaw channels status --probe` shows channels back --- diff --git a/docs/guides/clawhub.md b/docs/guides/clawhub.md index 8399c56..0dfc25e 100644 --- a/docs/guides/clawhub.md +++ b/docs/guides/clawhub.md @@ -52,7 +52,7 @@ Skill names are scoped to their publisher: `@alice/meeting-notes` and `@bob/meet ### Other directories -- [skills.sh](https://skills.sh): an Agent Skills directory across agents. OpenClaw installs from it with `openclaw skills install skills-sh:owner/repo/slug`. These entries are marked **Not scanned by ClawHub**. +- [skills.sh](https://skills.sh): an Agent Skills directory across agents. OpenClaw installs from it with `openclaw skills install skills-sh:owner/repo/slug`. OpenClaw marks these installs **Not scanned by ClawHub**. - [VoltAgent/awesome-openclaw-skills](https://github.com/VoltAgent/awesome-openclaw-skills): a large community list. Inclusion is not a security review. - [clawskills.sh](https://clawskills.sh): a third-party discovery site, unrelated to skills.sh. @@ -164,7 +164,7 @@ For CI, ClawHub ships a reusable GitHub Actions workflow; see [CI/CD & Testing]( ### After you publish -Publishes are staged: since 2026-10-13 every skill version and package release is held as pending behind pre-publication checks, and a scanner failure or timeout leaves it unpublished rather than letting it through ([clawhub PR #3947](https://github.com/openclaw/clawhub/pull/3947)). The checks are static analysis, VirusTotal, SkillSpector, Tencent A.I.G and ClawScan risk analysis; the release appears in search once it clears. Releases that are held or blocked stay visible to their owner. Download the scan report for a blocked version with: +A new release stays pending until it clears ClawHub's pre-publication checks (see [What ClawHub checks today](#what-clawhub-checks-today)), then appears in search. Releases that are held or blocked stay visible to their owner. Download the scan report for a blocked version with: ```bash clawhub scan download my-skill --version 1.0.1 --output report.zip @@ -176,96 +176,21 @@ Skills the agent writes for itself go through [Skill Workshop](/guides/skill-wor ## Security -### The ClawHavoc incident (February 2026) +### Incident history {#the-clawhavoc-incident-february-2026} -Koi Security audited all 2,857 skills then on ClawHub and flagged 341 as malicious, 335 of them from one campaign it named **ClawHavoc** ([The Hacker News](https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html), [SC Media](https://www.scworld.com/news/openclaw-agents-targeted-with-341-malicious-clawhub-skills), [eSecurity Planet](https://www.esecurityplanet.com/threats/hundreds-of-malicious-skills-found-in-openclaws-clawhub/)). The skills posed as crypto wallet trackers, Polymarket bots, YouTube tools and Google Workspace integrations, often under typosquatted names. Most told the user to run a fake "Prerequisites" step that installed **Atomic macOS Stealer (AMOS)**. Windows users were sent a password-protected ZIP containing a keylogger. - -Around the same time, Snyk's **ToxicSkills** study scanned 3,984 skills from ClawHub and skills.sh and found at least one security flaw in 36.8% of them, a critical issue in 13.4%, and 76 confirmed malicious payloads ([Snyk](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub)). - -### Unit 42 findings (June 2026) - -On 23 June 2026, Palo Alto Networks Unit 42 reported five malicious skills that had passed ClawHub's scanning between February and May 2026 ([Unit 42](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/)): - -- **Two macOS infostealers** with command-and-control connectivity -- **`omnicogg`**, which hid an AMOS dropper in `README.md` and padded the file with 22 MB of junk to get past scanner size limits. Both VirusTotal and ClawScan returned clean. -- **`money-radar`**, a fake financial adviser that injected affiliate links at runtime -- **`letssendit`**, an agentic Solana front-running skill - -The publisher accounts were banned and the skills removed. The lesson stands: scanning catches a lot, and attackers design around it. +In February 2026 Koi Security flagged 341 of the 2,857 skills then on ClawHub as malicious, 335 of them from one campaign (**ClawHavoc**) that used a fake "Prerequisites" step to install the Atomic macOS Stealer. In June 2026 Palo Alto Networks Unit 42 reported five more malicious skills that had passed ClawHub's scanning, including one that padded `README.md` with 22 MB of junk to get past scanner size limits ([Unit 42](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/)). Scanning catches a lot, and attackers design around it. The full history is in [Known Vulnerabilities](/security/known-vulnerabilities#malicious-clawhub-skills-february-2026). ### What ClawHub checks today -Each release gets a security audit on its skill page, combining ([Security audits](https://docs.openclaw.ai/clawhub/security-audits)): - -- **NVIDIA SkillSpector** findings -- **Tencent A.I.G** findings on agent instructions. Because A.I.G cannot inspect Python bytecode, ClawHub rejects skills containing `.pyc`, `.pyo` or `.pyd` files. -- **ClawScan** risk analysis, which asks whether the name, description, declared permissions and actual content line up, using the OWASP Agentic Skills Top 10 as a lens -- **VirusTotal** and static analysis results, shown as detail pages +Since 2026-10-13 every new skill version and package release is held as **pending** until the TruffleHog and ClawScan pre-publication checks pass on that exact artifact. A malicious verdict blocks the release; a scanner failure or timeout leaves it unpublished ([clawhub PR #3947](https://github.com/openclaw/clawhub/pull/3947)). The skill's security audit page then combines results from NVIDIA SkillSpector, Tencent A.I.G, ClawScan, VirusTotal and static analysis ([Security audits](https://docs.openclaw.ai/clawhub/security-audits)). Because A.I.G cannot inspect Python bytecode, ClawHub rejects skills containing `.pyc`, `.pyo` or `.pyd` files. Signed-in users can report a skill with the **Report skill** button. Reports never hide a skill automatically; moderators review them ([ClawHub moderation spec](https://github.com/openclaw/clawhub/blob/main/specs/security-moderation.md)). The old auto-hide rule was withdrawn after GHSA-5jj4-m8c9-gwcq showed that four ordinary accounts could hide any skill, official ones included. -OpenClaw itself also has a local code-safety scanner (since 2026.2.6), and `openclaw skills install` refuses releases ClawHub has marked malicious or blocked. - -### Third-party tools - -- [Clawdex by Koi](https://clawhub.ai/wearekoi/skills/clawdex) (`@wearekoi/clawdex`): a skill that checks other skills against Koi's malicious-skills database before you install them. Koi is now part of Palo Alto Networks. -- [Snyk agent-scan](https://github.com/snyk/agent-scan): an open-source security scanner for AI agents, MCP servers and agent skills (formerly `mcp-scan`). - -### Red flags - -Avoid skills that contain: - -- `curl | bash` or `wget | bash`, or a "prerequisites" step that downloads and runs something -- Base64-encoded strings or zero-width Unicode characters -- Very large files with little content (padding to evade scanners) -- Hardcoded URLs to unknown domains -- Reads of `~/.ssh`, `~/.aws`, browser profiles, wallets or other credential paths -- Environment variables that do not fit the skill's purpose -- `chmod 777`, or instructions to edit `SOUL.md` or agent config +On the OpenClaw side, `openclaw skills install` refuses releases ClawHub has marked malicious or blocked, and `openclaw security audit --deep` runs the local code-safety scanner over installed skills. Red flags to look for when reading a skill, and third-party scanners, are in [Skill Verification](/security/skill-verification#3-review-the-source). ### Locking down installs -There is no setting that switches ClawHub off. To control what can be installed, use `security.installPolicy`: a trusted local command that OpenClaw runs before every skill or plugin install or update (ClawHub, skills.sh, git, local, uploads, dependency installers). It answers `allow`, `warn` or `block`, and installs fail closed if it cannot answer. - -```json5 title="~/.openclaw/openclaw.json" -{ - security: { - installPolicy: { - enabled: true, - targets: ["skill", "plugin"], - exec: { - source: "exec", - command: "/usr/local/bin/openclaw-install-policy", - timeoutMs: 10000, - trustedDirs: ["/usr/local/bin"], - }, - }, - }, -} -``` - -The command reads one JSON request on stdin and writes one decision on stdout: - -```js title="/usr/local/bin/openclaw-install-policy" -#!/usr/bin/env node -let input = ""; -process.stdin.on("data", (c) => (input += c)); -process.stdin.on("end", () => { - const req = JSON.parse(input); - const decision = - req.targetType === "skill" - ? { protocolVersion: 1, decision: "block", reason: "skill installs are disabled on this host" } - : { protocolVersion: 1, decision: "allow" }; - process.stdout.write(JSON.stringify(decision)); -}); -``` - -The file must be a regular file owned by a trusted user with restricted permissions. `openclaw doctor --deep` runs a test request against it. See [Operator install policy](https://docs.openclaw.ai/tools/skills-config#operator-install-policy-security-installpolicy) for the full request and response format. - -Two more controls: - -- `skills.allowBundled: ["github", "weather"]` limits which **bundled** skills are eligible. -- `agents.defaults.skills` and `agents.entries..skills` limit which skills each agent can see. See [Skill Development](/guides/skill-development#which-agent-sees-which-skill). +There is no setting that switches ClawHub off. `security.installPolicy` runs a trusted local command before every skill or plugin install or update (ClawHub, skills.sh, git, local, uploads, dependency installers); it answers `allow`, `warn` or `block`, and installs fail closed if it cannot answer. `skills.allowBundled` limits which bundled skills are eligible, and `agents.defaults.skills` / `agents.entries..skills` limit which skills each agent sees. Config and caveats: [Skill Verification](/security/skill-verification#restrict-or-block-installs) and upstream [Operator install policy](https://docs.openclaw.ai/tools/skills-config#operator-install-policy-security-installpolicy). ### Reporting @@ -296,16 +221,16 @@ clawhub whoami clawhub search "query" clawhub explore [--sort downloads] clawhub inspect @owner/slug [--files] [--file ] [--versions] -clawhub uninstall @owner/slug -clawhub list -clawhub pin [--reason ] -clawhub unpin +clawhub --workdir uninstall @owner/slug # : agent workspace, or ~/.openclaw for --global +clawhub --workdir list +clawhub --workdir pin [--reason ] +clawhub --workdir unpin clawhub skill publish [--dry-run] [--version ] [--owner ] [--categories ] clawhub sync --all [--dry-run] [--bump minor] clawhub scan download --version ``` -Full reference: [ClawHub CLI](https://docs.openclaw.ai/clawhub/cli) and [`openclaw skills`](https://docs.openclaw.ai/cli/skills). +Full reference: [ClawHub CLI](https://docs.openclaw.ai/clawhub/cli), [`openclaw skills`](https://docs.openclaw.ai/cli/skills) and the site [CLI Reference](/reference/cli#skills-plugins-and-mcp). --- diff --git a/docs/guides/cloud-gpu-models.md b/docs/guides/cloud-gpu-models.md index f817966..59f4c38 100644 --- a/docs/guides/cloud-gpu-models.md +++ b/docs/guides/cloud-gpu-models.md @@ -49,7 +49,7 @@ Prices are approximate on-demand list prices **as of 2026-10-18**, taken from ea | [**RunPod**](https://www.runpod.io/pricing) | A100 80GB | 80 GB | $1.19-$1.79 | ~$870-$1,310 | 70B quantized, 32B full precision | | [**RunPod**](https://www.runpod.io/pricing) | H100 80GB | 80 GB | $1.99-$3.99 | ~$1,450-$2,910 | PCIe vs SXM, community vs secure | | [**Lambda**](https://lambda.ai/pricing) | A100 40GB | 40 GB | $1.99 | ~$1,450 | Simple pricing | -| [**Lambda**](https://lambda.ai/pricing) | H100 80GB | 80 GB | $3.29 PCIe / $4.29 SXM | ~$2,400 / ~$3,130 | | +| [**Lambda**](https://lambda.ai/pricing) | H100 80GB | 80 GB | $3.29 PCIe / $3.99-$4.29 SXM | ~$2,400 / ~$2,910-$3,130 | | | [**Vast.ai**](https://vast.ai/pricing) | Various | Various | Marketplace (live) | Varies | Auction/marketplace model, usually cheapest, less predictable | | [**CoreWeave**](https://www.coreweave.com/pricing) | A100 / H100 | 80 GB | See pricing page | | Enterprise, InfiniBand | | [**AMD Developer Cloud**](https://devcloud.amd.com/) | MI300X | 192 GB | See site | | Check the site for current credit offers | @@ -126,7 +126,7 @@ These providers host open-weight models behind an API. You pay per token; there | [**Together AI**](https://www.together.ai/pricing) | Bundled `together` provider | `TOGETHER_API_KEY` | Llama, DeepSeek, Kimi, GLM and more | | [**Fireworks AI**](https://fireworks.ai/pricing) | Official plugin `@openclaw/fireworks-provider` | `FIREWORKS_API_KEY` | Open-weight models and routers | | [**OpenRouter**](https://openrouter.ai) | Bundled `openrouter` provider; refs `openrouter//` | `OPENROUTER_API_KEY` | One key, many upstream providers | -| [**Hugging Face**](https://huggingface.co/pricing) | Provider page upstream | `HF_TOKEN` | See [Hugging Face](https://docs.openclaw.ai/providers/huggingface) | +| [**Hugging Face**](https://huggingface.co/pricing) | Bundled `huggingface` provider | `HF_TOKEN` or `HUGGINGFACE_HUB_TOKEN` | Routes to many inference providers; see [Hugging Face](https://docs.openclaw.ai/providers/huggingface) | | [**Modal**](https://modal.com/pricing) | Custom provider | your key | Serverless GPUs running your own vLLM | Per-token prices differ per model and change often, so check the linked pricing pages. OpenClaw's usage view shows the cost estimates it applies (`openclaw gateway usage-cost`). @@ -256,23 +256,13 @@ TabbyAPI uses ExLlamaV2/V3 for speed on RTX 3090/4090 with EXL2/GPTQ quantized m ## OpenClaw Configuration Notes -### Where things live - -| File | Purpose | -|------|---------| -| `~/.openclaw/openclaw.json` | Providers, models, agents, Gateway config | -| `~/.openclaw/.env` | API keys and other secrets (keep it `600`) | - ### Key rules -| Rule | Detail | -|------|--------| -| `baseUrl` | OpenAI-compatible servers usually end in `/v1`. Ollama's native API must **not** have `/v1`. Copy the URL from the provider's docs | -| `api` | Optional on custom providers (defaults to `openai-completions`); use `openai-responses` only if the server supports `/v1/responses` | -| `models` | An array of `{ id, name, ... }`; `id` is provider-local, with no provider prefix | -| Env substitution | `${ENV_VAR}` works in config values | -| Model refs | Select models as `provider-id/model-id` | -| Context window | Keep `contextWindow` at or below the server's `--max-model-len` | +- `baseUrl`: OpenAI-compatible servers usually end in `/v1`; Ollama's native API must **not**. Copy it from the provider's docs. +- `api`: optional on custom providers (defaults to `openai-completions`). Use `openai-responses` only if the server supports `/v1/responses`. +- `models[].id` is provider-local, with no provider prefix; you select it as `provider-id/model-id`. +- Keep `contextWindow` at or below the server's `--max-model-len`. +- Put keys in `~/.openclaw/.env` (mode `600`) and reference them as `${ENV_VAR}`. ### How OpenClaw picks a model @@ -357,10 +347,10 @@ For a full model selection guide covering cloud, local and hybrid setups, see th - **DeepSeek-R1-Distill-Qwen-32B** for planning and reasoning-heavy work - **Qwen 2.5 Coder 32B** for code-heavy work -These are community experience, not benchmarks. The [llama.cpp recipes](https://docs.openclaw.ai/plugins/llama-cpp) are the maintained reference in 2026.10.4; upstream adds a [recommended models](https://docs.openclaw.ai/concepts/recommended-models) page after that release. +These are community experience, not benchmarks. Upstream's [llama.cpp page](https://docs.openclaw.ai/plugins/llama-cpp) has maintained model recipes. :::warning -**Avoid models under about 8B parameters** for agent work. They hallucinate tool calls and lose track of multi-step tasks. Test real tasks before you make an open model your default; the best results with OpenClaw still come from frontier hosted models. +**Models under about 14B parameters often struggle with multi-step tool calling**, and those under 8B hallucinate tool calls. For reliable agent work use 30B+ or keep a hosted fallback. Test real tasks before you make an open model your default; the best results with OpenClaw still come from frontier hosted models. ::: --- diff --git a/docs/guides/custom-channels.md b/docs/guides/custom-channels.md index ca7ebfe..7dbc7bf 100644 --- a/docs/guides/custom-channels.md +++ b/docs/guides/custom-channels.md @@ -9,7 +9,7 @@ keywords: [openclaw, openclaw custom channel, channel plugin, plugin sdk, create # Custom Channels -OpenClaw 2026.10.4 supports 31 chat channels plus WebChat (see [Channels](/guides/channels)). If your platform is not among them, you can write a **channel plugin**. This page gives a short, correct skeleton and tells you where the upstream reference goes deeper. It was checked against OpenClaw **v2026.10.4** on 2026-10-18. +OpenClaw 2026.10.4 supports 31 chat channels plus WebChat (see [Channels](/guides/channels)). If your platform is not among them, you can write a **channel plugin**. This page gives a minimal skeleton and points to the upstream reference for the rest. The authoritative guide is [Building channel plugins](https://docs.openclaw.ai/plugins/sdk-channel-plugins). The SDK moves quickly (several subpaths were removed in 2026.8 to 2026.10), so check it before you start. @@ -23,7 +23,7 @@ Often you do not. Check these first: |----------------|-----| | Use a platform someone already supports | `openclaw channels list --all`, `openclaw plugins search `, or [clawhub.ai](https://clawhub.ai) | | Let your app, CI or Home Assistant send the agent a task | [Webhooks (`/hooks/agent`)](/guides/api-webhooks), no plugin needed | -| Build your own chat UI or client | The [Gateway WebSocket protocol](/guides/api-webhooks#websocket-api) and `@openclaw/gateway-client` | +| Build your own chat UI or client | The [Gateway WebSocket protocol](/reference/gateway-api#websocket-protocol-v4) and `@openclaw/gateway-client` | | Let another MCP client read and send through your existing channels | `openclaw mcp serve` | | React to or rewrite messages on existing channels | A plugin with [hooks](#hooks-instead-of-a-channel) | @@ -387,6 +387,8 @@ clawhub package publish myorg/openclaw-acme-chat --dry-run clawhub package publish myorg/openclaw-acme-chat ``` +The argument is a GitHub `owner/repo[@ref]`, a URL, or a local package folder such as `.`. + Users then install it with `openclaw plugins install clawhub:myorg/openclaw-acme-chat` (ClawHub) or `openclaw plugins install @myorg/openclaw-acme-chat` (npm). In 2026.10.4 a bare package spec installs from npm, so the `clawhub:` prefix is required for ClawHub. Name packages `@/openclaw-`; the `@openclaw/` scope belongs to the OpenClaw project. Reference: [Building plugins](https://docs.openclaw.ai/plugins/building-plugins). --- @@ -420,7 +422,8 @@ The hook names and their merge rules are in [Plugin hooks](https://docs.openclaw ## See Also - [Channels & Integrations](/guides/channels): built-in channels, pairing and group policy -- [API & Webhooks](/guides/api-webhooks): `/hooks/agent`, the Gateway protocol +- [API & Webhooks](/guides/api-webhooks): `/hooks/agent` +- [Gateway API](/reference/gateway-api): the WebSocket protocol - [Plugin System](/guides/plugin-system): plugin basics - [Security Hardening](/security/hardening): what an in-process plugin can reach - Upstream: [Building channel plugins](https://docs.openclaw.ai/plugins/sdk-channel-plugins), [Channel outbound API](https://docs.openclaw.ai/plugins/sdk-channel-outbound) diff --git a/docs/guides/deployment-options.md b/docs/guides/deployment-options.md index 0e16d55..5964619 100644 --- a/docs/guides/deployment-options.md +++ b/docs/guides/deployment-options.md @@ -9,7 +9,7 @@ keywords: [openclaw, deploy, docker, kubernetes, cloud hosting, self-host] # Deployment Options -OpenClaw runs as one Gateway process with its state in `~/.openclaw/`. Every option below is a different way to supervise that process and keep that directory. This page compares them and points to the official guide for each. Commands were checked against OpenClaw 2026.10.4. +OpenClaw runs as one Gateway process with its state in `~/.openclaw/`. Every option below is a different way to supervise that process and keep that directory. This page compares them and points to the official guide for each. ## Quick Comparison @@ -26,7 +26,7 @@ OpenClaw runs as one Gateway process with its state in `~/.openclaw/`. Every opt | [Managed hosting](#managed-hosting) | Easiest | Non-technical users | Varies | :::danger Never expose an unauthenticated Gateway -The Gateway listens on port 18789. Keep it on loopback and reach it over an SSH tunnel or Tailscale, or put it behind token/password auth and a firewall. Since 2.0 the installer refuses network installs that would expose OpenClaw without auth. See [Security Hardening](/security/hardening) and the upstream [network exposure](https://docs.openclaw.ai/gateway/security/network-exposure) guide. Whatever you deploy, the agent can run shell commands on that host; review approvals and sandboxing before connecting channels. +The Gateway listens on port 18789. Keep it on loopback and reach it over an SSH tunnel or Tailscale, or put it behind token/password auth and a firewall. Gateway auth is on by default: onboarding generates a token, and with no valid auth configured the Gateway refuses connections. See [Security Hardening](/security/hardening) and the upstream [network exposure](https://docs.openclaw.ai/gateway/security/network-exposure) guide. Whatever you deploy, the agent can run shell commands on that host; review approvals and sandboxing before connecting channels. ::: ## Local service {#local-service} @@ -151,15 +151,13 @@ kubectl port-forward svc/openclaw 18789:18789 -n openclaw Read the generated token with `kubectl get secret openclaw-secrets -n openclaw -o jsonpath='{.data.OPENCLAW_GATEWAY_TOKEN}' | base64 -d`. For a local test cluster, `./scripts/k8s/create-kind.sh` creates one with Kind. Upstream describes these manifests as a starting point, not a production deployment. Use `/healthz` and `/readyz` (or `/startupz`) for probes. -:::warning Archived Helm chart -The community chart [serhanekicii/openclaw-helm](https://github.com/serhanekicii/openclaw-helm) was **archived** in May 2026 and its chart repository URL no longer resolves. Do not start new deployments on it. Its example `gateway.host` and `brain.provider` keys are not OpenClaw config keys; the real setting is `gateway.bind` (`loopback`, `lan`, `tailnet`, `auto` or `custom`). -::: +Community Helm charts (one of them archived) are listed in [Ecosystem](/reference/ecosystem#helm-charts). If you copy values from one, note that `gateway.host` and `brain.provider` are not OpenClaw keys; the real setting is `gateway.bind` (`loopback`, `lan`, `tailnet`, `auto` or `custom`). ## Cloudflare Containers (Moltworker) {#moltworker} Upstream now has its own **experimental** Cloudflare template in [`scripts/cloudflare`](https://github.com/openclaw/openclaw/tree/main/scripts/cloudflare). It runs one Gateway in a Cloudflare Container (`standard-2`, one instance) behind a Worker and Durable Object, and replicates the SQLite databases to R2 with Litestream. Litestream protects the databases, not the whole state directory, so read the limits section of the [Cloudflare guide](https://docs.openclaw.ai/install/cloudflare) before you use production credentials. -[Moltworker](https://github.com/cloudflare/moltworker) (cloudflare/moltworker, Apache-2.0, about 9,900 stars as of 2026-10-18) is the earlier Cloudflare Sandbox port. Its README calls it "a proof of concept … not officially supported", and it has had no commits since May 2026. It needs the Workers Paid plan ($5/month) plus container compute; see its README for the cost estimate. Prefer the upstream template for new deployments. +[Moltworker](/reference/ecosystem#moltworker) is Cloudflare's earlier proof-of-concept port, unmaintained since May 2026. Prefer the upstream template for new deployments. ## 1Panel {#1panel} @@ -180,7 +178,7 @@ To install OpenClaw: open the panel, go to **App Store**, search for **OpenClaw* ## Coolify {#coolify} -[Coolify](https://coolify.io) is a self-hosted PaaS with an OpenClaw entry in its service catalog; see the [Coolify OpenClaw docs](https://coolify.io/docs/services/openclaw). A separate community integration, [essamamdani/openclaw-coolify](https://github.com/essamamdani/openclaw-coolify) (about 150 stars, last push August 2026), adds a Docker sidecar proxy, Cloudflare Tunnel, SearXNG and pre-installed dev tools. Its build needs roughly 13 GB of free disk for the Docker build cache. +[Coolify](https://coolify.io) is a self-hosted PaaS with an OpenClaw entry in its service catalog; see the [Coolify OpenClaw docs](https://coolify.io/docs/services/openclaw). Community Coolify templates and images are listed in [Ecosystem](/reference/ecosystem#deployment-tools). ## DigitalOcean {#digitalocean} @@ -205,14 +203,7 @@ The Ansible install uses a system unit, so on those hosts `sudo systemctl status ## Managed Hosting {#managed-hosting} -Many third-party services host OpenClaw for you. See the **[Hosting Providers guide](/guides/hosting-providers)** for a comparison. A few examples (prices change; check each site): - -- [Agent37](https://www.agent37.com) — low-cost shared containers -- [MyClaw.ai](https://myclaw.ai) — budget managed plans -- [WZ-IT](https://wz-it.com/en/managed-open-source/) — German managed open-source hosting -- [Clowd.bot](https://clowd.bot) — pay per launch - -RunClaw.ai, listed here before, did not respond on 2026-10-18. +Many third-party services host OpenClaw for you. The [Hosting Providers guide](/guides/hosting-providers) compares them. :::warning With managed hosting, your conversations, credentials and data pass through a third party's infrastructure, and that party controls the host the agent runs commands on. Review the provider's privacy policy and how it handles upgrades. Self-hosting gives you full control over your data. diff --git a/docs/guides/hosting-providers.md b/docs/guides/hosting-providers.md index af3a9cb..e7cfb73 100644 --- a/docs/guides/hosting-providers.md +++ b/docs/guides/hosting-providers.md @@ -3,13 +3,13 @@ last_update: date: 2026-10-18 verified_with: 2026.10.4 title: Hosting Providers -description: Compare about 30 OpenClaw hosting providers, from free VPS tiers to managed and enterprise hosting. Prices checked 2026-10-18. +description: Compare about 25 OpenClaw hosting providers, from free VPS tiers to managed and enterprise hosting. Prices checked 2026-10-18. keywords: [openclaw, hosting, managed hosting, cloud providers, vps] --- # Hosting Providers -About 30 providers offer OpenClaw hosting: fully managed services, platforms that manage your own server, VPS templates, and enterprise tiers. This page lists them with prices checked on **2026-10-18** against each provider's own site. Prices change often; check the provider before you buy. +About 25 providers offer OpenClaw hosting: fully managed services, platforms that manage your own server, VPS templates, and enterprise tiers. This page lists them with prices checked on **2026-10-18** against each provider's own site. Prices change often; check the provider before you buy. :::note Listings are vendor-submitted Most entries were added by the providers themselves or copied from their marketing pages. Clawdocs has not tested these services and does not endorse any of them. See the [listing policy](#listing-policy). @@ -19,16 +19,7 @@ Most entries were added by the providers themselves or copied from their marketi Not sure whether to self-host or use managed hosting? See [Deployment Options](/guides/deployment-options) for a comparison of all deployment methods including Docker, Kubernetes, and Cloudflare Workers. ::: -## Pricing at a Glance - -```mermaid -flowchart LR - Free["$0/mo
Oracle Cloud Free Tier
Agent37 / Aplite free plans"] --> Budget["$4-10/mo
Agent37, LumaDock
Hetzner, Contabo, xCloud"] - Budget --> Mid["$19-29/mo
MyClaw, Clawbase
ClawHosters, ClawdHost"] - Mid --> Premium["$29+/mo
BYOS platforms
Enterprise"] -``` - -## Quick Comparison +## Quick Comparison {#pricing-at-a-glance} Prices are entry prices as of 2026-10-18, from each provider's site. Promotional prices are marked. @@ -39,7 +30,7 @@ Prices are entry prices as of 2026-10-18, from each provider's site. Promotional | [Agent37](#agent37) | Managed (shared) | Free / $3.99/mo | No | — | Free tier, cheap paid plans | | [LumaDock](#lumadock) | VPS template | $4.99/mo (annual) | Possible | — | Budget VPS | | [Hetzner](#hetzner) | DIY VPS | See Hetzner | Yes | Yes | Best value self-host | -| [Alibaba Cloud](#alibaba-cloud) | VPS template | $4/mo | Yes (Qwen) | No | Asia-Pacific, Qwen models | +| [Alibaba Cloud](#alibaba-cloud) | VPS template | $4/mo | No (Qwen via API) | No | Asia-Pacific, Qwen models | | [Contabo](#contabo) | VPS template | €4.50/mo | Possible | Partial | Global budget VPS | | [Railway](#railway) | PaaS | $5/mo | No | No | Testing / development | | [Hostinger](#hostinger) | Managed apps | $5.99/mo (promo) | No | — | Managed AI automation apps | @@ -57,17 +48,17 @@ Prices are entry prices as of 2026-10-18, from each provider's site. Promotional | [Everpod](#everpod) | Managed | $29/mo | — | — | One customer per machine, model usage included | | [OpenClawHosting.io](#openclawhosting) | BYOS Managed | $29/mo | Yes (GPU) | — | Multi-instance teams | | [MoltBotHost](#moltbothost) | BYOS Managed | $29/mo | Yes (GPU) | Partial | Bring your own server | -| [SEAOTTER](#seaotter) | Managed Hermes (GCP) | $99/mo | No | — | Isolated Hermes control plane, no VPS/SSH | +| [SEAOTTER](#seaotter) | Managed Hermes, **not OpenClaw** | $99/mo | No | — | Hermes Agent only | :::warning -**API costs are separate.** Most providers require you to bring your own LLM API keys ($20-60/month typical). Some users have reported bills of **$3,600/month** from uncontrolled agent loops. Set spending limits on your API accounts. +**Model costs are usually separate.** Most providers require your own LLM API keys, and an always-on agent can run up large bills. Set spending limits in your provider's console; see [Cost Management](/guides/cost-management). ::: --- ## Fully Managed Hosting -These providers handle everything — no VPS, Docker, or terminal skills needed. +These providers run the server for you. ### xCloud {#xcloud} @@ -172,11 +163,6 @@ Managed Hermes Agent control plane on Google Cloud — not OpenClaw hosting, and - **Price**: **$99/agent/month** after a 7-day no-card trial - **Setup**: typically a few minutes; no VPS or SSH - **Features**: Per-agent isolation, MCP from Cursor / Claude / Codex, lifecycle APIs -- **Cite**: [seaotter.dev/cite](https://seaotter.dev/cite) · [What it is](https://docs.seaotter.dev/guides/what-is-seaotter) - -:::info -SEAOTTER hosts Hermes Agent, not OpenClaw. Extra managed-agent option alongside Agent37-style hosts — not a replacement. -::: ### Clawbase (formerly Molty Hosting) {#molty-hosting} @@ -241,7 +227,7 @@ Global presence with cryptocurrency payment support. ### Clowd.bot {#clowdbot} -Unique pay-as-you-go pricing — no subscriptions. +Pay per launch, no subscription. - **URL**: [clowd.bot](https://clowd.bot) - **Price** (as of 2026-10-18): $0.50 per instance launch + LLM token costs @@ -348,7 +334,7 @@ A free ARM VM large enough for OpenClaw and a small local model. ### Hetzner {#hetzner} -Best value-for-money for self-hosters. European data sovereignty. +Self-managed VPS in the EU. - **Guide**: [docs.openclaw.ai/install/hetzner](https://docs.openclaw.ai/install/hetzner) - **Sizing**: upstream asks for at least 6 GB RAM to build the image from source; a smaller server works with the official pre-built image @@ -359,7 +345,7 @@ Best value-for-money for self-hosters. European data sovereignty. ### Contabo {#contabo} -Global budget VPS with dedicated OpenClaw page. +Budget VPS with an OpenClaw page. - **URL**: [contabo.com/en/openclaw-hosting](https://contabo.com/en/openclaw-hosting/) - **Pricing** (entry price as of 2026-10-18; other tiers not re-checked): @@ -384,42 +370,36 @@ Hostinger's former OpenClaw VPS page now redirects to its managed "AI automation ### DigitalOcean {#digitalocean} -The developer-favorite with excellent documentation. +1-Click Marketplace Droplet. Upstream warns to review third-party 1-click images' startup scripts and firewall defaults; a plain Droplet with the normal install is in [Deployment Options](/guides/deployment-options#digitalocean). - **URL**: [marketplace.digitalocean.com/apps/openclaw](https://marketplace.digitalocean.com/apps/openclaw) - **Price**: From $24/month (4 GB RAM Droplet; not re-checked 2026-10-18) -- **Features**: 1-Click Deploy, security-hardened (Docker isolation, unique gateway token, firewall rules, non-root execution, fail2ban) -- **Also**: App Platform for elastic scaling of multiple agents +- **Features** (per the listing): Docker isolation, unique Gateway token, firewall rules, non-root execution, fail2ban ### Alibaba Cloud {#alibaba-cloud} -Largest geographic reach with tight Qwen AI model integration. +OpenClaw image on a Simple Application Server, wired to Alibaba Cloud Model Studio. - **URL**: [alibabacloud.com/en/campaign/ai-openclaw](https://www.alibabacloud.com/en/campaign/ai-openclaw) - **Price**: From $4/month (Simple Application Server; not re-checked 2026-10-18) - **Locations**: 19 global regions - **Features**: Pre-installed OpenClaw image, one-click setup, integrated with Alibaba Cloud Model Studio -- **Local LLMs**: Qwen3-max pre-configured +- **Models**: Qwen models through the Model Studio API (not local) ### LumaDock {#lumadock} - **URL**: [lumadock.com/vps-hosting/openclaw](https://lumadock.com/vps-hosting/openclaw) - **Price** (as of 2026-10-18): VPS.S1 (2 vCPU, 2 GB RAM) $4.99/month billed yearly, $5.99 monthly; VPS.S2 (4 GB RAM) from $7.99 - **Features**: Pre-installed on Ubuntu 24.04, AMD EPYC, NVMe SSD, unmetered bandwidth, DDoS protection, snapshots/backups -- **Support**: 24/7 certified engineers, 30-day refund +- **Refund**: 30 days ### BoostedHost {#boostedhost} -Premium performance with Auto-Burst scaling. - - **URL**: [boostedhost.com/openclaw-vps-hosting](https://boostedhost.com/openclaw-vps-hosting/) - **Features**: NVMe SSD, high-clock CPUs, **Auto-Burst Scaling** (borrows extra power during spikes), dedicated IPv4, 18+ countries -- **Support**: Real human engineers 24/7 ### LightNode {#lightnode} -Most global locations of any provider. - - **URL**: [go.lightnode.com/moltbot-vps](https://go.lightnode.com/moltbot-vps) - **Price**: Hourly billing - **Locations**: **40+ locations** across US, Europe, Middle East, Asia, South America @@ -427,8 +407,6 @@ Most global locations of any provider. ### Railway {#railway} -Cheapest way to test OpenClaw in the cloud. - - **URL**: [railway.com/deploy/openclaw](https://railway.com/deploy/openclaw) - **Price**: Free trial credit, then Hobby $5/month (not re-checked 2026-10-18) - **Features**: One-click deploy, web-based setup wizard, state persisted to Railway Volume, auto reverse proxying with auth, one-click backup exports @@ -444,17 +422,7 @@ Cheapest way to test OpenClaw in the cloud. --- -## Enterprise & GDPR-Compliant - -### Clawery {#clawery} - -- **URL**: [clawery.com](https://clawery.com) -- **Price**: Custom (enterprise) -- **Status**: The site now describes an enterprise AI assistant service and no longer mentions OpenClaw (checked 2026-10-18). Ask the vendor what runs underneath before treating it as OpenClaw hosting. - -### NEAR AI {#near-ai} - -The former `near.ai/openclaw` page returns 404 (checked 2026-10-18), so NEAR's OpenClaw hosting beta is no longer listed. NEAR's related open-source project is [IronClaw](https://github.com/nearai/ironclaw) (12,661 stars as of 2026-10-18), a separate Rust agent focused on privacy and security, not an OpenClaw host. See [Lightweight Variants](/guides/lightweight-variants). +## Done-for-you setup ### Managed OpenClaw {#managed-openclaw} @@ -466,15 +434,9 @@ The former `near.ai/openclaw` page returns 404 (checked 2026-10-18), so NEAR's O ## Serverless & Edge -### Cloudflare (Moltworker) {#cloudflare} - -An experimental Cloudflare project that runs OpenClaw on Workers and Sandbox containers. Its README calls it "a proof of concept" that "is not officially supported and may break without notice". - -- **Price**: Workers Paid plan $5/month plus container compute; the README estimates about $34.50/month running 24/7, plus API keys -- **Repo**: [github.com/cloudflare/moltworker](https://github.com/cloudflare/moltworker) (9,948 stars, last push 2026-05-09, as of 2026-10-18) -- **Features**: Sandbox containers, browser automation via CDP, optional R2 storage +### Cloudflare {#cloudflare} -See [Deployment Options](/guides/deployment-options#moltworker) for setup details. +Upstream has an experimental Cloudflare Containers template; Cloudflare's older Moltworker proof of concept is unmaintained. Costs are a Workers Paid plan plus container compute. See [Deployment Options](/guides/deployment-options#moltworker). --- @@ -498,7 +460,7 @@ Comparison sites and reviews. Several are run by hosting companies or earn affil Before choosing a provider, be aware of these risks: -- **API cost runaway**: Set spending limits on your LLM API accounts. Community reports of $3,600/month bills from uncontrolled agent loops +- **API cost runaway**: Set spending limits on your LLM API accounts - **Outdated versions**: Ask which OpenClaw version the provider runs and how fast it applies updates. CVE-2026-25253 (fixed in 2026.1.29) is one of hundreds of published advisories; see [Known Vulnerabilities](/security/known-vulnerabilities) - **Exposed gateways**: Internet scans in February 2026 found [42,665 exposed instances (Shodan, Feb 9) and 135,000+ in follow-up scans](/security/known-vulnerabilities#exposed-instances-january-february-2026). On a VPS, keep `gateway.bind` on loopback and reach it through an SSH tunnel or Tailscale ([hardening](/security/hardening)) - **Third-party installers**: Some providers advertise `curl -fsSL https:///install | bash`. That runs the provider's script with your privileges. Read it first, or use the [official installer](https://docs.openclaw.ai/install) @@ -512,7 +474,7 @@ See [Security Overview](/security/overview) and [Security Hardening](/security/h - **Disclosure**: a pull request that adds or edits an entry must state the author's affiliation with the operator (owner, employee, contractor, affiliate, or none). Undisclosed vendor edits are reverted. - **Prices are dated**: every price carries the date it was checked ("as of YYYY-MM-DD") and a link to the provider's own page. - **Unverified claims are marked**: uptime, compliance, security and "first/only/best" claims are the vendor's own unless a source is cited. Clawdocs does not test these services. -- **Pruning**: entries whose site is unreachable, returns 404, or no longer offers OpenClaw are removed at the next review. Removed on 2026-10-18: Clawhost.dev (404; its `npx clawd deploy` line pointed at an unrelated npm package), RunClaw.ai (connection timeout), ClawRun.dev (HTTP 503), Kilo Claw (page redirects to the generic kilo.ai homepage) and WZ-IT (OpenClaw page redirects to a generic managed-hosting page). +- **Pruning**: entries whose site is unreachable, returns 404, or no longer offers OpenClaw are removed at the next review. Removed on 2026-10-18: Clawhost.dev (404; its `npx clawd deploy` line pointed at an unrelated npm package), RunClaw.ai (connection timeout), ClawRun.dev (HTTP 503), Kilo Claw (page redirects to the generic kilo.ai homepage), WZ-IT (OpenClaw page redirects to a generic managed-hosting page), Clawery (site no longer mentions OpenClaw) and NEAR AI (`near.ai/openclaw` returns 404). ## See Also diff --git a/docs/guides/lightweight-variants.md b/docs/guides/lightweight-variants.md index ab1a34c..4bd98de 100644 --- a/docs/guides/lightweight-variants.md +++ b/docs/guides/lightweight-variants.md @@ -188,18 +188,9 @@ Whichever you run, an agent with shell, files, email or browser access needs app --- -## Contributing a variant - -1. Document clearly what works and what does not compared with OpenClaw. -2. State your security model, especially for embedded and IoT builds. -3. Add the project to a maintained list such as [rohitg00/awesome-openclaw](https://github.com/rohitg00/awesome-openclaw) (560 stars) or [vincentkoc/awesome-openclaw](https://github.com/vincentkoc/awesome-openclaw) (146 stars, last push 2026-04-20). -4. Consider MCP compatibility for interoperability. - ---- - ## See also -- [Ecosystem](/reference/ecosystem): tools, clients and hosting +- [Ecosystem](/reference/ecosystem#lightweight-alternatives): the short index of these projects, plus community tools, clients and hosting - [Installation](/getting-started/installation): standard OpenClaw setup - [Local Models](/guides/local-models): running models on your own hardware - [Security Overview](/security/overview): threat model and hardening diff --git a/docs/guides/lobster-workflows.md b/docs/guides/lobster-workflows.md index b0da9c5..251fb65 100644 --- a/docs/guides/lobster-workflows.md +++ b/docs/guides/lobster-workflows.md @@ -761,21 +761,6 @@ lobster version --- -## Lobster vs alternatives - -| Tool | Approach | Human approval | Runs locally | -|------|----------|----------------|--------------| -| **Lobster** | YAML workflow shell, typed pipes | Built-in gates with resume tokens | Yes | -| **LangGraph** | Python/JS graph library | Interrupts (human-in-the-loop) | Yes (open source library) | -| **CrewAI** | Python agent framework | Human input on tasks | Yes | -| **n8n** | Visual workflow builder | Wait/approval nodes | Self-hosted | -| **Temporal** | Durable distributed workflows | Signals | Self-hosted | -| **GitHub Actions** | CI/CD YAML | Environment protection rules | Hosted or self-hosted runners | - -Lobster's niche is small, reviewable pipelines that plug directly into OpenClaw tools and agents, with typed data between steps and approval gates that survive a pause. - ---- - ## See also - [Automation Guide](/guides/automation): Automations (cron), hooks and other triggers diff --git a/docs/guides/local-models.md b/docs/guides/local-models.md index b7fb745..d733ce3 100644 --- a/docs/guides/local-models.md +++ b/docs/guides/local-models.md @@ -296,7 +296,7 @@ Give each host its own provider ID with `api: "ollama"`. Each provider has its o agents: { defaults: { model: { - primary: "ollama-fast/gemma4:12b", + primary: "ollama-fast/qwen3.5:9b", fallbacks: ["ollama-large/qwen3.5:27b"], }, }, @@ -307,7 +307,7 @@ Give each host its own provider ID with `api: "ollama"`. Each provider has its o baseUrl: "http://gpu-server-1:11434", apiKey: "ollama-local", api: "ollama", - models: [{ id: "gemma4:12b", name: "gemma4:12b", contextWindow: 32768 }], + models: [{ id: "qwen3.5:9b", name: "qwen3.5:9b", contextWindow: 32768 }], }, "ollama-large": { baseUrl: "http://gpu-server-2:11434", @@ -622,7 +622,7 @@ OpenClaw needs models that handle function calling. Not all local models do this | **DeepSeek-R1-Distill-Qwen-32B** | Moderate | Good | Excellent | Reasoning-heavy tasks | | **Llama 3.3 70B** | Good | Good | Good | Needs a big GPU | | **Mistral Small 3.2 24B** | Moderate | Good | Good | Good balance | -| **Gemma 4 12B** | Moderate | Good | Moderate | Lightweight option | +| **Gemma 4 E4B / 26B** | Moderate | Good | Moderate | Lightweight option | These ratings are community experience, not benchmarks. The [llama.cpp recipe catalog](https://docs.openclaw.ai/plugins/llama-cpp) is the maintained reference in 2026.10.4; upstream adds a [recommended models](https://docs.openclaw.ai/concepts/recommended-models) page after that release. diff --git a/docs/guides/recipes/advanced-recipes.md b/docs/guides/recipes/advanced-recipes.md index 79fa625..6fc9166 100644 --- a/docs/guides/recipes/advanced-recipes.md +++ b/docs/guides/recipes/advanced-recipes.md @@ -10,7 +10,7 @@ keywords: [openclaw, advanced recipes, multi-agent, workboard, memory search, ho # Advanced Recipes :::danger Read before you run this recipe -These recipes give an agent real powers (shell, SSH, email, smart-home devices). By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Before you try one, turn on approvals (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices the recipe needs. The config blocks on this page were checked with `openclaw config validate` on OpenClaw 2026.10.4. See [permission modes](https://docs.openclaw.ai/tools/permission-modes) and [sandboxing](https://docs.openclaw.ai/gateway/sandboxing). +These recipes give agents shell, SSH, smart-home and deploy access. By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Turn on approvals first (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices it needs. See [Security hardening](/security/hardening#exec-approvals) and upstream [permission modes](https://docs.openclaw.ai/tools/permission-modes). ::: These recipes go beyond the basics. Each one shows the config, the skill files and, most importantly, where the guardrail is **enforced**. A sentence in a skill such as "always ask before deploying" is guidance for the model, not a control. Prompt injection can talk a model out of it. The controls are tool policy, exec approvals, the sandbox, scoped credentials and channel allowlists ([Security Hardening](/security/hardening)). @@ -419,7 +419,7 @@ A file path in the workspace, or pasted text. specific connected channel. ``` -Use it with `/skill content-pipeline` in chat. For a scheduled post to a connected channel, make a one-shot automation with `openclaw cron add --at "2026-10-21T09:00" --message "Post the approved announcement draft from drafts/... as written" --name "Announce launch" --channel slack --to "#announcements"` once you have approved the text. +Use it with `/skill content-pipeline` in chat. For a scheduled post to a connected channel, make a one-shot automation with `openclaw cron add --at "2026-10-21T09:00" --tz Europe/Berlin --message "Post the approved announcement draft from drafts/... as written" --name "Announce launch" --channel slack --to "channel:C0123456789"` once you have approved the text. Slack targets are channel IDs (`channel:`), not names. --- diff --git a/docs/guides/recipes/code-reviewer.md b/docs/guides/recipes/code-reviewer.md index e0dbe17..4090a52 100644 --- a/docs/guides/recipes/code-reviewer.md +++ b/docs/guides/recipes/code-reviewer.md @@ -10,7 +10,7 @@ keywords: [openclaw, code review, automated review, pull request, code quality, # Recipe: Code Reviewer :::danger Read before you run this recipe -These recipes give an agent real powers (shell, SSH, email, smart-home devices). By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Before you try one, turn on approvals (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices the recipe needs. Config blocks on this page were checked with `openclaw config validate` on 2026.10.4. See [permission modes](https://docs.openclaw.ai/tools/permission-modes) and [sandboxing](https://docs.openclaw.ai/gateway/sandboxing). +This recipe gives an agent your shell (through `gh`) and read access to your repositories. By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Turn on approvals first (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices it needs. See [Security hardening](/security/hardening#exec-approvals) and upstream [permission modes](https://docs.openclaw.ai/tools/permission-modes). ::: Have OpenClaw review pull requests and report CI failures to you in chat. The reviewer reads; it never merges, pushes or comments on GitHub. diff --git a/docs/guides/recipes/email-assistant.md b/docs/guides/recipes/email-assistant.md index 8578d1e..ae206a1 100644 --- a/docs/guides/recipes/email-assistant.md +++ b/docs/guides/recipes/email-assistant.md @@ -10,7 +10,7 @@ keywords: [openclaw, email assistant, email triage, inbox, himalaya, gog, gmail, # Recipe: Email Assistant :::danger Read before you run this recipe -These recipes give an agent real powers (shell, SSH, email, smart-home devices). By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Before you try one, turn on approvals (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices the recipe needs. Config blocks on this page were checked with `openclaw config validate` on 2026.10.4. See [permission modes](https://docs.openclaw.ai/tools/permission-modes) and [sandboxing](https://docs.openclaw.ai/gateway/sandboxing). +This recipe gives an agent your shell (through `himalaya`) and your inbox. By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Turn on approvals first (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices it needs. See [Security hardening](/security/hardening#exec-approvals) and upstream [permission modes](https://docs.openclaw.ai/tools/permission-modes). ::: Get a morning and evening digest of your inbox, VIP alerts, and reply drafts you send yourself. diff --git a/docs/guides/recipes/research-agent.md b/docs/guides/recipes/research-agent.md index 64fedef..298b124 100644 --- a/docs/guides/recipes/research-agent.md +++ b/docs/guides/recipes/research-agent.md @@ -10,7 +10,7 @@ keywords: [openclaw, research agent, ai research, automated research, web search # Recipe: Research Agent :::danger Read before you run this recipe -These recipes give an agent real powers (shell, SSH, email, smart-home devices). By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Before you try one, turn on approvals (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices the recipe needs. Config blocks on this page were checked with `openclaw config validate` on 2026.10.4. See [permission modes](https://docs.openclaw.ai/tools/permission-modes) and [sandboxing](https://docs.openclaw.ai/gateway/sandboxing). +This recipe gives an agent the web and write access to its workspace. By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Turn on approvals first (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices it needs. See [Security hardening](/security/hardening#exec-approvals) and upstream [permission modes](https://docs.openclaw.ai/tools/permission-modes). ::: Turn OpenClaw into a research assistant that searches, cross-checks and writes a structured report. diff --git a/docs/guides/recipes/smart-home.md b/docs/guides/recipes/smart-home.md index 2696b50..06a83a6 100644 --- a/docs/guides/recipes/smart-home.md +++ b/docs/guides/recipes/smart-home.md @@ -10,7 +10,7 @@ keywords: [openclaw, smart home, home automation, philips hue, openhue, iot cont # Recipe: Smart Home :::danger Read before you run this recipe -These recipes give an agent real powers (shell, SSH, email, smart-home devices). By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Before you try one, turn on approvals (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices the recipe needs. Config blocks on this page were checked with `openclaw config validate` on 2026.10.4. See [permission modes](https://docs.openclaw.ai/tools/permission-modes) and [sandboxing](https://docs.openclaw.ai/gateway/sandboxing). +This recipe gives an agent your shell (through `openhue`) and your lights. By default OpenClaw runs host commands **without asking** (`tools.exec.mode` is `full`) and the sandbox is **off**. Turn on approvals first (`openclaw config set tools.exec.mode ask`), use a strong model for anything that runs tools unattended, and give the agent only the accounts and devices it needs. See [Security hardening](/security/hardening#exec-approvals) and upstream [permission modes](https://docs.openclaw.ai/tools/permission-modes). ::: Turn lights on and off, dim rooms and set scenes from chat. This recipe covers Philips Hue. For locks, alarms, thermostats and other devices, see the [Home Assistant recipe](/guides/recipes/advanced-recipes#home-assistant-control), which needs stricter guardrails. @@ -84,10 +84,10 @@ Lights on a schedule are an automation: ```bash openclaw cron add "30 22 * * *" \ "Dim the bedroom lights to 20% warm white." \ - --name "Bedtime lights" --tools exec,read + --name "Bedtime lights" --tools exec,read --no-deliver ``` -`--tools exec,read` lets the job run `openhue` (through the allowlist) and read the skill, nothing else. +`--tools exec,read` lets the job run `openhue` (through the allowlist) and read the skill, nothing else. `--no-deliver` keeps the run out of your chat. ## See Also