OpenClaw is the first “AI assistant” that feels less like a chat box and more like a teammate who can actually touch the keyboard. It runs locally or on a server you control, connects to real chat surfaces (WhatsApp, Telegram, Discord, Slack and more), and can use tools like shell commands, files, browser automation, plugins, and long-term memory to complete work end to end.
If that sentence made you slightly uncomfortable, good. The OpenClaw docs basically agree: running an agent with tool access is “spicy”, and there’s no perfectly secure setup, only deliberate tradeoffs.
This post is a deep, practical guide to what OpenClaw is, what it can do, how it works, and how to run it without doing something… legendary in the worst way.
TL;DR (for busy humans)
OpenClaw is an open-source, self-hosted AI agent system with a Gateway that connects models to real tools and real messaging surfaces.
It became famous because it combines three things that are individually common, but collectively rare: persistent memory, deep tool access, and an agent loop that can plan and execute instead of just replying.
It is powerful enough that security researchers documented impersonation and typosquat campaigns around earlier naming transitions, so “download hygiene” matters.
What is OpenClaw, really?
Think of OpenClaw as a “Gateway + Skills + Channels” system:
- Gateway: a service (usually Node.js) that runs continuously and brokers everything: messages in, model calls, tool execution, logs, routing, auth, and UI access.
- Channels: connectors that let you talk to your agent from WhatsApp, Telegram, Discord, Slack, and more.
- Tools/Skills/Plugins: the capability layer that lets it do things (run commands, read/write files, browse, trigger workflows, call services).
- Memory: it can keep long-term context across sessions (often stored as local files), which is part of why it feels like a persistent assistant instead of a goldfish.
Under the hood, OpenClaw is designed to take a goal, build a plan, execute steps with tools, observe results, and iterate. That “agent loop” is why people describe it as “an assistant with hands” rather than “a smarter chatbot.”
Quick history (so you don’t get confused by old posts)
OpenClaw has had earlier names (Clawdbot, Moltbot) tied to trademark drama and the project’s rapid viral growth. Security researchers noted opportunists registering typosquat domains and cloning repos during a rename window, which is exactly the kind of thing that hits fast-growing open-source projects.
Translation: always verify the real project domain and GitHub org before installing anything.
4 killer things OpenClaw can do (that make it feel unreal)
1) Turn “Do I have time today?” into an automatically executed plan
Instead of: “Here’s a nice schedule idea.”
OpenClaw can: review your constraints, propose a plan, then actually execute the boring parts (messages, reminders, drafts, workflow steps) because it has real tool access and can run continuously as a daemon.
2) Build systems for you while you sleep (Kanban boards, ops dashboards, automation glue)
A 1Password writer described setting it up and quickly having it build a working Kanban board for task tracking. That’s not “one magic prompt”, that’s the agent loop + tools + persistence doing its thing.
3) Operate through chat apps you already live in
WhatsApp QR login, Telegram bots, Discord, Mattermost, Slack, etc. The whole point is you can talk to it where you already talk to humans, then it can do real work on the machine it’s running on.
4) Escalate from “I can’t” to “I’ll find another way”
The same 1Password post mentions an anecdote where it couldn’t book via OpenTable, so it went and got voice software and called a restaurant. That’s the vibe: it improvises toolchains when blocked, which is both impressive and exactly why you must treat access control as sacred.
What can you do with OpenClaw? Practical use cases that actually matter
OpenClaw for founders and ops
If you run a business, OpenClaw becomes valuable when it stops being “AI writing” and starts being “AI doing”.
Example workflows:
- Daily ops sweep: collect status from multiple places, summarize, ping the right person, open a task, and keep a running ops log (persistent memory helps here).
- Customer support triage: ingest a ticket, pull relevant internal docs, propose a response, and (with the right guardrails) draft replies and next steps. The danger is prompt injection through untrusted ticket text, so you isolate what it can do.
- Process enforcement: the Gateway can run continuously, and OpenClaw has concepts like health checks, logging, and an audit command so you can treat it like infrastructure, not a toy.
OpenClaw for devs
This is where it gets spicy-good.
- Repo work: create branches, apply patches, run tests, open PR drafts, and keep context across sessions. (If you let it touch your repo, sandbox and permissions matter.)
- Local automation: it can run shell commands and manipulate files, which turns “here’s how you might do it” into “done, here’s the diff and the output.”
- Multi-agent patterns: OpenClaw explicitly supports multi-agent routing concepts, which is a fancy way of saying “use a safer reader agent for untrusted inputs, then pass summaries to a tool-enabled agent.” That’s not theory, it’s recommended in their security thinking.
OpenClaw for hosting and infrastructure nerds (my favorite category)
Run it on a VPS like BoostedHost and it starts behaving like always-on infra:
- Always-on agent: keep the Gateway running 24/7 and talk to it from chat.
- Safer separation: put the agent on a dedicated box instead of your personal laptop, so compromise does not instantly mean “your whole life is now a log file.” The security docs and security community commentary heavily imply separation as a sane default.
- Controlled remote access: OpenClaw points to remote access approaches like SSH tunnel and Tailscale in their “next steps”, which is exactly how you avoid exposing a control plane to the public internet.
How OpenClaw works (without the marketing fog)
The onboarding wizard is the “choose your risk” moment
The docs show a guided openclaw onboard --install-daemon flow where you pick local vs remote gateway, auth method (OAuth or API keys), and chat providers like WhatsApp, Telegram, Discord, Mattermost.
That wizard also generates and stores gateway tokens, installs a background service, and sets runtime expectations (Node recommended, Bun not recommended for some channels).
DM pairing exists for a reason
By default, unknown DMs do not get processed until approved. You can list and approve pairings explicitly. That’s OpenClaw acknowledging the obvious truth: a bot that can run tools should not be “public DM accessible by accident.”
The security audit command is not optional
OpenClaw includes openclaw security audit plus --deep and --fix options to flag common footguns (auth exposure, browser control exposure, permissions, allowlists) and apply guardrails.
That alone tells you the team expects people to misconfigure it, because people are people.
Hardware requirements (real talk)
OpenClaw can be lightweight or heavy depending on how you use it, but there’s one pattern that keeps showing up: memory matters more than you think.
From real-world usage guidance:
- Absolute minimum: 2 GB RAM
- Recommended: 4 GB RAM
- Comfortable / production: 16 GB RAM
If you underspec it, you get exactly the kind of chaos you’d expect from a long-running Node process plus UI plus tool execution: random crashes, heap errors, and a UI that refuses to load when you need it most.
Opinionated sizing rule (works well in practice):
- 4 GB if you want it to feel stable for personal use
- 8 to 16 GB if you want browser automation, multiple agents, heavier workflows, or “I’m actually relying on this”
Security: the part people ignore until it bites them
OpenClaw’s own security page is blunt: there is no “perfectly secure” setup. The goal is to be deliberate about who can talk to it, where it can act, and what it can touch.
Threat model in one paragraph
OpenClaw can execute shell commands, read/write files, access network services, and send messages if you give it that access. People who can message your bot can try to trick it, social engineer it, or probe for details.
So you do “access control before intelligence”: identity first (pairing, allowlists), scope next (sandboxing, tool policies), model last (assume models can be manipulated).
Prompt injection is not just “public DMs”
Even if only you can DM it, prompt injection can come from anything it reads: web pages, emails, docs, attachments, pasted logs. The docs explicitly recommend patterns like using a read-only reader agent to summarize untrusted content before passing it to tool-enabled agents.
Download hygiene matters (because opportunists are fast)
During earlier naming transitions, Malwarebytes documented typosquat domains and a cloned GitHub repo impersonating the project and setting up potential supply-chain risk.
If you install agents like you install random Minecraft mods, you are speedrunning regret.
A sane “starter setup” that balances power and not getting wrecked
This is a practical baseline that keeps the magic while reducing blast radius:
- Run OpenClaw on a dedicated VPS or dedicated machine, not the laptop that contains your entire identity.
- Keep the Gateway private (loopback, VPN access, or tunnels like the remote access pointers in the docs), never “open port to the world.”
- Use DM pairing and allowlists, especially for WhatsApp/Telegram style channels.
- Start with sandboxing and minimal tools, widen access only when you trust your configuration and your workflow.
- Run
openclaw security audit --deepwhenever you change anything important.
That setup still lets OpenClaw be OpenClaw. It just makes it harder for one dumb moment to become a full incident report.
FAQ
Does OpenClaw run locally or on a server?
Both. The onboarding flow explicitly supports local vs remote gateway setups.
Which chat platforms can it connect to?
The docs list a wide set of channel integrations, including WhatsApp, Telegram, Discord, Slack, Google Chat, Mattermost, and more.
What’s the biggest mistake people make?
Exposing it publicly and giving it broad tools. The security docs call out network exposure, browser control exposure, and tool blast radius as common failure modes.
Why is everyone talking about it?
Because it combines persistent memory, deep tool access, and an agent loop that executes instead of only advising. That combination makes it feel like a preview of the future.
Want OpenClaw on a VPS that’s actually sized for it?
If your plan is “run it for real, 24/7, without babysitting”, hosting it on a proper VPS is the cleanest route.
With BoostedHost your data is protected by Swiss laws.
