OpenClaw (formerly known as Clawdbot) is a personal AI assistant you run on your own server. It answers on the channels you already use (WhatsApp, Telegram, Slack, Discord, Signal, iMessage and more than 20 platforms) connecting through a local Gateway that you control.
The project was created by Peter Steinberger, an Austrian developer and the founder of PSPDFKit. It is open source under the MIT license, has more than 384,000 stars on GitHub, and is a genuine alternative to depending on cloud assistants where your data lives on someone else’s servers.
A note on the name: the project was renamed twice in three days. It launched as Clawdbot in November 2025; on 27 January 2026 it became Moltbot, after Anthropic asked for a change over the resemblance to Claude; and on 30 January it settled on its final name, OpenClaw. The old domains and repositories still redirect, but you should be using the current ones. The copyright now belongs to the OpenClaw Foundation rather than to the author personally.
Why OpenClaw?
- Proactive: it acts without needing constant commands
- Self-hosted: your data, your server, your control
- Cross-platform: 23+ messaging channels (WhatsApp, Telegram, Discord, Slack, Signal, iMessage, Google Chat, Microsoft Teams, Matrix, IRC, LINE, and more)
- Voice: voice interaction on macOS, iOS and Android
- Extensible: a Skills (plugin) system for email, calendar, commands, files and APIs
- Open source: MIT license, code audited by the community
Security Warning
The numbers turned out to be far worse than they first looked. A passive scan in January 2026 found 42,665 exposed instances, of which 5,194 were confirmed vulnerable and 93.4% allowed authentication to be bypassed. SecurityScorecard widened the sweep and documented more than 135,000 instances across 82 countries. What was leaking:
- API keys and access tokens
- OAuth secrets
- Complete conversation histories
- The ability to run commands on the server
In one documented case, an attacker managed to redirect a victim’s email in under 5 minutes from a vulnerable instance. Do not expose the Gateway to the public internet. Read the hardening section at the end of this post.
Requirements
| Component | Requirement |
|---|---|
| Operating system | Linux (Ubuntu/Debian) or WSL2 on Windows |
| Node.js | 22.22.3+, 24.15+ or 25.9+ (the installer handles it) |
| RAM | Minimal (the Gateway uses very little) |
| Storage | ~500 MB |
| API key | Anthropic (Claude), OpenAI, or any LLM provider |
| Messaging | An account on whichever platform you want to connect |
Step-by-step installation
Step 1: Update the system
sudo apt update && sudo apt upgrade -yStep 2 (optional): Node.js
The official installer detects and provisions Node on its own, so you can skip this step entirely. You only need to do it by hand if you would rather manage the version yourself, or if you are going to build from source.
The supported versions today are Node 22.22.3+, 24.15+ or 25.9+, and the recommended default is Node 26. Watch out for the detail here: any 24.x will not do, you need 24.15 or later.
curl -fsSL https://deb.nodesource.com/setup_26.x | sudo -E bash -
sudo apt install -y nodejs
node --versionOnly if you are building from source, you also need pnpm:
npm install -g pnpmStep 3: Install OpenClaw
Option A: Quick install (recommended)
curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/instalador-proxmox-resumen.sh | bash
exec bashOption B: Manual install (from source)
git clone https://github.com/openclaw/openclaw.git openclaw
cd openclaw
pnpm install
pnpm ui:build
pnpm buildStep 3b: Check that the install is healthy
Before you configure anything, verify. openclaw doctor inspects the whole installation (Node version, permissions, Gateway configuration, credentials) and tells you what is missing. It is the command that saves you from most of the «it won’t start» cases.
openclaw --version
openclaw doctor
openclaw gateway statusStep 4: Initial setup
The first time you run it, OpenClaw launches an interactive wizard that walks you through the configuration. You can pick QuickStart mode (fast, sensible defaults) or Advanced (full control).
Step 5: Set up your API key
During onboarding, OpenClaw asks for the API key of your LLM provider. You can use:
- Anthropic (Claude): the project’s default option
- OpenAI (GPT-4): a supported alternative
- Other providers: any OpenAI-compatible API
Step 6: Connect a messaging channel (example: Telegram)
- Search for @BotFather on Telegram
- Run
/newbot - Follow the instructions to name your bot
- Copy the token BotFather gives you
- Paste it into the OpenClaw installer
Important: the BotFather token is a secret. Don’t share it or commit it to a repository.
Alternative: install it with Docker
If you already run Docker on the server (as in the rest of the tutorials on this blog) there is an official method, and it is probably the one you want: it isolates the assistant from the host system, which is no small detail for an agent that can run commands.
git clone https://github.com/openclaw/openclaw.git
cd openclaw
export OPENCLAW_IMAGE="ghcr.io/openclaw/openclaw:latest"
./scripts/docker/setup.shThe script handles onboarding, generates the token and brings the container up. Useful details for fitting it behind your reverse proxy: the port is 18789 (the Gateway’s control interface and HTTP), and the volumes you need to persist are /home/node/.openclaw (configuration and data) and /home/node/.config/openclaw (auth profile secrets).
Two warnings. First: building the image needs at least 2 GB of RAM; with 1 GB, pnpm install is killed for lack of memory and all you see is an exit 137. Second, and more interesting for what comes next: there is an OPENCLAW_SANDBOX=1 variable that turns on agent isolation. If you are going to give it Skills with system access, switch it on.
Skills: what the assistant can do
Skills are extensions that broaden what OpenClaw is able to do:
- Send and read email
- Manage your calendar
- Run commands on the server
- Work with files and APIs
- Automations with cron
- Browser control
Security recommendation: on your first install, choose «Skip for now» for Skills and Hooks. Get familiar with the system before you hand out advanced permissions.
First run
OpenClaw gives you three ways to start:
- TUI (recommended for Linux servers): a terminal interface, exposes no ports
- Web UI: a graphical interface in your browser
- Defer: configure it later
For headless Linux servers, TUI is the best option because it doesn’t need to expose a web interface.
Pairing
The first time someone interacts with your bot, you’ll see an «access not configured» message. The default behaviour is dmPolicy="pairing": anyone who is not approved gets a code back and the bot ignores them until you authorize it. The codes expire after an hour.
- Telegram shows you a user ID and a temporary code
- On the server, run:
openclaw pairing approve telegram <code> - Once approved, the bot replies normally
You can see who is waiting for approval with openclaw pairing list <channel>.
And here comes the most important nuance in this whole article: pairing is not the mechanism that protects your installation. The official documentation says so bluntly: pairing is a routing selector, not an authorization boundary. It decides who the bot talks to, not who can connect to the Gateway. Real access control lives in gateway.auth, which is exactly what comes next.
Security hardening
This part is not optional. Not after the documented incidents with exposed instances:
1. Put a token on the Gateway
This is the measure that actually matters, and the one missing from most of those 42,665 exposed instances: 93.4% allowed authentication to be bypassed. The Gateway supports a shared token that is required before any WebSocket connection is accepted.
openclaw doctor --generate-gateway-tokenThat leaves the configuration looking like this:
{ gateway: { auth: { mode: "token", token: "a-long-random-token" } } }To rotate it: generate a new one, restart the Gateway, update your remote clients and confirm the old credentials no longer work. That last step is the one almost nobody does.
2. Never expose the Gateway to the internet
The Gateway should listen on 127.0.0.1 (localhost) and nothing else. If you need remote access, put it behind a reverse proxy with authentication.
3. If you need remote access
- Tailscale Serve: this is what the official documentation recommends, because it keeps the Gateway on loopback and lets Tailscale handle access. The cleanest option if you are the only user.
- Cloudflare Tunnel, but with Cloudflare Access in front of it. Without Access you are not protecting anything: the single most documented misconfiguration in these incidents is precisely a reverse proxy that makes remote connections look local.
- If you use any reverse proxy, set
gateway.trustedProxiesto its IP and make sure the proxy overwrites theX-Forwarded-Forheader instead of appending to it. If it only appends, an attacker can spoof their origin.
4. Limit the agent’s permissions
- Choose which Skills are enabled
- Don’t grant full access without understanding what each permission does
- Review the Hooks before you turn them on
What does it cost?
OpenClaw itself is 100% free (MIT license). The real cost comes from the language model you use:
| Model | Input | Output |
|---|---|---|
| Claude Sonnet | ~$3/million tokens | ~$15/million tokens |
| Claude Opus | Higher cost | Higher cost |
| GPT-4 | Varies | Varies |
Monthly estimate: between $5 and $20 USD with moderate use.
Alternative: OAuth. OpenClaw supports OAuth authentication with Anthropic, OpenAI and Gemini. If you already pay for ChatGPT Plus, Claude Pro or Gemini Pro, you can use that instead of paying per token. Costs become more predictable, though some advanced features may still require direct API access.
Conclusion
OpenClaw is probably the most mature self-hosted personal AI assistant project out there today: more than 384,000 GitHub stars, 23+ messaging platforms, an extensible Skills system, and an active community. But security is non-negotiable: never expose the Gateway directly to the internet, keep permissions tight, and keep the system updated.