Preface¶
At the start of 2026, the star count of an open-source project on GitHub rose at a visible pace. It is not another ChatGPT wrapper or a simple CLI tool, but a personal AI assistant that can run 24/7 on your own machine — OpenClaw (🦞, community nickname Molty).
Initiated by Peter Steinberger, founder of PSPDFKit, the project went through names like Clawdbot and Moltbot before finally being named OpenClaw, and is maintained under the MIT license by the OpenClaw Foundation. As of August 2026, its main GitHub repository has surpassed 380,000 stars, and many developers call it “the open-source solution closest to JARVIS”.
Unlike cloud SaaS assistants, OpenClaw’s core philosophy is local-first: you run a Node.js Gateway on your Mac, Linux, or Windows (WSL2) machine, connect chat apps like WhatsApp, Telegram, Slack, Discord, Signal, and iMessage to the AI Agent, allowing it to read files, run Shell commands, control browsers, and store long-term memories — and you can trigger all of this by sending a message from your phone.
This article is cross-verified based on the OpenClaw official repository, official documentation, and DigitalOcean technical interpretation, sorting out its architecture, Skill ecosystem, Ollama local deployment path, and the most discussed Agent security issues currently.
What is OpenClaw?¶
OpenClaw is essentially a self-hosted Gateway that acts as the control plane between chat channels and AI Agents. The official documentation defines it as:
Run a single Gateway process on your own machine (or server) to serve as a bridge between messaging apps and your always-on personal AI assistant.
It targets developers and power users who want a personal AI assistant that can be triggered from any channel, with all data stored on their own hardware, without relying on hosted services.
Key features:
1. Local-first: The Gateway, sessions, memories, and configuration files all reside on your device; the default configuration path is ~/.openclaw/openclaw.json.
2. Multi-channel inbox: One Gateway serves multiple Channel plugins simultaneously. It natively supports WhatsApp, Telegram, Slack, Discord, Google Chat, Signal, iMessage (BlueBubbles), Matrix, Microsoft Teams, Feishu, LINE, WebChat, and more; channels like Twitch, Nostr, and Zalo can be extended via plugins.
3. Agent-native: Built-in capabilities including tool calling, session isolation, multi-Agent routing, persistent memory (stored as local Markdown files), Cron scheduled tasks, and Webhooks.
4. Model-agnostic: Supports over 25 cloud vendor APIs including Claude, GPT, Gemini, and DeepSeek, and also supports local models via Ollama, LM Studio, etc.; it comes with an API key and pays-as-you-go.
DigitalOcean’s article noted that OpenClaw surpassed 60,000 GitHub stars within 72 hours of its launch, with the developer community describing it as a “proactive personal agent” that can perform real tasks locally, rather than just a chat-only Bot.
Core Architecture: Node.js Gateway¶
The technical core of OpenClaw is a long-running Node.js / TypeScript Gateway process that listens on port 18789 by default, reusing the same port for WebSocket control, HTTP API, Control UI, and plugin routing.
The official architecture diagram is as follows:
Chat Apps + Channel Plugins → Gateway → OpenClaw Agent
↓
CLI / Web Control UI / macOS Menu Bar / Mobile Node
The Gateway is responsible for:
- Channel connections: Maintaining WebSocket/HTTP long connections for channels like WhatsApp and Telegram;
- Session routing: Isolating sessions by sender, group, and Agent workspace;
- Tool execution: Shell commands, file read/write, browser automation, Canvas rendering, etc.;
- Memory management: Reading and writing local Markdown workspace files.
The recommended runtime version is Node 26 (Node 22.22.3+, 24.15+, 25.9+ are also supported). After installation, you can use launchd (macOS) or systemd (Linux) user services to keep the Gateway running permanently, enabling a true 24/7 assistant.
The default address of the local Control UI is: http://127.0.0.1:18789/. For remote access, the official recommends prioritizing Tailscale or SSH tunnels, and emphasizes that the tunnel itself cannot bypass Gateway authentication — clients still need to carry a token or password.
Multi-channel Messaging: Remotely Control Your Agent from Your Phone¶
OpenClaw’s “viral” capability largely comes from embedding the Agent into the chat apps you already use.
Take WhatsApp as an example: after configuring the channels.whatsapp.allowFrom whitelist, only specified phone numbers can send private messages to the Agent; for group chats, you can set requireMention: true to prevent the Agent from interrupting conversations:
{
channels: {
whatsapp: {
allowFrom: ["+15555550123"],
groups: { "*": { requireMention: true } },
},
},
messages: { groupChat: { mentionPatterns: ["@openclaw"] } },
}
Telegram is marked in the official documentation as the “fastest to get started” channel. Slack and Discord are suitable for team collaboration scenarios — the same Gateway can mount multiple Channels at the same time, and inbound messages are distributed to different Agent workspaces via routing rules.
Actual use cases listed by DigitalOcean include: managing Notion/Obsidian todos in WhatsApp, having the Agent run Cron debug tasks while you sleep, automatically filling out forms and grabbing data via browser plugins, and integrating with Home Assistant to control smart home devices. The core logic is consistent: natural language entry + local tool execution.
Skill Ecosystem: Markdown-driven Capability Expansion¶
OpenClaw’s capability expansion does not rely on modifying source code, but uses the Skill mechanism — similar to the idea of Claude Skills.
Skills describe their capabilities, trigger conditions, and behavior guidelines in Markdown files like SKILL.md; the Agent reads these descriptions and combines underlying Tools (file reading, Shell execution, Web Fetch, etc.) to complete tasks. The community already has over 100 pre-configured AgentSkills that can be searched and installed via the CLI; you can also have the Agent automatically generate new Skills and share them back to the community.
The official documentation divides the expansion system into three layers:
| Layer | Description |
|------|------|
| Tool | Typed low-level primitives: read files, execute commands, browser operations |
| Skill | Task capability packages defined in Markdown, describing when and how to call Tools |
| Plugin | Channel plugins, Provider plugins, etc., extending the Gateway itself |
The onboarding wizard (openclaw onboard) will guide you to select and install Skills during the first installation, lowering the barrier to entry. For developers, this is much lighter than modifying prompts or writing new microservices every time — describe capabilities with documentation, and the Agent orchestrates execution on its own.
Local Models: Ollama Integration¶
“Data never leaves the local machine” is one of the important selling points of OpenClaw. In addition to cloud APIs, the official first-class support includes Ollama and OpenAI-compatible endpoints such as LM Studio, vLLM, and MLX.
Select Local only or Cloud + Local in openclaw onboard, and the wizard will detect the local Ollama address, list installed models, and prompt to pull models if they are missing. Ollama on loopback or the local area network does not require a real API key, and you can use the ollama-local placeholder in the configuration to pass authentication checks.
Typical local configuration steps:
# Ensure Ollama is running and pull the model
ollama pull llama3.1:8b
# Install OpenClaw and run the onboarding process
npm install -g openclaw@latest
openclaw onboard --install-daemon
# Select Local only in the wizard, the default baseUrl is http://127.0.0.1:11434
The official documentation specifically reminds: Local small models lack the security filtering provided by cloud vendors, and are more vulnerable to Prompt Injection. If using Ollama, prioritize models with a context window ≥16K, enable Compaction, narrow down the Tool whitelist, and consider enabling sandbox (see the next section). LM Studio is recommended as the “lowest-friction” local onboarding path.
Memory retrieval can also be fully localized: set memory.search.provider: "local" to use GGUF/llama.cpp embeddings, without uploading vectors to the cloud.
Quick Deployment: Get the Gateway Running in 5 Minutes¶
The official recommended installation path applies to macOS / Linux / Windows WSL2:
npm install -g openclaw@latest
openclaw onboard --install-daemon
openclaw dashboard
onboard --install-daemon will install the systemd/launchd user service to ensure the Gateway automatically restarts after a crash. You can also use the official one-click script:
curl -fsSL https://openclaw.ai/install.sh | bash
If you prefer containerized deployment, the official provides Docker images and Compose examples; platforms like DigitalOcean also offer security-hardened 1-Click images for users who do not want to run it natively on their machines.
The minimum hardware requirements are relatively modest: community experience suggests around 2GB RAM, 1 CPU core, and 5GB disk space (higher configuration is required for running large local models). Docker Compose is currently one of the more common production deployment methods.
Agent Security: Greater Power, Greater Risk¶
OpenClaw can execute Shell commands, read and write files, and control browsers — which means once the model is induced by Prompt Injection or malicious messages, the attack surface directly lands on your host machine. This is the most discussed topic around the project in 2026.
The core positions of the official security documentation are:
1. Sandbox is disabled by default. Set agents.defaults.sandbox to docker or podman to enable containerized Tool execution; the Gateway process always runs on the host machine. The documentation clearly states: “This is not a perfect security boundary, but it can significantly limit file system and process access when the model makes a mistake.”
2. Elevated mode is an explicit escape hatch. tools.elevated allows executing exec outside the sandbox, and you must tighten the allowFrom whitelist, never opening it to strangers.
3. Channel whitelists are the first line of defense. Be sure to configure allowFrom and group @ mention rules to avoid arbitrary users on the public Internet sending instructions to your Agent.
4. Local models require stricter Tool Policies. Reduce readable directories, disable high-risk Tools, and restrict browser access to specific domain names.
5. Gateway authentication is enabled by default. When exposing the service beyond loopback, be sure to configure gateway.auth.token or password; use the trusted-proxy mode in reverse proxy scenarios.
The security community and multiple third-party reviews point out: OpenClaw has taken “being able to perform actions” to the forefront of the open-source field, but the permission model still requires users to have DevOps security awareness — deploying it as “giving LLM root privileges” carries extremely high risks; deploying it as “a chat Bot with Tools” will waste its core value. The折中方案 is: sandbox + whitelist + robust model + regular openclaw doctor audits.
Summary: Why Developers Should Pay Attention¶
The popularity of OpenClaw is not accidental. It fills a long-existing gap: most Agent frameworks stay at “being able to reason”, and few default to “being able to take action, run permanently, and be triggered from a phone”. OpenClaw uses a single Node.js Gateway to connect channel routing, sessions, Tools, Skills, and memory into a closed loop, with MIT open-source, model-agnostic, and scalable Skills — for developers who want to build their own JARVIS, there are almost no alternatives with the same level of completeness currently.
But be sure to recognize the boundaries clearly:
- It is a personal assistant/runtime, not an enterprise-grade zero-trust Agent platform;
- Security capabilities largely depend on correct configuration, rather than “secure out of the box”;
- The quality of cloud APIs is still significantly better than small-parameter local models, and local deployment is suitable for privacy-sensitive or 7×24 lightweight tasks.
If you are already familiar with the terminal, willing to maintain a machine that runs 24/7, and understand the meaning of Shell permissions, OpenClaw is worth spending an afternoon going through the onboard process, and experiencing it by sending your first message via Telegram or WhatsApp. If your team requires compliance audits, fine-grained RBAC, and vendor SLAs, you should treat it as experimental infrastructure rather than putting it directly into production.
References
- OpenClaw GitHub: https://github.com/openclaw/openclaw
- OpenClaw Official Documentation: https://docs.openclaw.ai/
- DigitalOcean: What is OpenClaw? Your Open-Source AI Assistant for 2026