OpenClaw

An agent acts through built in tools for the shell, files, the web and messaging, through skills that teach it repeatable workflows, and through plugins, with 142 official plugins plus community packages on ClawHub.

Any MCP server can be connected over Streamable HTTP, SSE or stdio, with OAuth, headers and tool filters, and its tools pass through the same tool profiles and policy as everything else. Community skills reach Notion, Obsidian, GitHub, Home Assistant, Spotify and 1Password.

In practice that means an agent sends email under the user's account, posts to chat channels, controls smart home devices and commits code under a verified GitHub identity.

Sourcedocs.openclaw.ai/tools/mcpread 2026-10-18

Several isolated agents run in one Gateway, each with its own workspace, credentials, model registry and session history, and bindings route each chat account to the right one. Any agent can spawn subagents in their own sessions that report back when done, with configurable nesting depth for coordinator patterns and a cheaper model for the children.

Swarm fans work out from a Code Mode script using ordinary JavaScript control flow, with structured results, bounded concurrency (32 children at once and 200 per group by default) and live progress. Standing orders give an agent ongoing authority over a defined program, with scope, triggers and escalation rules, so routine multistep work runs without a prompt each time.

Sourcedocs.openclaw.ai/tools/swarmread 2026-10-18

Beyond its own memory files, the search index takes additional directories of team documents or shared notes, scanned recursively and watched for changes, with images and audio indexed alongside Markdown when Gemini multimodal embeddings are used.

Retrieval is hybrid, embeddings plus keyword ranking with a diversity pass, over a SQLite index or an experimental PostgreSQL one, with OpenAI embeddings by default and Gemini, Voyage, Mistral, Bedrock, Ollama or a local llama.cpp model as alternatives.

The memory wiki plugin compiles a separate knowledge vault of pages, structured claims with evidence and provenance, and dashboards, and imports Open Knowledge Format bundles. Sources have to be Markdown or one of the supported media types.

Sourcedocs.openclaw.ai/concepts/memory-searchread 2026-10-18

Commands on a real host run only when tool policy, an allowlist and, where required, a person all agree, with allow once, allow always and deny decisions bound to the exact command, working directory and executable. Approval prompts go to Slack, Discord, Telegram or Matrix as buttons or reactions, or to the companion app, and an unanswered prompt falls back to deny.

Session permission modes run from read only, through guarded mode with a person reviewing escalations, to workspace mode, where an LLM review step can allow, deny or hand the call to a person, up to unrestricted access that only an admin can set. In a cloud desktop a person can take control of the screen at any time, which pauses the agent's input.

Sourcedocs.openclaw.ai/tools/exec-approvalsread 2026-10-18

Gateway access runs through operator scopes, from read and session access to write, admin, pairing and approvals, checked on every request with unclassified methods denied. Named roles add a scope ceiling, an agent allowlist and visibility into other people's sessions, and identity can come from Tailscale, Cloudflare Access or a proxy such as Pomerium using OIDC or SAML.

Unknown chat senders get a pairing code, access groups share sender allowlists across channels, and a policy plugin checks the configuration against an authored policy file with attestation hashes. Trail of Bits audited the code through OpenAI's Patch the Planet program, but there is no SOC 2 or ISO 27001 certification, and one Gateway is one trust domain, not a wall between untrusted tenants.

Sourcedocs.openclaw.ai/gateway/operator-scopesread 2026-10-18

A metadata only audit history records which agent ran, when and how it ended, which tool actions each run took and, with message auditing on, whether inbound messages reached dispatch and outbound ones were delivered, without storing prompts, arguments or output. Operator approvals become decision receipts tied to the run, and optional execution identity binds to scheduled runs.

For the reasoning behind a run, trajectory bundles export the prompt, system prompt, tools, tool calls and transcript timeline as a redacted package. Traces, metrics and logs export over OpenTelemetry to Grafana, Datadog, Honeycomb, New Relic or any OTLP backend, and a Prometheus endpoint exposes Gateway metrics.

Sourcedocs.openclaw.ai/gateway/auditread 2026-10-18

Memory lives as plain Markdown in each agent's workspace, with no state. USER.md holds stable preferences as directives marked active or superseded, MEMORY.md holds durable facts and decisions loaded at the start of every session, and dated daily notes hold running context that a background dreaming sweep distills into long term memory.

Telling the agent to remember something makes it write the note, and active memory recalls relevant entries during a turn. Each automatically ingested memory carries its source session, so the memory forget command can preview and then remove everything derived from chosen sessions or participants and keep them from being ingested again, while the rest of the store stays intact.

Sourcedocs.openclaw.ai/concepts/memory-provenanceread 2026-10-18

Everything runs on infrastructure the customer chooses, and state stays on that machine rather than in a vendor cloud, since there is no hosted tier.

Desktop apps install the Gateway on macOS, Windows or Linux, and the same Gateway runs in Docker, on Kubernetes through Kustomize manifests, or on a VPS, with setup guides for Azure, GCP, Oracle Cloud, Hetzner, Fly.io, DigitalOcean, Railway, Render and Northflank.

Tool execution can move into a sandbox on Docker, Podman, a remote machine over SSH or OpenShell, and local models through Ollama, LM Studio or vLLM keep inference on the same hardware. By default an install sends the Foundation only a daily version check, which can be switched off.

Sourcedocs.openclaw.ai/install/kubernetesread 2026-10-18

ClawHub is the public registry of skills and plugins, versioned with changelogs, download and star counts and a security scan on every release, and one command installs or updates a skill. Every upload runs through ClawScan, which combines VirusTotal, NVIDIA SkillSpector and Tencent AI Infra Guard with an AI judge, and installs of anything marked malicious are blocked.

Bundled skills ship with the install, among them a browser automation skill, and reference templates supply ready personas for a chief of staff, researcher, reviewer and writer. Most registry content comes from the community, and Claw packages, which bundle a complete agent with its skills, MCP servers and scheduled jobs, remain experimental.

Sourcedocs.openclaw.ai/clawhubread 2026-10-18

Work reaches the agent from 29 chat channels, among them WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, Google Chat, Matrix, LINE, WeChat, SMS and phone calls through Twilio, Telnyx or Plivo. The built in scheduler persists one shot and cron jobs, condition watchers and stream sources, and delivers output to a channel, a webhook or nowhere.

Inbound webhooks let an outside service wake an agent or submit a turn with a dedicated token, Gmail inbox events arrive through Google Pub/Sub, an IMAP plugin starts an isolated reader session for each allowed message, and a heartbeat runs periodic turns so the agent can raise anything that needs attention.

Sourcedocs.openclaw.ai/automation/cron-jobsread 2026-10-18

The customer picks the models, from 64 model and media providers, among them Anthropic, OpenAI, Google Gemini and Vertex, Amazon Bedrock, Microsoft Foundry, Mistral, DeepSeek, xAI, Groq, OpenRouter, LiteLLM and Vercel AI Gateway, plus local runtimes such as Ollama, LM Studio, vLLM and SGLang. Supported subscriptions such as ChatGPT can stand in for an API key.

Each agent and its subagents can run a different model, and a configured fallback chain moves to the next model after rotating through auth profiles when a provider fails. No lab's model is privileged in the code, though OpenAI embeddings are the default for memory search.

Sourcedocs.openclaw.ai/concepts/model-providersread 2026-10-18

The Gateway WebSocket protocol is the full control plane API, covering status, channels, models, chat, agents, sessions, nodes and approvals, with typed schemas and role and scope checks at handshake.

Over HTTP the Gateway can serve an OpenAI compatible chat completions, models, embeddings and responses surface that runs a normal agent turn, and a tools invoke endpoint calls a single tool under the same auth and policy.

Running openclaw mcp serve exposes routed channel conversations to Codex, Claude Code or any MCP client, an ACP mode hosts coding runtimes, and a plugin SDK adds channels, providers, tools and hooks. The HTTP surfaces carry operator level access and are meant for private networks.

Sourcedocs.openclaw.ai/gateway/protocolread 2026-10-18

A QA stack runs scenarios written in YAML against a real Gateway and a synthetic chat channel and records pass or fail evidence for each run, with a personal agent benchmark pack of ten scenarios covering reminders, memory recall, secret redaction, approval denials and proof backed progress reports.

A character evaluation runs one persona across several models and has judge models rank the transcripts blind. That machinery tests OpenClaw itself before release and needs a source checkout with the private QA commands switched on. The installed product has no suite for scoring a team's own agent configuration after a change to its skills, prompts or model.

Sourcedocs.openclaw.ai/concepts/qa-e2e-automationread 2026-10-18

The agent drives a dedicated Chrome, Brave, Edge or Chromium profile kept apart from the user's own browser, opening tabs, clicking, typing, dragging, taking snapshots and screenshots and saving downloads, or attaches to the user's signed in Chrome when asked. Remote and hosted browsers connect over CDP, including Browserbase, Browserless and Notte.

A separate computer tool lets a vision capable model see and control the Gateway's own desktop or a paired node's, through Peekaboo or the CUA driver on macOS and an experimental CUA plugin on Windows and Linux, and cloud desktops leased through Crabbox show the same screen in the chat sidebar. Browser navigation sits behind an SSRF policy with allow and block lists.

Sourcedocs.openclaw.ai/tools/browserread 2026-10-18