OpenClaw Reference¶

Look-up facts for OpenClaw: versions and release channels, requirements, paths and ports, configuration keys, CLI command map, channels, memory and workspace files, skills, MCP surfaces, the CVE record, and a hardening checklist. For tasks see How-to Guides; for the why see Explanation.

Verification basis

Facts on this page were checked on 2026-09-25 against the openclaw/openclaw repository (README, SECURITY.md, VISION.md, docs/), the npm registry, and the CVE Program's cvelistV5 records. OpenClaw ships several releases a month; re-check anything version-specific before relying on it.

Versions and Release Channels¶

OpenClaw uses calendar versioning, YYYY.M.PATCH (for example 2026.9.6), with prerelease suffixes such as -beta.N. Four update channels exist (Release channels):

Channel	npm dist-tag	Current version (publish date)	Notes
`stable`	`latest`	`2026.9.6` (2026-09-23)	Recommended default. Builds usually ship to `beta` first, then get promoted without a version bump
`extended-stable`	`extended-stable`	`2026.7.35` (2026-09-21)	Trailing supported-month line; package installs only; never auto-applies
`beta`	`beta`	`2026.9.6` (2026-09-23)	Newest of `beta` and `latest`; an older beta never replaces a newer stable
`dev`	none (git `main`)	moving	Git checkout of `main`; not for production gateways

Source: registry.npmjs.org/openclaw dist-tags, read 2026-09-25.

Recent Stable Releases¶

Version	npm publish date	Highlights (from the changelog)
2026.9.6	2026-09-23	Clearer managed-update outcomes, recovery of unfinished work after restarts, 30-day Usage reporting, remote workspaces gain Files/Memory/Skills, optional Decision Models (TypeSafe Jev plugin)
2026.9.5	2026-09-19	Patch release
2026.9.4	2026-09-11	Patch release
2026.9.3	2026-09-08	Fenced transactional updaters begin with this release
2026.9.2	2026-09-05	Shared-state schema bump; see updating across a schema bump
2026.9.1	2026-09-03	Mermaid rendering in chat, one-prompt quick start, personal skill libraries, update rollback on failed post-update Doctor
2026.8.1	2026-08-31	Conversation search, sessions on paired devices and cloud workers, masked credential requests, widgets/dashboards
2026.7.1	2026-07-13	Control UI and onboarding overhaul, mobile app updates, stronger Codex workflows
2026.1.30	2026-01-31	First releases after the rename to OpenClaw
2026.1.29	2026-01-30	Fixes CVE-2026-25253, CVE-2026-24763, CVE-2026-25157

Mis-versioned prerelease

The package published as 2026.9.1-beta.1 is actually 2026.8.1-beta.4 and is not newer than stable 2026.8.1 (release correction in the 2026.8.1 changelog).

Cadence: the split changelog lists 123 release entries (6 of them betas) from 2026.1.5 to 2026.9.6, often several per week; npm also carries maintenance lines such as 2026.6.3x and 2026.7.3x (the current extended-stable is 2026.7.35). The npm package openclaw was created 2026-01-29; earlier builds were published as clawdbot (last 2026.1.24-3).

System Requirements¶

Requirement	Value	Source
Node.js	`>=24.16.0 <25` or `>=26.1.0` (Node 26 recommended)	npm `engines` for 2026.9.6; Install
Operating systems	macOS, Linux, Windows (native PowerShell installer, Windows Hub app, or WSL2)	README
FreeBSD	Package installs only; source installs rejected; not Tier 1	2026.9.6 changelog
npm flag	`--allow-scripts=openclaw` on npm 12 or 11.16+; omit on npm 11.15 and earlier	README
Docker (optional)	Docker Engine or Desktop + Compose v2; at least 6 GB RAM for a local source image build	Docker
Service manager	launchd LaunchAgent (macOS), systemd user service (Linux/WSL2)	Install
Language / repo	TypeScript, pnpm workspace (plain `npm install` at repo root unsupported)	README

Host sizing

The official docs publish no minimum RAM/CPU for a package install. Earlier versions of this page listed 512 MB / 1 core minimum and 2 GB / 2 cores recommended; treat those as unverified community guidance. Local model inference and the browser tool (Chromium) dominate resource use.

Paths, Ports, and Files¶

Item	Default	Notes
Gateway port	`18789` (WebSocket + HTTP on one port)	`--dev` profile uses `19001`
Gateway bind	`loopback`	Container images default to an exposed bind; pair with auth
Control UI	`http://127.0.0.1:18789/`	Opened by `openclaw dashboard`
Health endpoints	`/healthz` (liveness), `/readyz` (channel-aware readiness)	Documented for the Docker deployment
Hosted widget paths	`/__openclaw__/canvas/`, `/__openclaw__/a2ui/`	Served on the Gateway port
Config file	`~/.openclaw/openclaw.json` (JSON5)	Strict schema validation; Gateway refuses to start on unknown keys
State directory	`~/.openclaw`	Override with `OPENCLAW_STATE_DIR`; `--profile <name>` uses `~/.openclaw-<name>`
Agent workspace	`~/.openclaw/workspace`	`agents.defaults.workspace`
Shared database	`~/.openclaw/state/openclaw.sqlite`	Workspace setup state and attestation
Per-agent sessions	`~/.openclaw/agents/<agentId>/agent/openclaw-agent.sqlite`	Session rows and transcripts
Managed skills	`~/.openclaw/skills`	Target of `openclaw skills install --global`
Docker state mount	`/home/node/.openclaw`	Container path for state/config
Container images	`ghcr.io/openclaw/openclaw` (primary), `openclaw/openclaw` (Docker Hub mirror)	Tags: versions, `latest`, `latest-browser`
mDNS service	`_openclaw-gw._tcp`	Only when the bundled `bonjour` plugin is enabled

Environment Variables¶

Variable	Purpose
`OPENCLAW_HOME`	Base for derived paths such as the dev git checkout (`$OPENCLAW_HOME/openclaw`)
`OPENCLAW_STATE_DIR`	State directory override (default `~/.openclaw`)
`OPENCLAW_CONFIG_PATH`	Config file override
`OPENCLAW_GATEWAY_TOKEN`	Gateway shared-secret token (Docker `.env`, SecretRef env source)
`OPENCLAW_IMAGE`	Image used by `scripts/docker/setup.sh`
`OPENCLAW_GATEWAY_PORT`	Host port for the Docker Compose Gateway
`OPENCLAW_GIT_DIR`	Location of the `dev` channel git checkout
`OPENCLAW_PROXY_URL`	Operator-managed HTTP/WebSocket egress proxy
`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, ...	Provider credentials; prefer SecretRefs over plain env vars
`TELEGRAM_BOT_TOKEN` and other channel tokens	Read by `openclaw channels add --use-env` without copying into `openclaw.json`

Configuration Keys¶

Selected keys with security or operational weight. The full schema is printed by openclaw config schema; field docs are in the Configuration reference.

Key	Default	Meaning
`gateway.bind`	`"loopback"`	`lan`, `tailnet`, `custom` widen exposure
`gateway.auth.mode`	token (generated at onboarding)	`token`, `password`, `trusted-proxy`, `none` (private ingress only)
`gateway.auth.allowTailscale`	off	Accept Tailscale Serve identity headers
`gateway.trustedProxies`	unset	Reverse-proxy source allowlist
`gateway.controlUi.allowedOrigins`	derived from `gateway.publicOrigin`	Required for non-loopback Control UI
`gateway.remote.tlsFingerprint`	unset	Pin remote `wss://` certificate
`gateway.roles`	unset	Operator role ceilings (present in August 2026 source; check your version)
`agents.defaults.sandbox.mode`	`"off"`	`non-main` or `all` to sandbox tool execution
`agents.defaults.sandbox.scope`	-	e.g. `session`
`agents.defaults.sandbox.workspaceAccess`	-	`none`, `ro`, `rw`
`tools.exec.host`	`"auto"`	Sandbox when a sandbox runtime is active, otherwise Gateway host
`tools.profile`	-	e.g. `"messaging"` for a restricted tool set
`tools.alsoAllow`	-	Add tools (such as `lobster`) on top of the profile
`tools.elevated`	-	Escape hatch that runs `exec` outside the sandbox
`tools.codeMode.executor`	`node`	`quickjs` for the hardened WASM executor; `node:vm` is not a security boundary
`channels.<id>.dmPolicy` / `allowFrom`	pairing	Who can trigger the agent in DMs
`update.channel`	`stable`	Persisted by `openclaw update --channel`
`update.checkOnStart`	`true`	`false` disables the daily version check and opt-in statistics
`skills.entries.<name>.enabled`	per skill	`coding-agent` bundled skill is opt-in
`skills.install.allowUploadedArchives`	`false`	Allow zip-archive skill uploads over the Gateway API
`mcp.servers.<name>`	-	Saved outbound MCP server definitions

CLI Command Map¶

Top-level command groups from the CLI reference (2026.9.x). Run openclaw <command> --help for the authoritative list.

Area	Commands
Setup	`setup`, `onboard`, `configure`, `config get/set/patch/unset/schema/validate`, `doctor`, `dashboard`
Backup and update	`backup create/verify/restore`, `migrate`, `reset`, `uninstall`, `update` (`--channel`, `--tag`, `--dry-run`, `status`, `repair`)
Gateway	`gateway status/probe/start/stop/restart/run/install/usage-cost/health`, `logs`, `health`, `status`
Channels and pairing	`channels list/status/add/remove/login/logout/logs`, `pairing list/approve`, `devices`, `qr`
Agents and sessions	`agent`, `agents list/add/bind/unbind`, `sessions`, `resume`, `tasks`, `acp`, `mcp`
Models	`models list/set/status/fallbacks/auth`, `infer`
Memory	`memory status/index/search`, `wiki`
Skills and plugins	`skills search/install/update/verify/list/info/check`, `plugins list/install/enable/disable/update`
Security	`security audit`, `secrets audit/configure/apply`, `approvals`, `exec-policy`, `sandbox list/explain/recreate`
Automation	`cron` (alias `automations`), `hooks`, `webhooks gmail`
Nodes and browser	`nodes`, `node`, `browser`
Global flags	`--dev`, `--profile <name>`, `--container <name>`, `--log-level`, `--no-color`, `-V/--version`

Commands that do not exist

Earlier versions of these notes listed openclaw start, openclaw stop, openclaw chat --channel, openclaw lobster run, openclaw memory show/reindex, openclaw channel test, openclaw usage and openclaw update --version. None appear in the 2026.9 CLI reference. Use openclaw gateway start/stop, openclaw tui (aliases chat, terminal), the Lobster plugin tool, openclaw memory index, openclaw channels status --probe, openclaw gateway usage-cost, and openclaw update --tag <version>.

Channels¶

The official channel catalog (generated from docs/channels/index.md, 2026-09-25) lists 32 entries. "Bundled"/"core" ship with the install; "official plugin" installs with openclaw plugins install @openclaw/<id>; "external" plugins live outside the repo.

Distribution	Channels
Included in core / bundled	WebChat, Telegram, A2A (A2A 1.0 JSON-RPC), Reef (encrypted agent-to-agent)
Official plugins	WhatsApp (Baileys), Discord, Slack, Signal (signal-cli), iMessage (imsg), Microsoft Teams, Google Chat, Matrix, Mattermost, IRC, LINE, Feishu, Nextcloud Talk, Nostr, QQ bot, SMS (Twilio), Synology Chat, Tlon, Twitch, Zalo, Zalo personal, Buzz, ClickClack, Raft
External plugins	WeChat (`openclaw-weixin`), WeCom, Yuanbao, Zalo ClawBot
Related	Voice Call plugin (Plivo, Telnyx, Twilio)

Native apps: macOS menu bar app, iOS, Android, Windows Hub, plus Linux; nodes add camera, screen, location, and Canvas capabilities.

Memory and Workspace Files¶

File	Role	Loaded
`AGENTS.md`	Operating instructions	Injected at session start
`SOUL.md`	Persona, boundaries, tone	Injected at session start
`IDENTITY.md`	Agent name, vibe, emoji	Injected at session start
`USER.md`	User profile and stable preferences	Injected (separate small budget)
`BOOTSTRAP.md`	One-time first-run ritual, deleted after completion	New workspaces only
`MEMORY.md`	Curated long-term facts and decisions	Injected at session start; truncated past the bootstrap budget
`memory/YYYY-MM-DD.md`	Daily notes	Today and yesterday on bare `/new` or `/reset`; indexed for `memory_search`
`DREAMS.md`	Dream Diary / dreaming sweep summaries	For human review
`memory/imports/<source>/`	Imported Codex, Claude Code, Hermes memory	Indexed, not merged into `MEMORY.md`

Memory tools: memory_search (semantic), memory_get, intent, provided by the active memory plugin (default memory-core; one memory plugin active at a time).

Skills¶

Fact	Value
Format	Directory with `SKILL.md` (YAML frontmatter + Markdown), AgentSkills spec
Bundled skills	Shipped from the repo's `skills/` directory (earlier notes: 53, as of 2026-04, unverified); new skills go to ClawHub, not core
Registry	ClawHub (repo `openclaw/clawhub`)
Scanning	ClawHub pages show VirusTotal, ClawScan, and static-analysis state; `openclaw skills verify @owner/<slug>` checks the `clawhub.skill.verify.v1` trust envelope

Skill load precedence (highest first): workspace skills/, <workspace>/.agents/skills, ~/.agents/skills, <state-dir>/skills (managed), workshop skills, bundled and Custodian skills, then skills.load.extraDirs and plugin skills.

MCP and Protocol Surfaces¶

Surface	Role	Entry point
MCP server	Expose Gateway channel conversations to MCP clients over stdio	`openclaw mcp serve`
MCP client registry	Save third-party MCP servers (stdio, SSE, Streamable HTTP, OAuth) for agent runs	`openclaw mcp add/set/list/probe`, `mcp.servers`
ACP	Editors connect; OpenClaw hosts external harnesses (Claude Code, Gemini CLI, OpenCode, Cursor)	`openclaw acp`
A2A 1.0	Agent Card discovery and JSON-RPC tasks	A2A channel
OpenAI-compatible HTTP	`/v1/chat/completions`, `/v1/responses`, `/v1/models`, `/v1/embeddings`	Disabled by default; shared-secret auth equals full operator access
Observability	OpenTelemetry and Prometheus export	Gateway config

Agent runtimes: built-in openclaw embedded runtime, codex (Codex app-server harness plugin), copilot (external plugin), claude-cli CLI backend, and ACP-hosted harnesses.

CVE Record¶

Selected CVEs verified against CVE Program records (cvelistV5). OpenClaw publishes advisories as GitHub Security Advisories; the project's own count on 2026-08-27 was 647 repository advisories (Why OpenClaw), a disclosure count rather than a count of exploitable defects.

CVE	Published	CVSS 3.1	Fixed in	Summary
CVE-2026-25253	2026-02-01	8.8 High	2026.1.29	Control UI took `gatewayUrl` from a query string and auto-connected, sending the gateway token (one-click token exfiltration leading to RCE). GHSA-g8p2-7wf7-98mq
CVE-2026-24763	2026-02-02	8.8 High	2026.1.29	Command injection in Docker sandbox execution via unsafe `PATH` handling
CVE-2026-25157	2026-02-04	7.8 High	2026.1.29	OS command injection via project root path in `sshNodeCommand`
CVE-2026-32922	2026-03-29	9.9 Critical (CVSS 4.0: 9.4)	2026.3.11	`device.token.rotate` let `operator.pairing` callers mint `operator.admin` tokens, enabling RCE on nodes via `system.run`. GHSA-4jpw-hj22-2xmc

March 2026 cluster

Secondary reporting describes nine CVEs disclosed between 2026-03-18 and 2026-03-21, one scored 9.9. Only CVE-2026-32922 (9.9) was verified individually here; the full list is TBD, check the advisory page.

Exposure and Supply-Chain Incidents¶

Date	Finding	Source
2026-02	SecurityScorecard STRIKE counted 135,000+ internet-exposed instances in 82 countries (about 40,000 in its first report the same day); about 50,000 reported exploitable via known RCE CVEs	Bitdefender, The Register
2026-02	Koi Security "ClawHavoc": 341 malicious skills among 2,857 audited ClawHub skills (335 from one campaign), later updated to 824	Koi, The Hacker News
2026-02	OpenClaw partners with VirusTotal to scan every ClawHub skill (SHA-256 lookup, Code Insight, daily rescans)	OpenClaw blog, The Hacker News

Access Control Mechanisms¶

Mechanism	Scope	Notes
Shared secret (`token` / `password`)	Gateway WS and HTTP	Required by default; fail-closed when no auth path is configured. Grants full operator scopes
Device pairing	Every WS client and node	Signed `connect.challenge`; loopback auto-approved, LAN/tailnet require approval
Operator scopes	`operator.admin`, `.read`, `.write`, `.approvals`, `.pairing`	Honored for identity-bearing modes; ignored for shared-secret HTTP compatibility endpoints
Trusted proxy / Tailscale Serve	Identity from headers	`gateway.auth.mode: "trusted-proxy"`, `gateway.auth.allowTailscale`
DM policy and allowlists	Per channel	Pairing codes for unknown DM senders; group allowlists with mention gating
Tool policy and exec approvals	Per agent	Profiles, allow/deny, approvals; enforced in code before sandbox rules

Hardening Checklist¶

Production deployment hardening

Derived from the official Security pages and Why OpenClaw "hardened setup". Run openclaw security audit --deep to check drift.

ClawHub Skill Vetting Status¶

Aspect	Status (2026-09)
Automated malware scanning	VirusTotal (with Code Insight) for published skills since 2026-02; daily rescans
Additional scanners	ClawScan and static analysis shown on skill pages
Trust verdict at install	`clawhub.skill.verify.v1` envelope via `openclaw skills verify`
Pending or stale scans	Installation can proceed with a warning
Local file hashing	`skills verify` does not hash current local files
Plugins	Run in-process with Gateway privileges; not sandboxed

Glossary¶

Term	Meaning
Gateway	Long-lived daemon that owns channels, sessions, tools, and the WS/HTTP API
Node	Device (macOS/iOS/Android/headless) connected with `role: node` exposing device commands
Control UI	Browser dashboard served by the Gateway
Agent runtime / harness	The loop that executes a turn (`openclaw`, `codex`, `copilot`, `claude-cli`, ACP)
Skill	`SKILL.md` instruction pack
Plugin	Code or bundle package adding tools, channels, providers, skills, MCP servers
ClawHub	Public skill and plugin registry
Lobster	Typed workflow runtime with approval gates, via the `@openclaw/lobster` plugin
Molty	The project's space-lobster mascot