# OpenClaw (slim)

> Open-source personal AI assistant that runs as a Gateway on the owner's own computer and answers in WhatsApp, Telegram, Slack, iMessage and other chat apps, with desktop and mobile apps. The OpenClaw Foundation maintains it under the MIT licence.

- Full: https://www.anchorterminal.com/tools/openclaw.md (~8,950 tokens) · this version ~2,180 tokens · JSON https://www.anchorterminal.com/tools/openclaw.json · canonical https://www.anchorterminal.com/tools/openclaw
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-12

**B · 67.1/100 · rank #270 of 986 · #4 in Personal assistants · not agent-ready · confidence medium**


Assessment: Self-hosted under the MIT licence, with state, memory and credentials kept on the owner's machine and no paid tier. A fresh install runs tools on the host with full access, no approval prompt and no sandbox, and the project has published 722 security advisories since January 2026, 14 of them critical.

## Facts

- Kind: Agent harness · vendor: OpenClaw Foundation · category: Personal assistants · legal entity: OpenClaw Foundation · provenance 53/100
- Packages: npm `openclaw`, oci `ghcr.io/openclaw/openclaw`
- Auth: OAuth or key · pricing: Free · x402: no · licence: MIT
- Probe metrics: not measured yet (probes haven't run)
- Where it runs: A Gateway process on the owner's computer or server, bound to loopback on a regular host install. Installers for macOS, Linux and Windows, an npm package for Node 24.16+ or 26.1+, desktop apps, and a container image at ghcr.io/openclaw/openclaw, which defaults to an exposed bind (https://docs.openclaw.ai/gateway/security)
- What it does without asking: By default host commands run with no approval, file tools have full access and the message tool can send to any configured conversation. Persistent config changes from a restricted chat session ask for approval with a card or `/approve <id> allow-once|deny`. Free-text replies such as yes never authorise a change (https://docs.openclaw.ai/gateway/permission-modes)
- Approval controls: Session permission modes `read-only`, `guarded` (a human reviews exec after an allowlist), `workspace` (a model reviews and can escalate to a human) and `full`. Per-message `/exec ask=always`. Tool allow and deny lists and profiles `minimal`, `messaging`, `coding` and `full`. Optional Docker or Podman sandbox per agent or session
- Accounts: Google Workspace through the bundled `gog` skill and the separate gog CLI with OAuth (Gmail, Calendar, Drive, Contacts, Sheets, Docs), Gmail Pub/Sub triggers, an IMAP plugin that reads but does not send, GitHub, and anything reachable through MCP servers, skills or the browser. Scopes are whatever the owner grants each tool
- Credential storage: Under `~/.openclaw`. Channel credentials in `credentials/`, model auth profiles in a per-agent SQLite database, MCP OAuth tokens in `state/openclaw.sqlite`, tokens possibly in `openclaw.json`. Recommended permissions are 700 and 600 with full-disk encryption. SecretRef providers (env, file, exec, store) and a 1Password plugin are optional (https://docs.openclaw.ai/gateway/security/secrets-and-storage)
- Memory: Markdown files in the workspace, default `~/.openclaw/workspace`. `USER.md` for preferences, `MEMORY.md` for long-term facts, daily notes under `memory/`, indexed for `memory_search`. Delete by editing the files or with `openclaw memory forget --agent <id> --session <id>`, which has a `--dry-run` preview
- Model providers: More than 60 provider pages in the docs, among them Anthropic, OpenAI, Google, Bedrock, OpenRouter, Ollama, LM Studio, llama.cpp and vLLM. Prompts and tool output go to the provider the owner configures. ChatGPT and Claude subscriptions can be used in place of API keys
- Channels: 34 entries in the channel catalogue, among them WhatsApp, Telegram, Slack, Discord, iMessage, Signal, Microsoft Teams, Google Chat, Matrix, SMS through Twilio, LINE, WeChat and X, plus the built-in WebChat. Telephony through a voice-call plugin (https://docs.openclaw.ai/channels)
- Proactive work: Heartbeat turns every 30 minutes by default, scheduled automations with cron-style timing, webhooks, Gmail and IMAP triggers, and standing orders loaded from `AGENTS.md` each session
- Monthly cost: The software is free. The owner pays the model provider for every reply, tool call and heartbeat turn, plus any search, speech or media API configured. `/usage cost` and the Control UI show local estimates, not a provider invoice (https://docs.openclaw.ai/reference/api-usage-costs)
- MCP: Client over Streamable HTTP, SSE and stdio with OAuth, configured under `mcp.servers` and subject to tool policy. `openclaw mcp serve` exposes channel conversations to another MCP client over stdio (https://docs.openclaw.ai/tools/mcp)
- Releases: Calendar versions on four channels (stable, extended-stable, beta, dev). v2026.10.2 was published on 12 October 2026. Stable tags in the last 90 days are 2026.8.1, 8.2, 9.1 to 9.9, 10.1 and 10.2
- Activity: 391.8k stars, 82.4k forks, more than 5,000 open issues and about 3,300 open pull requests on GitHub, with 748 open issues labelled bug (checked 2026-10-12)

- Scores: Reliability 75, Performance pending, Schema & documentation 84, Agent ergonomics 77, Security & auth 74, Payments & pricing 60, Task success pending, Maintenance & community 86, Transparency & trust 68 · negative events -8 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, as for the agent programs in the harness category. · Schema & documentation, Harness reading of the framework line, as the Goose and OpenHands dossiers use. · Agent ergonomics, Harness reading, scored on what an owner or pipeline driving it has to supply. · Security & auth, Harness reading of the framework checklist. · Payments & pricing, Read with the self-hosted rule. · Maintenance & community, v2026.10.2 was published on 12 October 2026 (30). · Transparency & trust, MIT (30).
- Sources: 35, open questions: 10, both in the full twin
- Capabilities: assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client
- JSON: https://www.anchorterminal.com/api/v1/tools/openclaw.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/openclaw.svg` or a link to https://www.anchorterminal.com/tools/openclaw from a page on openclaw.ai or one of its subdomains, or the README of github.com/openclaw/openclaw, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set a session permission mode of `guarded` or `workspace`, or `tools.exec.mode`, before connecting mail. The default runs host commands without approval
2. Turn on `agents.defaults.sandbox` for any agent that reads mail, web pages or attachments. Sandboxing is off by default
3. Set `tools.message.crossContext.allowAcrossProviders` and `allowWithinProvider` to `false` to confine sends to the current conversation
4. Route incoming mail to a restricted reader agent, as the IMAP and Gmail guides show, and deny `gateway`, `cron`, `sessions_spawn` and `sessions_send` for it
5. Run `openclaw security audit` after setup, and treat the Gateway token as an owner credential. `POST /tools/invoke` accepts it with full operator access

## Connect

```bash
curl -fsSL https://openclaw.ai/install.sh | bash   # or: npm install -g openclaw@latest --allow-scripts=openclaw && openclaw onboard --install-daemon
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| ZeroClaw | BB | 70.2 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/zeroclaw.min.md |
| NanoClaw | B | 68.3 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, agent.mcp-client, assistant.accounts | https://www.anchorterminal.com/tools/nanoclaw.min.md |
| Hermes Agent | B | 67.9 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/hermes-agent.min.md |
| IronClaw | B | 66.7 | assistant.proactive, assistant.messaging, assistant.accounts, assistant.memory, assistant.self-hosted, agent.mcp-client | https://www.anchorterminal.com/tools/ironclaw.min.md |
| nanobot | B | 62.4 | assistant.proactive, assistant.messaging, assistant.memory, assistant.self-hosted, assistant.accounts, agent.mcp-client | https://www.anchorterminal.com/tools/nanobot.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)