Raw research notes

OpenClaw

Checked: 2026-11-14. This file records what official pages said on that date. Figures that were not on a page opened for this pass are marked UNVERIFIED. When a news article and an official page disagree, the official line is quoted.

1. What it is

OpenClaw is a self-hosted control plane for an AI assistant. You run one Gateway process on your own computer or server. That Gateway connects chat apps, a browser dashboard, and native companion apps to an agent that can use tools, keep sessions, and remember notes. The docs describe it as one product that can be a personal assistant on one laptop or a shared multi-user assistant; configuration is what changes, not a separate paid edition.

Official one-paragraph description, from What is OpenClaw? (checked 2026-11-14):

OpenClaw is an AI assistant you run on your own infrastructure - for yourself, or shared with your team. It replies on the messaging surfaces you already use (Discord, Google Chat, iMessage, Mattermost, Signal, Slack, Telegram, WebChat, WhatsApp, and bundled channel plugins such as QQ Bot) and can also do voice plus hosted widgets in chat, on session dashboards, and in the macOS panel. The Gateway is the always-on control plane; the assistant is the product.

The docs homepage, docs.openclaw.ai, adds (checked 2026-11-14 via search extract of that page):

Your AI assistant, on your own hardware, in every chat app you already use. One Gateway. Any model. Any device. No hosted service in the middle.

Developed in the open by the OpenClaw Foundation, an independent 501(c)(3). No paid tier, no telemetry by default beyond a version check you can turn off, no lab owns it.

The same homepage says it is "MIT licensed, community-driven" and that prompts go to the model provider and chat platforms you configure. A daily version check can be turned off with update.checkOnStart: false. Anonymous feature statistics are described as opt-in on the GitHub README extract returned the same day.

Steward

The 501(c)(3) status is what the project says about itself. This pass did not open a separate IRS or state charity record, so the legal filing itself is UNVERIFIED.

License

GitHub API license object, checked 2026-11-14 at https://api.github.com/repos/openclaw/openclaw:

The README extract on the same date says: "MIT © OpenClaw Foundation."

Latest release

From https://api.github.com/repos/openclaw/openclaw/releases/latest, checked 2026-11-14:

Field Value
Name openclaw 2026.11.3
Tag v2026.11.3
Prerelease false
Draft false
Published 2026-11-10T18:53:07Z
Release page https://github.com/openclaw/openclaw/releases/tag/v2026.11.3

That release includes a macOS disk image asset named OpenClaw-2026.11.3-arm64.dmg. This pass did not open npmjs.com, so the npm publish timestamp is UNVERIFIED. The GitHub release notes page links https://www.npmjs.com/package/openclaw/v/2026.11.3.

A newer pre-release is listed on the releases page: v2026.11.5-beta.2, marked Pre-release, timestamp on the page "12 Nov 00:43". That line did not print a four-digit year. It is not what GitHub's releases/latest API returns. The same releases listing also shows an extended-stable maintenance tag v2026.9.37 ("10 Nov 20:42" on the page). Its own note says it is a gateway-only line from the end of September 2026 plus later fixes, and that the current OpenClaw at the time of that note was 2026.11.2. Treat v2026.11.3 as the latest stable release.

GitHub stars

Two views were opened on 2026-11-14:

Rough stars to repeat later: about 394,000. The exact API figure above is the one to cite. Third-party star trackers disagreed with each other the same day (examples seen in search: 394,406 and 394,447). Those are not used here.

2. Install on Windows 11 and macOS

Source pages checked 2026-11-14:

Node.js the docs require

From the install page, quoted:

Node 24.16.0+ on 24.x, or 26.1.0+ (24.22.1+/26.12.1+ strongly recommended for security) - Node 26 is recommended; the installer provisions Node 26 on macOS and Node 24 LTS on Linux when Node is missing.

From the Node.js page:

Check command, from the Node page:

node -v

Manual Windows Node install, if you do not want the OpenClaw script to do it:

winget install OpenJS.NodeJS.LTS

Windows 11

The Windows page says Windows Hub is the native WinUI companion for Windows 10 20H2+ and Windows 11. It installs without administrator privileges and ships signed x64 and ARM64 installers from its own release page, separately from the CLI. Download names on the install page:

What the recommended Hub setup actually does, from the Windows page: first-run "Set up locally" provisions an app-owned OpenClawGateway WSL distro and installs the Gateway inside it. The same app can instead connect to a local Gateway on this PC, a WSL Gateway, a remote Gateway, or an SSH tunnel.

The cross-platform Tauri desktop app is documented as the backup on Windows. Its installer name pattern is OpenClaw-<version>-windows-x86_64.exe. The Linux page says that Windows Tauri path can start a local Gateway with bundled Bun and does not require system Node.js. An older app can report "This app does not include a signed Windows Gateway" and then only connect remotely. Installing system Node does not fix that.

Exact PowerShell command for the native CLI and Gateway, quoted from both the install page and the Windows page:

iwr -useb https://openclaw.ai/install.ps1 | iex

Without onboarding:

& ([scriptblock]::Create((iwr -useb https://openclaw.ai/install.ps1))) -NoOnboard

Verify, from the Windows page:

openclaw --version
openclaw doctor
openclaw gateway status --json

If PowerShell says running scripts is disabled, the docs say to leave the execution policy unchanged and call npm's shim:

& "$env:APPDATA\npm\openclaw.cmd" --version
& "$env:APPDATA\npm\openclaw.cmd" doctor --generate-gateway-token

Native Windows Gateway startup uses a Scheduled Task. If task creation is denied, the fallback is a per-user Startup-folder login item, which does not start before someone logs on. Agent shell commands prefer PowerShell 7 and fall back to Windows PowerShell 5.1. The installer internals page says the complete native Windows launcher to downloaded-Node recovery path "remains unproven on native Windows."

macOS

Exact command, quoted from the install page. The same script is the Linux and WSL2 command:

curl -fsSL https://openclaw.ai/install.sh | bash

Without onboarding:

curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard

A rootless alternative that keeps Node and OpenClaw under a local prefix such as ~/.openclaw:

curl -fsSL https://openclaw.ai/install-cli.sh | bash

The installer internals page says that when Node is missing and nvm is not detected, install.sh provisions Node 26 through Homebrew on macOS. The rootless install-cli.sh downloads Node 24.22.1 on macOS.

If Node is already managed, npm install from the install page (npm 12, or npm 11.16 and newer):

npm install -g openclaw@latest --allow-scripts=openclaw
openclaw onboard --install-daemon

On npm 11.15 and earlier, the docs say to use the same npm install line without --allow-scripts=openclaw.

Verify, from the install page:

openclaw --version
openclaw doctor
openclaw gateway status

Managed startup on macOS is a LaunchAgent, installed by openclaw onboard --install-daemon or openclaw gateway install.

The native menu-bar app is separate from the CLI. From the macOS app page:

On a fresh Mac app install, the app prepares a bundled runtime, starts a Gateway on that Mac, and opens onboarding. It does not automatically join a Gateway it discovers on the network.

3. Default safety

Sandbox: off by default

Sandboxing, checked 2026-11-14:

OpenClaw can run tool execution inside a sandbox backend to limit the damage tools can cause. Sandboxing is off by default and controlled by agents.defaults.sandbox (global), agents.entries.*.sandbox (per-agent), or a required creator-role sandbox policy. The Gateway process always stays on the host; only tool execution moves into the sandbox when enabled.

This is not a perfect security boundary, but it materially limits filesystem and process access when the model does something dumb.

Modes, scope, and backend gives the defaults:

Setting Default
agents.defaults.sandbox.mode off
agents.defaults.sandbox.scope agent
agents.defaults.sandbox.backend docker
agents.defaults.sandbox.workspaceAccess none (from the config reference; applies once sandboxing is on)

off means no agent-wide sandbox. Sessions still run sandboxed if the creator's operator role requires it. With sandboxing off, the exec tool page says implicit host=auto resolves to the gateway host, so tools run on the real machine. An explicit host=sandbox request is rejected rather than silently moved to the host.

Docker is the default backend, but Doctor skips sandbox image checks while mode is off. A fresh install does not build the sandbox image until someone turns sandboxing on.

Shell approvals: off by default on the normal host

Exec tool, checked 2026-11-14:

No-approval host exec is the default for gateway and node (mode=full) — this comes from the host-policy defaults, not from host=auto. If you want approvals/allowlist behavior, set tools.exec.mode and tighten the host approvals file.

Exec approvals:

So the default personal install can run shell commands on the Gateway machine without an allowlist and without an ordinary approval prompt. Approvals exist and can be tightened. They are not the default.

What is locked down by default

These defaults are safer than the shell defaults, and they are easy to miss:

Other defaults a non-coder can trip over:

Where state and secrets live

Default state directory: ~/.openclaw, or $OPENCLAW_STATE_DIR if set. On Windows the project also refers to %USERPROFILE%\.openclaw (launcher, logs, and bin). Source: Where things live on disk and the Windows page.

Secrets, storage, and logs says to assume anything under ~/.openclaw/ may contain secrets or private data. Paths named there:

Path What it holds
~/.openclaw/openclaw.json Main config. Can include gateway tokens, provider settings, and allowlists. Recommended mode 600.
~/.openclaw/ State root. Recommended mode 700.
~/.openclaw/.env Recommended place for provider API keys. A workspace .env is not trusted for provider keys.
~/.openclaw/credentials/ Channel credentials, for example WhatsApp creds.json. Legacy OAuth import at credentials/oauth.json.
~/.openclaw/state/openclaw.sqlite Shared runtime state: pairing, MCP OAuth tokens, dynamic client secrets, shared auth profiles.
~/.openclaw/agents/<agent>/agent/openclaw-agent.sqlite Per-agent model auth profiles (API keys and OAuth), sessions, and transcripts that can contain private messages and tool output.
~/.openclaw/secrets.json Optional file-backed secret payload.
~/.openclaw/workspace Default agent workspace, including memory files.
~/.openclaw/sandboxes/ Copies of files used inside sandboxes, once sandboxing is used.
~/.openclaw/exec-approvals.sock Local approval socket. Tokens for it live in client/credentials.sqlite, not in the shared policy row.

The GitHub Copilot page is explicit about encryption: the protected local secret store "is not encrypted at rest; its SQLite file relies on state-directory permissions." That sentence is about the Copilot token store. The general secrets page does not claim full-disk encryption is automatic. It tells operators to use full-disk encryption on the gateway host and to prefer a dedicated OS user if the computer is shared.

Chat messages also leave the machine when a cloud model or a chat platform is used. The FAQ says local models keep prompts on the machine, but channel traffic still goes through that channel's servers.

4. Everyday capabilities

Sources checked 2026-11-14: Features, Tools, Browser, PDF tool, Memory overview, Automations, ClawHub security audits, Platforms.

Browser

The agent can open a separate Chrome, Brave, Edge, or Chromium profile named openclaw, controlled through a loopback service inside the Gateway. It can list, open, focus, and close tabs; click, type, drag, and select; take snapshots, screenshots, and PDFs; and answer questions from page text. A bundled browser-automation skill teaches the recovery loop when the browser plugin is enabled. On macOS, a person can explicitly copy selected cookies from a Chrome-family profile into the managed profile. Passwords are not copied. Local storage and IndexedDB stay behind. The user profile is the one that attaches to the real signed-in Chrome session through Chrome DevTools MCP.

Files and documents

Built-in file tools include read, write, edit, and apply_patch. They operate on the agent workspace. On a native Windows Gateway, read, write, and edit also accept Git Bash, Cygwin, and WSL-style drive paths and resolve them to Windows drives.

Documents: the features page says images, audio, video, and documents go in and out, including image and video generation and voice-note transcription. The PDF tool analyzes one or more PDFs (up to 10) and returns text. It can read a local path, a file:// URL, an http(s) URL, or an inbound media:// reference. Anthropic and Google models can take the PDF natively. Other providers get extracted text, and pages with very little text can be rendered to images. Default page cap for that fallback is agents.defaults.pdfMaxPages = 20. Remote URLs are rejected when the tool is sandboxed. The tool does not create PDFs; the browser tool is the one that mentions saving PDFs.

Memory

Memory is Markdown in the agent workspace, default ~/.openclaw/workspace. There is no hidden memory store separate from those files. The memory page names:

A person can say "remember that..." and the agent writes a file. Files stay until deleted. The model context window is still limited, so search pulls relevant notes back. rememberAcrossConversations defaults on for personal installs and off when DM isolation is configured.

Scheduled jobs

Automations are the built-in scheduler. The CLI is openclaw automations. openclaw cron remains an alias. Jobs persist, wake the agent, and can deliver to a chat channel, a webhook, or nowhere. Isolated jobs default to announce delivery. With no external route, the conversation that created the job receives the result, including WebChat. The scheduler is enabled by default. This pass did not find a list of jobs that ship already scheduled for a new personal install. Assume a new install has the scheduler and no personal jobs until someone adds them.

Skills and ClawHub

A skill is a SKILL.md instruction pack. A plugin can add tools, channels, providers, and skills. ClawHub is the marketplace. The macOS Dashboard can search ClawHub and install a skill; the Gateway runs the pre-download check. Official publishers can skip the security-verdict fetch. Audits show risk and findings, and the audit page says they are not a guarantee. The security FAQ says OpenClaw does not run built-in local dangerous-code blocking during plugin or skill install. The threat-model page says skills run with agent privileges and that credential-harvesting residual risk is Critical.

Messaging channels that the features page actually names

Shipped in the core install:

Official plugins, installed with openclaw plugins install @openclaw/<name> or during openclaw onboard / openclaw channels add:

Maintained outside the OpenClaw repo:

Group chats can require a mention. Direct messages use pairing and allowlists, described above.

Native apps, and which operating systems

From the platforms page and the app pages:

App OS Role
Windows Hub Windows 10 20H2+ and Windows 11, x64 and ARM64 Recommended Windows desktop app. Local setup uses an app-owned WSL Gateway. Can also chat, show tray status, act as a node, and run a local MCP mode.
Tauri desktop app Linux as the companion; Windows as the backup Can set up a local Gateway. On Windows it can use bundled Bun.
macOS menu-bar app macOS 26.2 or later Menu bar, WebChat, voice, permissions, exec approval prompts, Mac node tools, computer control. Can start a local Gateway.
iOS app iOS 26.2 or iPadOS 26.2 or later Companion node. Does not host the Gateway. Camera, screen, location, voice, chat.
Android app Google Play, or a signed APK on selected GitHub releases Companion node. Does not host the Gateway. The Android page says the Gateway runs on macOS, Linux, or Windows via WSL2.
Linux Gateway is fully supported. Desktop companion is the Tauri app. Gateway host, not only a phone-style node.

The iOS requirements line says the Gateway runs "on another device (macOS, Linux, or Windows via WSL2)." The Android support snapshot says the same three hosts. The Windows page separately documents a native Windows Gateway. Those pages disagree about whether "Windows" for a phone means WSL2 only. Quote the phone pages if the reader is pairing a phone: they name WSL2, not the native Scheduled Task Gateway.

5. Connecting a brain

"Still offered" means the official OpenClaw provider page, checked 2026-11-14, still documents that sign-in for a new setup. Prices below are only the ones read on an official page this pass.

Google AI Studio API key — still offered

Page: https://docs.openclaw.ai/providers/google

This is the recommended Google path. Auth env vars: GEMINI_API_KEY or GOOGLE_API_KEY. Default model on that page: google/gemini-4-argon (shorthand google/gemini-4), with a 1,048,576-token context window and up to 65,536 output tokens. The page says google/gemini-3-pro-preview was retired on 2026-03-09.

openclaw onboard --auth-choice gemini-api-key

The page says to create a key in Google AI Studio and calls it "a free key." It does not quote a free-tier token cap. Any numeric free quota is UNVERIFIED.

Vertex AI with Google Cloud Application Default Credentials is a separate managed-cloud route (google-vertex). It is still documented.

Groq — still offered, as a plugin

Page: https://docs.openclaw.ai/providers/groq

Groq is an official external plugin, not described as part of the core install. Provider id groq. Auth: GROQ_API_KEY. Base URL: https://api.groq.com/openai/v1. Suggested default: groq/openai/gpt-oss-120b. Keys are created at console.groq.com/keys. No 2026 ban or special billing warning was on this page.

openclaw plugins install @openclaw/groq-provider
export GROQ_API_KEY=gsk_...

OpenRouter — still offered, API key and OAuth

Page: https://docs.openclaw.ai/providers/openrouter

Both paths are current:

openclaw onboard --auth-choice openrouter-api-key
openclaw onboard --auth-choice openrouter-oauth

OAuth is a browser PKCE sign-in that exchanges the code for an OpenRouter API key and stores it in the openrouter:default profile. Headless hosts print a URL and ask for the redirect URL. API keys come from openrouter.ai/keys. No ban was stated on this page. OpenRouter bills the OpenRouter account; this pass did not open OpenRouter's price table, so dollar amounts are UNVERIFIED.

Ollama and other local models — still offered

Page: https://docs.openclaw.ai/providers/ollama/setup

Onboarding can choose Ollama, then Cloud + Local or Local only. Local and LAN addresses do not need a real API key. OpenClaw uses the marker ollama-local. Public hosts and https://ollama.com need a real OLLAMA_API_KEY. Hosted Ollama is a different provider id, ollama-cloud.

Manual local setup quoted from that page:

ollama pull gemma4
export OLLAMA_API_KEY="ollama-local"

The models FAQ also says llama.cpp, vLLM, SGLang, and LM Studio work through OpenAI-compatible or Anthropic-compatible endpoints, and that smaller or heavily quantized models are more vulnerable to prompt injection. It tells people to use a large model for any bot with tools.

GitHub Copilot device login — still offered

Page: https://docs.openclaw.ai/providers/github-copilot

The built-in provider is the default Copilot path and does not require VS Code:

openclaw models auth login-github-copilot

The terminal shows a URL and a one-time code. The flow needs an interactive terminal. The token goes into the local secret store as a tokenRef unless plaintext mode is chosen. Model choice depends on the GitHub plan and organization policy. The page points at GitHub's plan-model list and does not itself announce a 2026 ban. Two other paths are also documented: the Copilot SDK harness plugin, and the Copilot Proxy VS Code extension (copilot-proxy, enabled by default, talks to http://localhost:3000/v1). Enterprise data-residency tenants use a separate device login:

openclaw models auth login --provider github-copilot --method device-enterprise

Claude CLI — still offered, with a billing history that press and official docs describe differently

Page: https://docs.openclaw.ai/providers/anthropic/

OpenClaw still documents two Anthropic routes:

CLI setup quoted from the provider page:

claude auth login
openclaw onboard
# choose: Claude CLI

OpenClaw does not copy, refresh, or store that native login. Claude Code owns it. A model can be pinned to the CLI runtime with agentRuntime.id: "claude-cli".

April 2026 press versus the official page today. News articles (The Verge, 3 April 2026; TechCrunch, 4 April 2026) reported that starting 4 April 2026, Claude subscriptions would stop covering third-party harnesses including OpenClaw, and that people would need extra usage or an API key. Those are not Anthropic's current help-center text.

Official Anthropic page, Use the Claude Agent SDK with your Claude plan, checked 2026-11-14:

Update June 15, 2026: We've paused the previously-announced changes to Claude Agent SDK usage. For now, nothing has changed: Claude Agent SDK, claude -p, and third-party app usage still draw from your subscription limits.

Update October 7, 2026: Claude Max, Ultra, and Team plans now include monthly API credits. They cover the Claude API, Claude Managed Agents, and the Claude Agent SDK and claude -p when you run them with an API key from your linked Claude Console organization. Nothing changes for your plan: when you're signed in with your Claude plan, the Claude Agent SDK and claude -p still draw from your subscription limits.

OpenClaw's Anthropic page quotes that June 15 pause and says subscription-plan Agent SDK, claude -p, and third-party app usage "still draw from the signed-in subscription's usage limits." It also says Anthropic can change this without an OpenClaw release. A separate OpenClaw costs page says that as of 2026-07-05 Anthropic had confirmed Claude CLI reuse, including claude -p, as a sanctioned pattern unless it publishes a new policy.

Extra usage is still a real billing switch, not a closed April-only event. Buy usage bundles, checked 2026-11-14, says bundle balance "works across Claude, Claude Code, Claude Cowork, and third-party products" and "only apply after you've exceeded your plan's limits and are using usage credits." Prices on that page: a $50 bundle costs $45 (10% off), a $250 bundle costs $200 (20% off), a $1000 bundle costs $700 (30% off). Monthly discounted purchase caps: $2000 for Pro, Max, and Ultra; $3000 for Team owners. Past the cap, usage is "billed at standard rates." The page says prices can change. OpenClaw's usage-tracking page still shows an "optional extra-usage budget" for subscription credentials and names "Anthropic's Claude-login path with Extra Usage enabled" as a cost source. If usage credits are turned on, going past the plan can cost money even though the April "subscription no longer covers OpenClaw" rule is not the current official rule.

Long-context errors are a different warning. The OpenClaw FAQ says Extra usage is required for long context requests means the request wants Anthropic's 1M context window and the credential is not eligible for long-context billing.

Codex / OpenAI OAuth — still offered

Pages: https://docs.openclaw.ai/providers/openai/authentication and https://docs.openclaw.ai/providers/openai/setup

Documented methods:

openclaw models auth login --provider openai --method oauth
openclaw models auth login --provider openai --method device-code
openclaw models auth login --provider openai --method siwc
openclaw models auth login --provider openai --method api-key

Browser OAuth is the default when --method is omitted. Device code is the headless path. "Sign in with ChatGPT (Beta)" (siwc) authorizes OpenClaw as an app to use Codex allowance for eligible Responses API calls. The setup page says onboarding no longer imports OAuth material from ~/.codex. No 2026 ban was stated on these pages. API-key use is separate pay-as-you-go billing. Subscription quota numbers were not on the pages opened here and are UNVERIFIED.

Gemini CLI OAuth and Antigravity OAuth — not offered for new setup

OpenClaw Google provider page:

OpenClaw does not offer new Gemini CLI OAuth or Antigravity OAuth setup. Google ended consumer Gemini CLI Login with Google access on June 18, 2026, and the Antigravity terms prohibit third-party tools from accessing the service through Antigravity OAuth. Use an AI Studio API key or Vertex AI instead.

The optional google-gemini-cli runtime still exists, but only with a Google AI Studio API key plus a local gemini binary (brew install gemini-cli or npm install -g @google/gemini-cli). Old Gemini CLI OAuth profiles "remain executable for compatibility, but OpenClaw cannot create or repair them."

Google's own terms, https://antigravity.google/terms/, checked 2026-11-14, name OpenClaw:

Using third party software, tools, or services to access the Service (e.g. using OpenClaw with Antigravity OAuth) is a breach of this Agreement. Such actions may be grounds for suspension or termination of your Antigravity and/or Gemini CLI accounts.

Google's FAQ, https://antigravity.google/docs/faq/, says the same about Claude Code, OpenClaw, and OpenCode, and tells people to use a Gemini Enterprise or Google AI Studio API key instead. Wrapping Antigravity's headless agy -p inside a third-party agent is "not supported under consumer plans."

This is the official ban. Do not send a reader through Gemini CLI Login with Google or Antigravity OAuth.

6. What a non-technical person would find hard or dangerous

Hard, before anything is dangerous:

Dangerous if the defaults are left alone:

7. Facts for the scorecard

Short factual answers. Not a recommendation.

Sources

All checked 2026-11-14 unless noted.

Identity, license, stars, release:

Install:

Safety and storage:

Capabilities:

Model routes and billing:

Press that disagrees with the current Anthropic help page (April 2026 announcement, later paused on the official page):

Checked 14 November 2026 · prices, limits, and versions change