OpenClaw - Local-First Personal AI Assistant Gateway

OpenClaw is not just another coding-agent CLI.

It is closer to a personal assistant control plane: a local Gateway, a CLI, a web dashboard, model-provider integrations, messaging channels, plugins, skills, memory, sessions, device nodes, and optional sandboxing.

That makes it adjacent to tools like NanoClaw, Pi, Codex CLI, and OpenCode, but it has a wider scope. The goal is not only “ask an agent to edit code”; the goal is “run a personal assistant that can receive messages, route work, remember context, use tools, and act through connected channels.”

OpenClaw GitHub Source Code OpenClaw Website OpenClaw Documentation License: MIT

What is OpenClaw?

OpenClaw is a personal AI assistant that you run on your own devices or infrastructure.

The main process is the Gateway. It owns the assistant control plane:

• WebSocket API
• dashboard / Control UI
• sessions and transcripts
• agents and workspaces
• model providers
• channel connectors
• plugins and skills
• memory
• nodes for device capabilities
• health, status, diagnostics, and security checks

The CLI is the operator interface around that Gateway:

openclaw onboard
openclaw setup
openclaw configure
openclaw status
openclaw doctor --fix
openclaw gateway run
openclaw dashboard
openclaw models list
openclaw agent --message "Ship checklist"

Repository Snapshot

I cloned the repo into:

tmp/foss-post/openclaw

Source state:

This is a very large workspace. The checkout was about 1.7GB locally.

Main Pieces

The architecture docs describe one long-lived Gateway process that owns messaging surfaces and accepts CLI, app, automation, and node clients over WebSocket.

Local Field Test

Local environment:

Published CLI Help

There was no preinstalled openclaw binary:

which openclaw
openclaw --version

Result:

openclaw: command not found

Then I tested the published package:

/usr/bin/time -v timeout 90s npx -y openclaw@latest --help

Result:

The help output showed OpenClaw 2026.6.1 and a large command tree: onboard, setup, configure, status, doctor, gateway, models, agent, agents, channels, plugins, skills, memory, mcp, acp, sandbox, sessions, tasks, webhooks, dashboard, and more.

Gateway Help

I also checked Gateway help with an isolated profile:

npx -y openclaw@latest --profile foss-post-smoke gateway --help

Result:

Useful Gateway commands include:

openclaw gateway run
openclaw gateway status
openclaw gateway health
openclaw gateway probe
openclaw gateway diagnostics
openclaw gateway install
openclaw gateway start
openclaw gateway stop

Gateway flags include:

--bind loopback|lan|tailnet|auto|custom
--auth none|token|password|trusted-proxy
--token <token>
--password <password>
--port <port>
--force

First-Run Status and Doctor

I used an isolated profile to avoid changing the normal OpenClaw state:

npx -y openclaw@latest --profile foss-post-smoke status
npx -y openclaw@latest --profile foss-post-smoke doctor

Status worked and showed the expected pre-onboarding state:

• dashboard URL: http://127.0.0.1:18789/
• Gateway: local loopback, unreachable
• Gateway service: systemd user service not installed
• Node service: not installed
• agents: 0
• channels: none configured
• sessions: none

Doctor was more useful. It reported:

• gateway.mode is unset
• Gateway auth is missing a token
• no command owner is configured
• plugin registry needs repair
• session store directory is missing
• memory search provider is set to OpenAI but no API key was found
• many optional skills are unavailable because host binaries or OS-specific dependencies are missing

That is exactly the kind of output new users need to see before exposing anything.

Docker Compose

OpenClaw ships an official docker-compose.yml, and it validates:

docker compose config

Result:

I did not run a full image build or container startup in this pass. The source checkout is large, the Docker build is heavy, and this machine was down to about 14GB free disk with only about 1.6GB available RAM and no swap.

Instead, I prepared a conservative Home-Lab Compose file based on the official Docker model but using the published container image by default:

services:
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE:-ghcr.io/openclaw/openclaw:latest}
    container_name: openclaw-gateway
    restart: unless-stopped
    init: true
    env_file:
      - path: .env
        required: false
    environment:
      HOME: /home/node
      OPENCLAW_HOME: /home/node
      TERM: xterm-256color
      TZ: ${OPENCLAW_TZ:-UTC}
      OPENCLAW_STATE_DIR: /home/node/.openclaw
      OPENCLAW_CONFIG_PATH: /home/node/.openclaw/openclaw.json
      OPENCLAW_CONFIG_DIR: /home/node/.openclaw
      OPENCLAW_WORKSPACE_DIR: /home/node/.openclaw/workspace
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:?Set OPENCLAW_GATEWAY_TOKEN in .env}
      OPENCLAW_DISABLE_BONJOUR: ${OPENCLAW_DISABLE_BONJOUR:-1}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      GOOGLE_API_KEY: ${GOOGLE_API_KEY:-}
    ports:
      - "${OPENCLAW_BIND:-127.0.0.1}:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
      - "${OPENCLAW_BIND:-127.0.0.1}:${OPENCLAW_BRIDGE_PORT:-18790}:18790"
      - "${OPENCLAW_BIND:-127.0.0.1}:${OPENCLAW_MSTEAMS_PORT:-3978}:3978"
    volumes:
      - openclaw-state:/home/node/.openclaw
      - openclaw-auth-profiles:/home/node/.config/openclaw
    cap_drop:
      - NET_RAW
      - NET_ADMIN
    security_opt:
      - no-new-privileges:true
    extra_hosts:
      - "host.docker.internal:host-gateway"
    command:
      [
        "node",
        "dist/index.js",
        "gateway",
        "--bind",
        "${OPENCLAW_GATEWAY_BIND:-loopback}",
        "--port",
        "18789",
      ]
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  openclaw-cli:
    image: ${OPENCLAW_IMAGE:-ghcr.io/openclaw/openclaw:latest}
    container_name: openclaw-cli
    network_mode: "service:openclaw-gateway"
    init: true
    stdin_open: true
    tty: true
    env_file:
      - path: .env
        required: false
    environment:
      HOME: /home/node
      OPENCLAW_HOME: /home/node
      TERM: xterm-256color
      TZ: ${OPENCLAW_TZ:-UTC}
      OPENCLAW_STATE_DIR: /home/node/.openclaw
      OPENCLAW_CONFIG_PATH: /home/node/.openclaw/openclaw.json
      OPENCLAW_CONFIG_DIR: /home/node/.openclaw
      OPENCLAW_WORKSPACE_DIR: /home/node/.openclaw/workspace
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:?Set OPENCLAW_GATEWAY_TOKEN in .env}
      BROWSER: echo
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      GOOGLE_API_KEY: ${GOOGLE_API_KEY:-}
    volumes:
      - openclaw-state:/home/node/.openclaw
      - openclaw-auth-profiles:/home/node/.config/openclaw
    cap_drop:
      - NET_RAW
      - NET_ADMIN
    security_opt:
      - no-new-privileges:true
    entrypoint: ["node", "dist/index.js"]
    depends_on:
      - openclaw-gateway

volumes:
  openclaw-state:
  openclaw-auth-profiles:

The Home-Lab compose was validated with:

OPENCLAW_GATEWAY_TOKEN=dummy-token docker compose config

Both the public Home-Lab copy and the local assets/snippets/openclaw submodule copy rendered successfully.

Minimal Run Commands

From the Home-Lab folder:

cp .env.sample .env

Edit .env and set:

OPENCLAW_GATEWAY_TOKEN=your-long-random-token

Then start:

docker compose up -d

Check:

docker compose ps
curl -fsS http://127.0.0.1:18789/healthz

Open:

http://127.0.0.1:18789/

Use the CLI helper container after the Gateway exists:

docker compose run --rm openclaw-cli status
docker compose run --rm openclaw-cli dashboard --no-open
docker compose run --rm openclaw-cli doctor

Security Notes

OpenClaw connects to real channels and can run real tools. Treat the setup like a privileged automation system, not a toy chatbot.

Practical defaults I used in the Home-Lab compose:

• bind ports to 127.0.0.1
• require OPENCLAW_GATEWAY_TOKEN
• disable Bonjour/mDNS by default
• persist state in named Docker volumes
• leave provider API keys empty
• drop NET_RAW and NET_ADMIN
• set no-new-privileges:true

Before exposing it remotely, read the upstream security docs and prefer a private tunnel or VPN instead of a public unauthenticated port.

Where OpenClaw Fits

OpenClaw is the broadest of these. It overlaps with agentic CLI tools, but the primary product is the always-on assistant Gateway.

The honest pick:

• Pick OpenClaw if you want a local-first assistant Gateway with channels, plugins, skills, device nodes, and dashboard-style operation.
• Pick NanoClaw if you want a smaller runtime where container isolation and auditability are the pitch.
• Pick Hermes Agent if you want a persistent agent runtime with memory, cron, gateway integrations, and an OpenAI-compatible API surface.
• Pick Paperclip if you are coordinating work across many agents rather than building one personal assistant.

FAQ