OpenClaw: A Personal AI Agent You Text From Your Phone (GitHub, Scanned)

OpenClaw is a personal AI assistant that lives on your own computer and answers in the chat apps you already use. A local Gateway process connects it to WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Teams and more than 20 other channels, plus native apps for macOS, iOS, Android, Windows and Linux. You bring the model (Claude, Codex, a local model through a plugin), and the assistant can read and write files, run commands, browse and act on your behalf. Memory, state and credentials stay on your hardware, and by default the only call home is a daily version check.

It is on this list because it is the agent that went mainstream. Peter Steinberger first published it in November 2025; it went through the names Warelay, Clawdbot and Moltbot (the last after a trademark complaint from Anthropic) before settling on OpenClaw in January 2026, and it now has about 391,000 GitHub stars, a Wikipedia article and a steady stream of TikTok setup tutorials. Steinberger joined OpenAI in February 2026 and the project moved to the OpenClaw Foundation, an independent 501(c)(3) whose donors include OpenAI, Amazon and Red Hat. There is no paid tier, hosted service or token.

The power is also the risk. Tools run directly on the host for your main session unless you turn on sandboxing, inbound messages are untrusted input, and skills from the ClawHub registry are third-party code: Cisco researchers found published skills that exfiltrated data and injected prompts. The project's own security guide and exposure runbook are worth reading before you connect a chat account.

• Repository: github.com/openclaw/openclaw
• Licence: MIT (MIT License)
• Language: TypeScript. Stars: 391.2K. Forks: 82.2K. Last push: Oct 3, 2026.
• Scan: safe, Oct 3, 2026, commit efcd9ff

Who it is for

Technical users who want an always-on assistant reachable from their phone, are comfortable reviewing what an agent is allowed to do on their machine, and already pay for a model API or run a local model.

Getting started

1. Install on macOS, Linux or WSL2 (Windows: iwr -useb https://openclaw.ai/install.ps1 | iex)

curl -fsSL https://openclaw.ai/install.sh | bash

2. Or, if you manage Node 24.16+ yourself, install the npm package

npm install -g openclaw@latest --allow-scripts=openclaw

3. Run onboarding and install the background service (the script installer starts this for you)

openclaw onboard --install-daemon

4. Check the gateway and open the Control UI

openclaw gateway status && openclaw dashboard

The recommended installer is a shell script piped from openclaw.ai, and it can install a Node.js runtime for you. Onboarding asks for a model provider, so you need an API key or subscription (or a local model). Tools run on the host unless you configure sandboxing; read the security guide before pairing a chat account or exposing the Gateway beyond localhost.

Safety scan

We cloned openclaw/openclaw at commit efcd9ff on Oct 3, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• A large codebase: 51,928 files and about 13 million lines, mostly TypeScript, with Swift and Kotlin for the companion apps. All 147 secret candidates sit in tests and QA fixtures (fake Slack xoxb tokens, ghp_ tokens, AWS keys and PEM blocks used to prove the log redaction and secret scanners work). None is a live credential.
• The 181 pattern hits are the product doing what it says. 55 persistence hits are the macOS LaunchAgent and systemd units that keep the Gateway running; 78 api.telegram.org hits are the Telegram channel and its tests; the curl | bash lines are the installer's own usage text; the crypto-miner hit is a detection rule in OpenClaw's skill security scanner; the encoded PowerShell is a Windows process-identity probe; the very long line is a base64 Ogg test clip. The 125 bare-IP URLs are tests plus Tailscale's local API at 100.100.100.100.
• scripts/install.sh, the curl | bash installer, is 3,855 lines. It can call sudo to install Node.js through your package manager or NodeSource, and it adds OpenClaw to PATH in your shell profile. Five npm lifecycle scripts run on a source install, including a postinstall that sets up bundled plugins.
• 14 known advisories across 2,735 packages, low for a project this size. The two criticals (the sandbox package) are in .github/release/vercel-cli, release tooling that never ships; the main pnpm lockfile of 1,724 packages has two highs (braces, http-cache-semantics); the rest are unmaintained-crate notices in the Linux app's Tauri build.
• 111 workflows. Five use pull_request_target and none checks out the pull request, and all 76 third-party actions are pinned to commits, which is rare. Security policy, Dependabot, CodeQL, licence and contributing guide all present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 11.2M, Markdown 504.4K, Swift 449.9K, Kotlin 257.5K, JavaScript 186.8K, JSON 185.5K.

Questions

Is OpenClaw free?

Yes. OpenClaw is MIT-licensed and the Foundation has no paid tier, hosted service or token. What costs money is the model: you connect your own Anthropic, OpenAI or other provider account and pay its usage, or run a local model at no API cost.

Is OpenClaw safe to run?

It is as safe as the permissions you give it. By default tools run on the host for your own session, so an agent that is tricked by a message or a bad skill can act with your user account. Unknown senders must be approved with a pairing code, and sandboxing is available. Treat ClawHub skills like any third-party code and read them before installing.

What is the difference between OpenClaw and Hermes Agent?

Both are self-hosted agents you reach through chat apps. OpenClaw centres on a Gateway with many channels, companion device apps and a plugin and skill registry. Hermes Agent, from Nous Research, focuses on a learning loop that writes and refines its own skills, and ships a hermes claw migrate command to import OpenClaw settings, memories and skills.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.