OpenClaw
OpenClaw Foundation · openclaw.ai
OpenClaw is an MIT-licensed, self-hosted runtime whose state lives on the owner's hardware in Markdown, JSON5 and SQLite, with a single-command backup, Git-versioned state snapshots, local-model support and host-enforced approval and tool policies. Its bundled Reef channel gives the agent a portable key, signed messages and receipts that both sides record. It scores strongly on portability, transparency, modifiability and control. Actions still proceed when the best-effort audit write fails, tamper evidence covers only Reef traffic and Git backups, builds are not shown to be reproducible, and a default daily update check runs unless the owner disables it.
- MIT license, self-hosted, no paid tier or license check
- One-command backup (openclaw backup create) with verify
- Git-versioned, deterministic state snapshots (openclaw backup git)
- Memory and instructions stored as editable Markdown
- Local model support (Ollama, LM Studio, vLLM)
- Host-enforced exec approvals, tool policy and DM pairing/allowlists
- Signed, key-pinned agent-to-agent messaging over Reef
- Usage statistics opt-in; content goes only to configured providers
- Audit ledger is best-effort and metadata-only; actions proceed when a record is lost, and rows expire after 30 days
- Tamper evidence covers only Reef traffic and Git backups
- Builds not shown to be byte-for-byte reproducible
- Full assembled system prompt not directly printable
- Daily update check on by default
- Sandboxing off by default, so agent tools can reach state files
All 34 findings
OpenClaw 2026.9.6 (released 2026-09-23); public docs at docs.openclaw.ai and the openclaw/openclaw repo as of 2026-09-27. Stewarded by the OpenClaw Foundation (501(c)(3), launched July 2026), with OpenAI among its sponsors and its lead maintainer employed by OpenAI.
Portable · Can you leave, and take the whole agent with you?
92%- P1Round-trip portability
Not restorable in one action: `openclaw backup create` immediately exports a complete archive, but `openclaw backup restore` only extracts it to a staging directory; activation means stopping the Gateway, moving assets or setting OPENCLAW_STATE_DIR, running `openclaw doctor` and reinstalling plugin dependencies.
Partial - P2Complete export
`openclaw backup create` captures config, workspace instructions and memory, per-agent SQLite session stores, credentials, device and channel keys, skills and plugin resources, with a manifest.json listing contents, so nothing that defines the agent stays with the foundation. Plugin node_modules and some transient files are left out but can be regenerated.
Pass - P3Independent execution
OpenClaw runs on Node.js under the MIT license, and a restored install needs no foundation server; the only default foundation contact is an optional update check. With a local model provider, execution can be fully local.
Pass - P4Identity continuity
The bundled Reef channel gives the agent an Ed25519 key that peers pin by fingerprint, and the key lives in the state database that `openclaw backup create` carries, so peers can verify it is the same agent after a move without the foundation. On other channels (for example WhatsApp or Telegram), continuity rests on platform accounts whose credentials also travel in the backup.
Pass - P5No kill switch
The MIT-licensed software has no license check. The foundation says it runs no paid tier or hosted service, and the default update check only reports version information. It can be turned off or pointed at a self-hosted endpoint.
Pass - P6Capability independence
Tools, channels, cron, memory and skills run in the gateway runtime and plugins, so they remain when the owner swaps providers, including to local models. Some optional features default to third-party APIs (for example OpenAI embeddings for memory search), but local alternatives are documented.
Pass
Transparent · Can you see everything the agent is, with ordinary tools?
92%- T1Open storage format
Instructions and memory are plain Markdown files, config is JSON5 (openclaw.json), and sessions, approvals and audit rows are stored in SQLite databases that ordinary tools can read.
Pass - T2No hidden instructions
The system prompt is assembled per run by open-source code from workspace files, skills and tool schemas, and `/context list|detail` shows the contributors and their sizes. It does not print the full assembled prompt, and a request for a view-system-prompt command was closed as not planned.
Partial - T3No shadow memory
The foundation runs no hosted service for the agent. State, memory and credentials stay on the owner's hardware, and opt-in usage statistics are aggregate counts, not content. Model providers the owner configures are subject to their own data policies.
Pass - T4Complete action history
Session transcripts, including tool calls and results, are kept locally in the per-agent SQLite store, can be listed with `openclaw sessions --json`, are archived as JSONL after 30 days by default, and are included in `openclaw backup create`.
Pass - T5Readable logic
Skills are SKILL.md Markdown files with YAML frontmatter, plugins are TypeScript/JavaScript packages, and the runtime itself is open source.
Pass - T6No third-party influence channel
No advertising or sponsored-content channel is documented. Third-party skills and plugins, including those from ClawHub, reach the context only when the owner installs them, and the owner can inspect or remove them and set an install policy.
Pass
Auditable · Can you reconstruct exactly what the agent did?
70%- A1No unrecorded actions
Tool calls and results are stored durably in session transcripts, and the audit ledger records runs and tool actions, but nothing blocks an action whose record cannot be written: the docs state that queue saturation, storage failure or a crash can drop audit records without aborting the run.
Partial - A2Tamper evidence
Reef agent-to-agent traffic is kept in a hash-chained local audit, and opt-in `openclaw backup git` snapshots commit database contents, including transcripts and audit rows, to Git history, against which later edits show up. Otherwise the audit ledger and live transcripts can be edited or deleted without trace, and ledger rows expire after 30 days.
Partial - A3Separation from the audited
Sandboxing is off by default, so the main session's tools run on the host and can reach the state database, and the `sessions` tool can delete other sessions. With sandboxed tool execution and a tool policy that denies host exec and session management, the agent cannot reach its own records.
Partial - A4Readable with ordinary tools
Audit records and transcripts are SQLite rows, readable with standard SQLite tools as well as through `openclaw audit`, and archived transcripts are JSONL.
Pass - A5Corroborated interactions
On the Reef channel, envelopes carry message IDs and body hashes, recipients return Ed25519-signed receipts, and both sides log them in hash-chained audits, so two agents' records can be matched. The general audit ledger replaces platform message IDs with installation-local pseudonyms, so exchanges over other channels cannot be matched that way.
Pass
Verifiable · Can you prove the agent runs what it claims?
80%- V1Open, reproducible runtime
The runtime is MIT-licensed, and releases carry registry signatures and Sigstore provenance through a public release ledger. Community reports show that at least one npm release could not be reproduced byte-for-byte from source.
Partial - V2Active config is inspectable config
Runtime behavior is driven by the local openclaw.json (plus documented environment variables), exec approvals in local SQLite, and workspace files. All of these are on disk, and `openclaw security audit` reports drift from defaults.
Pass - V3Attributable messages
Messages sent over Reef are signed with the agent's Ed25519 key, which peers pin and which moves with a backup, and the optional Nostr channel signs with an owner-held key. Messages on other channels (for example WhatsApp, Telegram or Discord) carry only the platform account's attribution.
Pass - V4Independently checkable record
OpenClaw checks the Reef audit chain with open-source code, and `openclaw backup git verify` plus standard Git tooling check the integrity of backed-up history. The main audit ledger and live transcripts have no integrity check beyond SQLite's structural ones.
Partial - V5Comparable state
`openclaw backup git` writes deterministic per-table JSONL dumps of every database to a Git repository and reports `no changes` when content is unchanged, and new workspaces are initialized as Git repositories. Comparing two commits shows whether and how state changed.
Pass
Modifiable · Can you change anything, without asking?
100%- M1Instructions
Owner-level instructions (AGENTS.md, SOUL.md, USER.md, IDENTITY.md) are editable files. The built-in prompt sections live in open-source code and can be changed through the before_prompt_build hook or by modifying the MIT-licensed source.
Pass - M2Memory
Memory is stored in Markdown files (MEMORY.md, memory/YYYY-MM-DD.md) that the owner can edit or delete directly, and a forget command is also available. The search index is derived from these files.
Pass - M3Logic
Owners can write and override skills at the workspace or personal level, add plugins, and modify the open-source runtime.
Pass - M4Tools and permissions
Tools can be added through plugins and skills, and scoped with global or per-agent tools.allow and tools.deny lists, profiles and sandbox settings, all enforced before the model call.
Pass - M5Model choice
OpenClaw supports many hosted providers and local runtimes (Ollama, LM Studio, vLLM), and its tools and skills belong to the runtime rather than the model. Reasoning and tool-use quality will vary by model.
Pass - M6No gatekeeping
Modification requires no license, paid tier or foundation approval, and the foundation says no paid tier exists. Install policies for third-party skills are set by the owner.
Pass
Controllable · Is your word final?
83%- C1Communication boundaries
The gateway enforces DM pairing, allowlist or disabled modes, and Reef accepts only pinned, approved peers. Cross-conversation sends can be restricted through tools.message.crossContext but are allowed by default, and open issues report gaps, such as an agent being able to send through another agent's channel account.
Partial - C2Approval gates
Exec approvals (deny, allowlist, ask or full modes) are enforced by the execution host before a command runs, not by the model, and they stack on top of tool policy.
Pass - C3Immediate halt
The `/stop` chat command aborts the current run, and the owner can stop the gateway process or service at any time.
Pass - C4Data sovereignty
Anonymous usage statistics are opt-in, OpenTelemetry export is off by default, and conversation content goes only to providers the owner configures. A daily update check that sends version, OS and runtime details is on by default until the owner disables it.
Partial - C5Credential custody
API keys, OAuth tokens and channel credentials are stored locally under ~/.openclaw (the credentials directory and per-agent auth profiles), included in `openclaw backup create`, and can be rotated by the owner.
Pass - C6Full deletion
`openclaw uninstall --all` removes the service, state (including device keys and credentials) and workspace. The foundation holds no copy of the agent, although data already sent to model or channel providers falls under their retention policies.
Pass
Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.