• Open-source (MIT), self-hosted Node.js gateway
• 17+ messaging channels: WhatsApp, Telegram, Discord, Slack, iMessage, Signal, Teams...
• Not just chat — can execute tools: browse web, run code, control devices, schedule tasks
• Multi-agent orchestration with per-agent policies

• Austrian tech founder, Vienna & London
• Built PSPDFKit — PDF framework used by ~1 billion people
• Sold for >$100M to Insight Partners (2021)
• 3-year sabbatical, tried 43 projects before OpenClaw
• Started as a weekend side project, Nov 2025
• Philosophy: "I ship code I don't read"

Codebase by Language

A single always-on Node.js process that orchestrates everything:

• HTTP/WebSocket server on configurable port
• Channel connection lifecycle management
• Agent session state & run coordination
• Plugin loading & hot-reload
• Cron scheduler for automated tasks
• mDNS/Bonjour discovery for device nodes
• TLS & Tailscale integration

Startup Sequence

// gateway/server.impl.ts
1. loadConfig()      // Zod validate
2. loadPlugins()     // Extensions
3. createChannelMgr() // Init channels
4. attachWsHandlers() // WebSocket
5. startCron()       // Scheduled jobs
6. startDiscovery()  // mDNS broadcast
7. startBrowser()    // CDP bridge

The "Dock" Abstraction

Each channel provides a ChannelDock — a lightweight adapter defining:

• Capabilities: threading, reactions, file types
• Chunking: Telegram/WA = 4000 chars, Discord = 2000
• Mention gating: Group activation rules
• Config readers: Channel-specific settings
• Allowlist formatters: Per-platform ID schemes

Hierarchical Matching

When a message arrives, routing resolves which agent handles it:

DM Scope Modes

Access Policies

runEmbeddedPiAgent() — the core execution engine for every agent session:

• Model selection & context window validation
• Auth profile rotation on API failures
• Context auto-compaction when window fills
• Thinking level fallback for unsupported models
• Rate limit handling with intelligent backoff
• Token usage tracking across all retries
• Tool result truncation for oversized outputs

Resilient Retry Loop

// Simplified agent run logic
while (!done) {
  try {
    result = await runAttempt(payload);
  } catch (e) {
    if (isAuthError(e))
      rotateAuthProfile();
    else if (isContextOverflow(e))
      compactSession();
    else if (isRateLimit(e))
      await backoff();
    else if (isThinkingUnsupported(e))
      fallbackThinkingLevel();
    else throw e;
  }
}

The system prompt is built dynamically from multiple sources:

Three Prompt Modes

Built-in Tool Categories

Policy Hierarchy

Group Shortcuts

Exec Security Levels

Exec Host Targeting

// Where commands run:
host: "sandbox"   // Docker container
host: "gateway"   // Host machine
host: "node"      // Paired device

Supported Providers

Auth Profile System

Multiple API keys per provider with automatic rotation:

• api_key — Standard API key auth
• oauth — OAuth2 flow (Google)
• token — Bearer token (Copilot)
• aws-sdk — AWS Bedrock

Session Management

• Sessions stored as JSONL transcripts
• Location: ~/.openclaw/agents/{id}/sessions/
• Token tracking for context window management
• Auto-compaction when context fills up

Reset Policies

Memory System

• LanceDB vector embeddings for semantic search
• QMD (Quarto Markdown) backend for structured knowledge
• Tools: memory_search, memory_get
• Injected into system prompt with citation guidance

Per-Session Overrides

• /model — Switch LLM mid-conversation
• /think — Adjust reasoning level (off→ultra)
• /verbose — Tool output detail
• /elevated — Host execution permissions

Multi-Layer Security

• DM Policies: pairing (default), allowlist, open, disabled
• Exec Security: deny, allowlist, full
• Sandbox: Per-session Docker isolation
• Tool policies: 6-level hierarchy (slide 17)
• File system audit: ownership, permissions, setuid detection
• Skill scanner: Checks for malicious patterns
• External content validation: URL/content safety checks

Sandbox Modes

OpenClaw includes a full Chrome DevTools Protocol (CDP) browser controller:

• Bridge server: HTTP API for browser control
• Multi-profile: Separate browsing sessions
• ARIA snapshots: Accessibility tree for AI understanding
• AI snapshots: Structured page representation with refs
• Navigation: Click, type, scroll, screenshot
• Headless & headed: Both modes supported

Snapshot Formats

// ARIA format - accessibility tree
{ format: "aria",
  nodes: [
    { ref: "1", role: "link",
      name: "Sign In" }
  ] }

// AI format - structured for LLMs
{ format: "ai",
  snapshot: "[button ref=3] Submit",
  refs: { "3": { role: "button" } },
  stats: { lines: 42, refs: 15 } }

Profile Management

browserCreateProfile({ name: "work" })
browserStart({ profile: "work" })
browserStop({ profile: "work" })

Plugin SDK (plugin-sdk/index.ts)

Stable public API for building extensions:

• Channel APIs: ChannelPlugin, ChannelCapabilities
• Tool APIs: AnyAgentTool, ChannelAgentTool
• Config APIs: Schema builders, allowlist mergers
• Gateway APIs: GatewayRequestHandler
• Platform helpers: Discord, Slack, Telegram, etc.

35 Extensions

teal = channel plugins • purple = infrastructure

What is a Skill?

A folder with a SKILL.md file + supporting text. That's it.

• Injected into the system prompt as context
• Searched via embeddings (vector search)
• Support semver versioning & changelogs

Skill Types

52 Bundled Skills

Zero-Config Pairing

Companion apps extend OpenClaw to physical devices via Bonjour/mDNS:

1. Node sends node.pair.request
2. Gateway generates 6-digit pairing code
3. Owner approves via CLI
4. Persistent WebSocket established

Node Commands

openclaw nodes list
openclaw nodes describe <nodeId>
openclaw nodes pair approve <code>

Capability Matrix

Config Architecture

• Single ~/.openclaw/config.json5 file
• Full Zod schema validation on startup
• Hot-reload via file watcher (no restart)
• Runtime updates via RPC: config.get, config.patch
• Migration logic for schema upgrades
• Env var overrides: OPENCLAW_SECTION_KEY

Key Sections

Example Config

// ~/.openclaw/config.json5
{
  agents: {
    list: [{
      id: "main",
      model: "claude-sonnet-4-5",
      workspace: "~/agent-workspace",
    }],
  },
  channels: {
    telegram: {
      enabled: true,
      botToken: "env:TELEGRAM_TOKEN",
    },
    whatsapp: { enabled: true },
  },
  tools: {
    profile: "coding",
    exec: { security: "allowlist" },
  },
  gateway: {
    port: 18789,
    bind: "loopback",
  },
}

Core (The Brain)

Channels (The Spokes)

Infrastructure

Support

Top 10 Most Active Days

Prefix Distribution

Scoped Commits (Top)

AI Co-Authorship Detected

• Co-Authored-By: Claude — multiple instances
• Co-Authored-By: Claude Opus 4.5
• Co-Authored-By: Claude Opus 4.6
• Luna AI <[email protected]>
• Pip <[email protected]>
• google-labs-jules[bot] — 14 commits
• Maude Bot — 14 commits
• CLAWDINATOR Bot — 9 commits

Branch Strategy

• main — Primary development branch
• Feature branches: feat/name, fix/name
• AI branches: claude/..., codex/...
• Contributor branches: contrib/...
• CI branches: ci/...
• Dependabot for dependency updates

Release Channels

CalVer Versioning

Format: v{YYYY}.{M}.{D}[-{patch}]

v2026.2.9
v2026.2.6-3
v2026.2.6-2
v2026.2.1
v2026.1.30
v2026.1.29  // CVE patch

Press Coverage

• The Pragmatic Engineer: "I ship code I don't read"
• TechCrunch: "AI assistants building their own social network"
• VentureBeat: "What the OpenClaw moment means for enterprises"
• 1Password: "It's incredible. It's terrifying."
• 36kr: "The First Super Individual in the AI Era"
• Nature, CNBC, Fortune, The Register

Critical Issues

• 135,000+ internet-exposed instances (SecurityScorecard)
• CVE-2026-25253 — One-click RCE (CVSS 8.8)
• 341 malicious skills on ClawHub stealing data
• 335 skills installing AMOS macOS malware
• 1 in 5 orgs deployed without IT approval
• Found in healthcare, finance, government sectors

Remediation

• VirusTotal partnership for skill scanning
• ClawSec security middleware
• NanoClaw — 500 lines, fully auditable
• Skill scanner built into core
• File system auditing (ownership, perms, setuid)
• External content validation

The OpenClaw Playbook

• Ship daily. 48 releases in 81 days. Don't wait for perfection.
• Fix-first culture. 3.3x more fixes than features. Fix bugs the same day.
• One person with vision. 71% of commits from one architect who sets direction.
• Convention commits. fix(scope): message makes changelogs automatic.
• CalVer, not SemVer. Dates in versions signal freshness and velocity.

Anti-Patterns They Avoid

• No long-lived branches. Feature branches merge fast.
• No committee decisions. One architect, fast merges.
• No release ceremonies. Tag and ship, multiple times per day.
• No gatekeeping. Community PRs welcome, fast review cycle.
• No over-engineering. Start simple, iterate rapidly.

Peter's Workflow

• Claude Code as primary coding tool
• AI generates implementation; human provides architecture
• Multiple AI agents (Jules, Maude Bot) submit PRs directly
• Automated bots handle CI labeling, stale automation
• AI-authored code is reviewed at the design level, not line-by-line

Lessons for Teams

• Trust AI for implementation, verify at architecture level
• Use AI agents as contributors, not just tools
• Invest in testing & CI to catch AI-generated bugs
• Conventional commits make AI-generated messages parseable
• AGENTS.md guides both human and AI contributors

From 1 to 510 in 81 Days

• Open from day one. MIT license, public repo
• Low barrier to contribute. Skills are just markdown files
• AGENTS.md onboards both humans and AI agents
• ClawHub marketplace gives contributors visibility
• Discord community for brainstorming (the Moltbot name came from there)
• Credit contributors in changelogs: (thanks @user)

Community Stats

A Swift-based voice wake-word listener built into the monorepo:

• Listens for "clawd" (or custom wake word)
• Uses Apple Speech framework for transcription
• Triggers configured hook command with transcript
• Full CLI: serve, transcribe, doctor, tail-log
• Runs as launchd service

# Always listening for "clawd"
swabble serve

# Wake word detected, runs:
$HOOK_COMMAND "Voice: Hey, what's the weather?"

Config

// ~/.config/swabble/config.json
{
  wake: {
    word: "clawd",
    aliases: ["claude"],
  },
  hook: {
    command: "openclaw",
    args: ["message", "--agent", "main"],
    minCharacters: 24,
    cooldownSeconds: 1,
  },
}

Trends to Watch

• Agent-to-agent communication via ACP protocol
• Enterprise hardening after 135K exposed instances
• Rust reimplementation (IronClaw) for security-critical deployments
• Voice-first interfaces via Swabble + talk-voice extension
• Cloudflare edge deployment via MoltWorker
• Formal security audits post-CVE

The Bigger Picture

What

Self-hosted AI agent gateway. Lives in your messaging apps. Executes tools. Controls devices. Open source.

Who

Peter Steinberger + 509 contributors + AI agents. Built in 81 days.

How

Hub-and-spoke Node.js gateway. 45+ modules. 17+ channels. 6-layer tool policies. Zod-validated config. CalVer releases.

Why It Matters

• First AI agent framework to go truly mainstream
• Proves AI-augmented solo development works
• Created an entire ecosystem in weeks
• Exposed the security gap in AI agents
• Changed how we think about apps vs agents