Openclaw

Why it's ranked here

The integration job here is genuinely hard: around thirty messaging platforms, device pairing, sessions, scheduled jobs, memory, and MCP both served and consumed, delivered as MIT-licensed code held by a non-profit foundation rather than a shim in front of a hosted product. The OpenAI-compatible endpoints mean existing frontends work without a bespoke adapter, and declared schema numbers imply a real migration path rather than ad-hoc upgrades. The documentation reads like operational runbooks, down to port precedence tables and upgrade ordering for device fleets.

What's good

The privilege model is worked out much further than usual for a self-hosted assistant. Command approvals build a canonical run plan before the human signs off, then execute that stored plan rather than any later edited command or working directory, and bind a single concrete file operand, refusing outright when one cannot be identified. Approval scope escalates by command class, up to a distinct administrator level for host execution. One safety check, refusing to manage a user service when a same-named system daemon exists, fails closed with no force flag. The docs even carry metadata telling agents when each page is worth reading.

Tradeoffs

Surface area is the cost. The command-line tool documents more than forty top-level commands before plugins add their own, and the list of files published to the package registry is a hand-maintained deny-list of several hundred entries, a lot of manifest to keep correct. By default, tools run directly on the host for the main session unless you configure sandboxing, so the out-of-the-box posture for a channel strangers can message is host execution. The recommended install pipes a remote script into a shell, and the docs list separate workarounds for several package-manager versions, a sign of how much the install path leans on lifecycle scripts.

How to use it well

Treat it as an operator tool with a security boundary, not an appliance. Keep the gateway bound to the local machine and reach it over a private network or SSH tunnel; inside a detected container the default binding opens to all interfaces, so check that case. Supply the access token through the environment rather than a config file, and configure sandboxing before connecting any channel unknown senders can reach. Run one gateway per machine even when hosting several agents; if you must run more, give each its own port, config and state. Telegram is the easiest first channel, needing only a bot token and no plugin install.

Observed

License

MIT, declared in the package manifest

Governance

Authored by the OpenClaw Foundation, a non-profit

Packaging

Published to npm; building from source uses a pnpm workspace, and plain npm install at the repository root is documented as unsupported

Interfaces

CLI, browser control UI, terminal UI, paired devices over WebSocket, and an OpenAI-compatible HTTP API

Gateway auth

Required by default; token or password, supplied via config or environment variables