Claw Documentation

#Overview

Claw is a multi-tenant bot management platform that provisions and manages OpenClaw Docker containers on a remote server. It provides a web dashboard for connecting Telegram bots, spinning up isolated AI assistant instances, configuring LLM providers, managing backups, and monitoring container health.

OpenClaw is an open-source, self-hostable personal AI assistant framework. It runs as a Node.js application providing a gateway service that bridges messaging platforms (Telegram, Discord, WhatsApp, Slack, Signal) with large language models (LLMs). Each OpenClaw instance is an autonomous AI agent with its own workspace, memory, skills, and configuration.

Architecture

#Getting Started

Setting up your first AI-powered Telegram bot takes just a few minutes:

#OpenClaw Installation

While Claw handles container provisioning automatically, understanding OpenClaw's standalone installation helps with debugging and manual configuration.

Requirements

• Node.js 22+ (24 recommended)
• 512MB RAM minimum (1GB+ recommended)
• ~200MB disk space
• macOS, Linux, or Windows (WSL2 recommended for Windows)

Install via npm

npm install -g openclaw@latest

Verify Installation

openclaw --version

Run Onboarding Wizard

openclaw onboard
# Guides you through:
# - AI model provider selection
# - API key entry
# - Messaging channel setup
# - Configuration review

Start the Gateway

openclaw up          # Start in foreground
openclaw up -d       # Start in background (daemon)
openclaw dashboard   # Open web dashboard

Docker Installation

Claw uses the official Docker image for containerized deployments:

# Pull the official image
docker pull ghcr.io/openclaw/openclaw:latest

# Or build from source
git clone https://github.com/openclaw/openclaw
cd openclaw
docker build -t openclaw:local -f Dockerfile .

#Claw Platform Features

#Container Management

Each bot's OpenClaw instance runs in an isolated Docker container with the following resource limits:

Container Lifecycle

Port Allocation

Each container gets two ports: a gateway port (mapped from container port 18789) and a bridge port (gateway + 1). Ports are deterministically derived from the bot ID using an MD5 hash within a configurable range (default: 19000–20000).

#Management Panel

Click the “Manage” button on any running bot card to access 8 advanced management features:

#OpenClaw Configuration

OpenClaw is configured via openclaw.json (JSON5 format) located at ~/.openclaw/openclaw.json inside the container.

Key Configuration Sections

Example openclaw.json

{
  "gateway": {
    "mode": "local",
    "port": 18789,
    "bind": "lan",
    "auth": { "token": "your-gateway-token" },
    "controlUi": {
      "dangerouslyDisableDeviceAuth": true
    }
  },
  "models": {
    "default": "openrouter/nvidia/llama-3.1-nemotron-70b-instruct:free"
  },
  "channels": {
    "telegram": {
      "enabled": true,
      "dmPolicy": "pairing"
    }
  }
}

CLI Config Commands

openclaw config get gateway.port
openclaw config set gateway.bind lan
openclaw config set models.default "openrouter/nvidia/llama-3.1-nemotron-70b-instruct:free"
openclaw doctor --fix          # Validate and fix config

#Workspace Files

OpenClaw agents are defined by Markdown files in the workspace directory (~/.openclaw/workspace/). These files form the agent's “brain.”

#Skills & Tools

OpenClaw differentiates between tools (what the agent can do) and skills (how the agent combines tools for specific tasks).

Core Tools

Skill Examples

Installing Skills

# Via ClawHub CLI
clawhub install <skill-slug>
clawhub update --all

# Manual: place skill folder in
$HOME/.openclaw/skills/      # Shared across agents
<workspace>/skills/          # Per-agent (highest precedence)

#Slash Commands

Slash commands provide direct control over the agent during a conversation. Send them as standalone messages or embed some inline.

#Messaging Channels

OpenClaw supports multiple messaging platforms. Configure them in the channels section of openclaw.json or via the Channels tab in the management panel.

Telegram (Primary)

The primary channel for Claw. Token is provided via @BotFather. Key settings include:

Other Channels

#Agents

OpenClaw supports multiple agents, each with its own workspace, model, and routing rules.

Agent CLI Commands

openclaw agents list              # List all agents
openclaw agents list --bindings   # Show routing rules
openclaw agents add work --workspace $HOME/.openclaw/workspace-work
openclaw agents bind --agent work --bind telegram
openclaw agents unbind --agent work --bind telegram
openclaw agents delete old-agent --force
openclaw agents set-identity --agent main --name "MyBot" --emoji "🤖"

#Security

Claw Platform Security

• Token Encryption: Bot tokens are encrypted with AES-256-GCM using PBKDF2-derived keys before storage
• TLS Docker API: Mutual TLS with CA, client cert, and client key for Docker API communication
• Session Auth: NextAuth.js with JWT sessions, CSRF protection, and secure cookies
• Admin Approval: New user accounts require admin approval before full access
• API Key Masking: LLM API keys are masked in API responses (first 6 + last 4 chars only)

OpenClaw Security

• Gateway Token: 256-bit random token for authenticating to the OpenClaw control UI
• DM Policy: Use pairing or allowlist to restrict who can message the bot
• Group Policy: Use requireMention: true to prevent the bot from responding to all messages
• Sandbox: Tool execution can be isolated in Docker sub-containers
• Security Audit: Run openclaw security audit --fix to check for vulnerabilities

#Troubleshooting

Common Issues

Diagnostic Commands

openclaw doctor                    # Quick health check
openclaw doctor --fix              # Validate schema + auto-fix
openclaw doctor --deep --yes       # Full diagnosis + fixes
openclaw status --all --deep       # Full system status
openclaw logs --follow             # Tail gateway logs
openclaw channels status --probe   # Check channel health
openclaw security audit --fix      # Security audit

#Use Cases