High-performance system monitor built for the OpenClaw ecosystem.

ClawGuard is a lightweight C++ daemon that continuously monitors your system's health and integrates natively with OpenClaw. Ask your bot "how's my system doing?" and get real answers with trend analysis and proactive alerts.

If you run OpenClaw on a Mac Mini, home server, or VPS, you need to know:

• Is my system healthy? CPU, memory, disk, network at a glance
• Is something going wrong? Proactive alerts before things break
• What's the trend? Memory leak detection, CPU trending, disk fill rate
• What's eating resources? Top processes by memory and CPU

Other monitoring tools are bloated Python scripts that eat the resources they're supposed to monitor. ClawGuard is written in C++ — it uses <1% CPU and <5MB RAM while running 24/7.

# Build locally
git clone https://github.com/YOUR_USERNAME/clawguard.git
cd clawguard
make

# Install (user-level, no sudo) + auto-start + OpenClaw skill
bash ./scripts/install.sh

Open http://localhost:7677 for the live dashboard.

curl -fsSL https://raw.githubusercontent.com/YOUR_USERNAME/clawguard/main/scripts/install.sh | bash

ClawGuard was built for OpenClaw. Install the skill:

# Auto-detected during ./scripts/install.sh, or manually:
mkdir -p ~/.openclaw/workspace/skills
cp -r skill/clawguard ~/.openclaw/workspace/skills/

Bot-first setup guide:

• skill/clawguard/BOT_PLAYBOOK.md
• offers Manual, Assist, and Autopilot autonomy modes and adapts by host profile

Now you can ask your OpenClaw bot:

• "How's my system doing?"
• "Is anything wrong with my server?"
• "What's eating my RAM?"
• "How's my CPU trending?"
• "How much disk space do I have left?"

ClawGuard writes alerts to ~/.clawguard/alerts.txt. Configure a cron job in OpenClaw to check it:

"Check ~/.clawguard/alerts.txt every 15 minutes. If there are WARNING or CRITICAL alerts, let me know on Telegram."

Edit ~/.clawguard/config.ini:

# Monitoring
mode = readonly
poll_interval_sec = 5
history_max_minutes = 1440
http_port = 7677
http_bind = 127.0.0.1
allow_remote_http = false
api_auth_token =
api_rate_limit_enabled = true
api_rate_limit_per_min = 120
port_scan_interval_sec = 60

# Security posture checks
security_scan_interval_sec = 60
openclaw_config_file = /Users/you/.openclaw/openclaw.json
integrity_baseline_file = /Users/you/.clawguard/integrity-baseline.txt

# Experimental containment (default-off)
containment_enabled = false
containment_shadow_mode = true
containment_auto_soft_actions = false
containment_auto_hard_actions = false
containment_require_user_approval_for_hard = true
containment_block_ttl_sec = 900
containment_max_actions_per_hour = 6

# Alert Thresholds
cpu_warn_pct = 80
cpu_crit_pct = 95
mem_warn_pct = 80
mem_crit_pct = 95
disk_warn_pct = 85
disk_crit_pct = 95

# OpenClaw Integration
openclaw_alerts = true

Rebuild integrity baseline after expected config/skill changes:

CLAWGUARD_REBASELINE=1 ./clawguard

Experimental containment notes:

• mode = readonly is a hard monitor-only gate and disables containment execution.
• Start with containment_enabled = true and containment_shadow_mode = true.
• Review simulated actions in GET /api/containment before enabling enforcement.
• Keep hard actions approval-gated unless user explicitly opts in.
• block_port shell-command execution is disabled in v1.0 for safety.

Remote API notes:

• Default is local-only (http_bind = 127.0.0.1).
• Non-loopback bind is refused unless allow_remote_http = true.
• When remote bind is enabled, api_auth_token is required and must be sent as:
  • Authorization: Bearer <token> or
  • X-API-Key: <token>
• API rate limiting is enabled by default (api_rate_limit_per_min = 120 per client).
• Dashboard responses include a restrictive Content Security Policy (CSP).

Publisher flow:

# requires MINISIGN_SECRET_KEY, MINISIGN_PUBLIC_KEY, CLAWGUARD_PUBLISHER_ID
./scripts/release/sign_release.sh dist

User verification flow:

./scripts/release/verify_release.sh dist

Required signing inputs for publishers:

• MINISIGN_SECRET_KEY=/path/to/minisign.key
• MINISIGN_PUBLIC_KEY=/path/to/minisign.pub
• CLAWGUARD_PUBLISHER_ID=clawguard.net (or your stable publisher identity string)

Optional stricter verification for users:

• CLAWGUARD_EXPECTED_PUBLISHER_ID=clawguard.net ./scripts/release/verify_release.sh dist

# Sign only (Developer ID)
APPLE_CODESIGN_IDENTITY="Developer ID Application: Your Name (TEAMID)" \
./scripts/release/macos_sign_and_notarize.sh ./clawguard

# Sign + notarize (when notary profile is configured)
APPLE_CODESIGN_IDENTITY="Developer ID Application: Your Name (TEAMID)" \
APPLE_NOTARY_PROFILE="clawguard-notary" \
APPLE_TEAM_ID="TEAMID" \
./scripts/release/macos_sign_and_notarize.sh ./clawguard ./clawguard.notarized.zip

User-side macOS provenance check:

./scripts/release/macos_verify_provenance.sh ./clawguard

# Linux (systemd user service, installed automatically by scripts/install.sh)
systemctl --user status clawguard

# macOS (launchd user agent, installed automatically by scripts/install.sh)
launchctl list | rg clawguard

┌──────────────────────────────────┐
│         ClawGuard Daemon         │
├──────────┬───────────┬───────────┤
│ Collector│  History  │  Alerts   │
│ (C++ OS  │ (Ring Buf)│ (Engine)  │
│  APIs)   │ 24h data  │ + Trends  │
├──────────┴───────────┴───────────┤
│          HTTP Server             │
│   JSON API  +  Web Dashboard     │
├──────────────────────────────────┤
│       OpenClaw Skill Layer       │
│  SKILL.md  +  alerts.txt file    │
└──────────────────────────────────┘

• Collector: Reads /proc (Linux) or Mach APIs (macOS) directly — no shell commands for core metrics
• History: Lock-free ring buffer holding 24h of 5-second samples (~17K snapshots)
• Alerts: Threshold evaluation with 5-minute cooldown, writes to file for OpenClaw
• HTTP: Minimal embedded server, no dependencies, serves JSON API + single-page dashboard
• Footprint: Single static binary, no runtime dependencies, <5MB RAM

Requirements: g++ with C++17 support, make

make              # Build
make clean        # Clean
sudo make install # Install to /usr/local/bin

Or with CMake:

mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make

Proprietary commercial license. See LICENSE for details.

Built with 🦞 for the OpenClaw community.