Open Source

Your AI agents. Working together.

Install multiple agents, they collaborate automatically.
Self-hosted. Docker-isolated. Agentic by design.

Terminal

"RIP OpenClaw."

How to deploy a secure, autonomous AI agent available on all your devices — in 60 seconds

600K+ watched the original setup. We made it 1-click.

Auto Mode

All your agents work together. Automatically.

Install multiple agents and they collaborate as one. No manual switching. The right agent handles each request — and tells you which one answered.

Telegram

You

Summarize my unread emails and check HN for AI news

seclaw

Inbox

3 urgent, 7 action needed, 12 FYI. Top urgent: contract review from legal (deadline tomorrow).

Hacker News

Top AI stories: Anthropic launches Claude 4.5, Google open-sources Gemma 3, OpenAI restructures.

— Inbox Management, Research & Intelligence

You

Any new leads from that Anthropic announcement?

seclaw

Scanning X for buying signals around "Claude 4.5"... Found 3 leads scoring 8+. Drafts saved to /shared/outreach/drafts/.

— Sales & Lead Generation

1

Install agents

npx seclaw add inbox-agent
Each template stacks onto your base agent. No conflicts.

2

Auto-route

The LLM picks the right capability for each message. Email questions go to Inbox. Lead questions go to Sales.

3

Attribution

Every response shows which agent answered. You always know who did what.

Optional: Focus Mode

Use /templates in Telegram to focus on a single agent. Auto mode is the default.

Auto (all)InboxResearchSales

Smart integration detection

When an agent needs an integration that isn't connected, it generates an OAuth link and sends it directly in chat. No manual setup. No /integrations command needed.

seclaw

I need X (Twitter) connected to scan for leads. Authorize X (Twitter)

Open the link, sign in, and grant access. After completing authorization, your new tools load automatically.

Why we built seclaw

OpenClaw has serious security holes

68K+ stars on GitHub. Zero container isolation. Your API keys, SSH keys, and browser cookies — all accessible to any tool the agent decides to install.

API keys exposed to MCP servers

Critical

OpenClaw passes all environment variables to every MCP container. Your Anthropic key, Stripe key, database credentials — all visible to any tool the agent installs.

env_file: .env # every secret, every container

No filesystem isolation

Critical

The agent has full read/write access to your entire home directory. It can read ~/.ssh/id_rsa, ~/.aws/credentials, browser cookies, and anything else on your machine.

volumes: ~/:/host # your entire home directory

Containers run as root

High

MCP containers run with full root privileges. Combined with host mounts, this means the agent can modify system files, install backdoors, or escalate to host root.

# no user directive, no cap_drop, no read_only

No action confirmation

High

OpenClaw has a "permissions" system, but it's enforced in the prompt — not in the runtime. A jailbroken agent can ignore all rules and send emails, delete files, or post on your behalf.

# "Please don't do bad things" — in the system prompt

Inbound ports open to internet

Critical

OpenClaw exposes n8n on port 5678 with no authentication. Anyone who finds your IP can access your workflow editor, see your credentials, and modify your agent.

ports: 5678:5678 # open to the world

No resource limits

Medium

No memory or CPU limits on any container. A runaway agent or cryptominer can consume all system resources, crash your machine, or mine crypto on your hardware.

# no deploy.resources.limits — infinite resources

These aren't theoretical — they're in the default docker-compose.yml that 68K+ people cloned.

Security model

Hard guardrails, not suggestions

OpenClaw enforces rules in the system prompt. We enforce them in Docker. One can be jailbroken. The other can't.

Your agent can't:

  • Can't access your API keys

    Keys live in the agent's env only. MCP containers have zero access to secrets.

    env isolation per container
  • Can't modify its environment

    Filesystem is immutable. The agent can't install backdoors or modify its own code.

    read_only: true
  • Can't access folders you haven't shared

    Only the /workspace mount is visible. Your home directory, SSH keys, and browser data are invisible.

    explicit volume mounts only
  • Can't escalate privileges

    Zero Linux capabilities. Can't become root, can't mount filesystems, can't access raw network.

    cap_drop: ALL + no-new-privileges
  • Can't use unlimited resources

    512MB RAM, 1 CPU core. A runaway agent or cryptominer gets killed, not your machine.

    deploy.resources.limits
  • Must get your confirmation

    Sending emails, posting on social media, deleting files — all require explicit approval via Telegram.

    permissions.yml whitelist

But it can still:

  • Reply to your Telegram messages
  • Read and write to /workspace files
  • Access Gmail, Drive, Notion, Linear via Composio
  • Run scheduled tasks via Inngest (cron + timezone)
  • Pause and wait for your Telegram approval (HITL)
  • Execute terminal commands (sandboxed)
  • Learn from past interactions (memory buffer)
  • Wake up regularly and do overnight work

The goal: maximum capability within minimum attack surface. Your agent does real work — it just can't escape its sandbox.

Side-by-side comparison

Every row is a real security boundary. Green means it exists. Red means it doesn't.

Security BoundaryOpenClawseclaw
Container isolationNone — shared envPer-container with bridge networks
API key protectionAll keys in every containerEnv-only, sealed per service
Filesystem accessEntire home directory/workspace mount only
Root privilegesRunning as rootNon-root + cap_drop ALL
Permission enforcementPrompt-based (bypassable)Runtime guardrails (permissions.yml)
Network exposurePort 5678 open to internetZero inbound via CF Tunnel
Resource limitsNone (infinite)512MB / 1 CPU per container
Filesystem mutabilityFull read/writeread_only: true + tmpfs
Setup time30+ minutes manual config60 seconds via CLI

How it works

The stack behind seclaw

Every component is open source. Every container is isolated. Your data never leaves your machine.

# Your machine

agent-net (internal network)

agent— Telegram + LLM + Composio + MCP Client
inngest— cron schedules, retries, human-in-the-loop
desktop-commander— MCP, read_only, cap_drop ALL
cloudflared— outbound-only tunnel, zero open ports
--->Telegram(via Cloudflare Tunnel)

Agent Runtime

Node.js

Lightweight Node.js server with Telegram Bot API, OpenAI SDK (multi-provider), and Composio for integrations. No framework overhead — just a single agent.js handling webhooks, LLM calls, and tool execution.

Inngest

Scheduler

Self-hosted workflow engine for scheduled tasks. Cron with timezone support, step-level retries, and human-in-the-loop approvals via Telegram. Dashboard at localhost:8288. Free forever.

Gemini 3 Flash

LLM

Default: Gemini 3 Flash via OpenRouter — fast, affordable, excellent tool use. Or switch to Claude, GPT-4o, Gemini Pro, and 100+ other models. One env variable change.

Desktop Commander

MCP Server

Gives your agent file read/write and terminal access — inside a locked-down container. read_only filesystem, zero Linux capabilities, 512MB limit. The agent can work, but can't escape.

Composio

Integrations

Managed OAuth for Gmail, Google Calendar, GitHub, Slack, Notion, Linear, and more. Your agent never sees raw credentials — Composio handles token refresh and API auth.

Cloudflare Tunnel

Secure Access

Access your agent from anywhere — phone, laptop, any device. Outbound-only connection: zero inbound ports. No firewall rules. No exposed IPs. Auto-created by CLI in 30 seconds.

Why Inngest for scheduling?

Self-hosted, free forever

No cloud fees, no execution limits. Runs as a single Docker container with SQLite storage. Dashboard included.

Human-in-the-loop

Scheduled actions can pause and wait for your Telegram approval before executing. Approve or reject with one tap.

Durable execution

Each step retries independently. If the LLM call fails, it retries without re-fetching data. No lost work.

Zero inbound ports with Cloudflare Tunnel

Without tunnel

Port 3000 open to the internet. Anyone who finds your IP can send requests to your agent. Port scanning bots find these in hours.

With Cloudflare Tunnel

Zero open ports. Your server makes an outbound connection to Cloudflare's edge. Access via your custom domain with Cloudflare Access for authentication. Auto-created by our CLI in 30 seconds.

Built-in tools

16 tools, zero config

Every agent ships with workspace management, scheduling, human-in-the-loop, and smart integration detection. No MCP required. No external services. Just tell your agent what to do.

Structured workspace

Every agent gets a persistent workspace at /workspace. Data persists across restarts and conversations.

🧠memory/

Persistent learnings about you — name, preferences, habits, language

tool: update_memory

tasks/

TODOs and action items with priority levels and due dates

tool: create_task

📝notes/

Quick thoughts, ideas, meeting notes, links

tool: save_note

📊reports/

Research results, daily digests, analysis summaries

tool: save_report

📨drafts/

Draft emails, messages, and documents to review before sending

tool: save_draft

⚙️config/

Schedules, capability settings, and system configuration. Managed automatically.

system-managed

workspace
$ ls /workspace
memory/   tasks/    notes/    reports/  drafts/  config/

$ cat memory/learnings.md
- [2026-02-13] User prefers Turkish
- [2026-02-13] User name is Mert
- [2026-02-14] Morning reports should include calendar

$ ls tasks/
review-contract.md  prepare-demo.md  update-docs.md

Scheduling & automation

Reminders, delayed actions, recurring schedules, and human-in-the-loop confirmations.

ToolWhat it does
send_delayed_messageSend a Telegram message after a delay
schedule_actionExecute any action after a delay with full agent capabilities
request_confirmationApprove / Reject buttons with human-in-the-loop execution
create_scheduleCreate a new recurring cron schedule
toggle_scheduleEnable or disable a schedule without deleting
trigger_schedule_nowManually run a scheduled task right now
connect_integrationGenerate OAuth link for a missing integration and share it in chat
list_files

List files in any workspace directory. "Show me my tasks" returns all open TODOs.

read_file

Read any workspace file. "Read my latest report" opens the most recent analysis.

All tools use direct filesystem access — no Desktop Commander MCP dependency. They work even if external services are completely offline.

Powered by Composio

250+ integrations. Zero credential management.

Gmail, Google Calendar, GitHub, Slack, Notion, Linear, Trello, Dropbox, WhatsApp, and more — all via managed OAuth. No raw API keys, no token files.

01Connect
npx seclaw integrations

OAuth in your browser. No raw API keys.

02Authorize
# Composio handles OAuth

Scoped permissions. Automatic token refresh.

03Use
"Summarize my unread emails"

Agent auto-discovers tools. Just ask in Telegram.

Managed OAuth

Tokens never touch your machine

Auto refresh

Zero credential maintenance

Scoped access

Per-integration permissions

Hot reload

Add integrations without restart

Setup in 60 seconds

Three steps. That's it.

1

Run the CLI

npx seclaw

Pick a template, enter your LLM provider and Telegram token. The CLI scaffolds Docker Compose, permissions, and Cloudflare Tunnel.

2

Start the stack

docker compose up

Agent, Inngest scheduler, Desktop Commander, and Cloudflare Tunnel — all start in isolated containers.

3

Message your bot

Open Telegram

Your agent is live. Scheduled tasks run automatically, integrations are connected, and every action is sandboxed.

npx seclaw

One-time purchase. Forever yours.

No subscriptions. Self-hosted. Your data stays on your machine.

17 agent templates from Free to $149

2 free templates included. 15 paid templates, one-time purchase.

Browse All Templates

Your only real cost: LLM API

Everything else is free — Docker, Inngest, Cloudflare Tunnel, Telegram, Composio free tier.

~$6

/month — Haiku only

~$3-10

/month — Gemini 3 Flash (default)

~$100+

/month — Opus heavy