OpenClaw Claw Packages Can Now Own Cron and MCP Resources on Main

OpenClaw’s experimental Claw package format can now describe and lifecycle-manage more than an agent and its files on main. Three changes merged on 22 July add portable export, Gateway-owned cron jobs, and ownership-aware MCP server declarations.

This is the point where Claws start to look like deployable agent setups rather than file bundles. A single package can describe an agent’s configuration, workspace files, exact skill and plugin versions, scheduled work, and MCP dependencies. The lifecycle tracks what the Claw created versus what it merely reused, so removal does not blindly tear down shared resources.

This cluster landed on main after 2026.7.2-beta.3. Operators considering any later package should verify that package’s release manifest instead of inferring inclusion from its version number. Regardless of packaging, the whole command surface remains explicitly experimental.

Operator decision

• Ordinary operators: do not build production automation around Claws yet. Their schema, output and lifecycle can change even when a package contains the command surface.
• Source-build evaluators: use dry-run plus integrity-bound consent, then test add, status, export and removal as one lifecycle. Cron and MCP cleanup behaviour matters as much as installation.
• Package authors: treat exports as portable agent setups, not backups. Sessions, credentials, unrelated agents and unowned state are deliberately excluded.
• Security reviewers: examine every MCP command or remote URL and every scheduled prompt in the dry-run. Packaging a capability does not make that capability trustworthy.

What changed

Cron jobs now belong to the package lifecycle

PR #102383 makes Claw-declared jobs go through the existing Gateway cron.add API. Claws do not write the scheduler store directly.

Each declaration receives a key scoped to the final agent and package-local job ID. The lifecycle records the resulting scheduler identity, exposes it in status and export, and attempts to disable recurring work before removing the agent, package or workspace state.

The important failure policy is conservative. If a scheduler write loses its response, a retry first reconciles by declaration key instead of creating another job. If removal cannot prove that recurring work was disabled, the operation records partial state and does not continue as if cleanup succeeded. A job changed after the removal plan is preserved rather than deleted from under an operator.

MCP declarations gain managed-versus-referenced ownership

PR #102406 applies package MCP declarations through OpenClaw’s validated source-configuration writer. Environment placeholders such as ${STATUSPAGE_TOKEN} remain references; resolved secret values are not copied into Claw provenance.

A collision-free declaration introduced by the first Claw is managed. An exact declaration that already existed, or one reused by another Claw, is referenced. A conflicting declaration with the same name blocks installation instead of being overwritten.

That distinction controls removal. Unchanged managed declarations are eligible for cleanup. Referenced declarations stay by default unless the operator selects them in the integrity-bound removal plan. Compare-before-unset checks preserve an MCP definition that changed after planning, and unreadable source configuration fails closed.

This is useful guardrail engineering, not process isolation. MCP servers can still expose powerful external capabilities, and plugins remain process-wide OpenClaw capabilities rather than per-agent installations.

Export creates a derivative portable package

PR #102306 adds:

openclaw claws export <agent-id> --out <new-directory> --json

The export projects portable agent fields, copies ledger-managed workspace files and safe workspace-relative avatars, and includes recorded package, cron and MCP declarations. It refuses an existing output directory or unavailable managed files.

It intentionally excludes credentials, sessions, unrelated agents, remote avatars and unowned local state. Every regenerated package receives a derivative identity and content-derived version rather than impersonating the original publisher’s package and version.

The initial merged implementation wrote grouped JSON, including openclaw.claw.json. That format has now advanced: PR #111391 merged on 23 July and makes CLAW.md the canonical human-authored and exported form while preserving grouped JSON input compatibility.

CLAW.md begins with YAML frontmatter validated by the same strict v1 schema. Duplicate keys, unsafe aliases and package-root escapes are rejected; development-snapshot integrity continues to bind the original source bytes. Export now writes package.json pointing openclaw.claw to canonical CLAW.md. The experimental gate and integrity-bound lifecycle consent described below remain in force, so the friendlier authoring format does not make Claws a stable production contract.

Consent is tied to the exact plan

The official documentation requires the experimental gate:

export OPENCLAW_EXPERIMENTAL_CLAWS=1

The intended flow is to inspect a local package or grouped JSON manifest, preview all effects, and apply only the exact plan reviewed:

openclaw claws inspect ./incident-triage.claw.json
openclaw claws add ./incident-triage.claw.json --dry-run --json
openclaw claws add ./incident-triage.claw.json \
  --yes \
  --plan-integrity <SHA256_FROM_DRY_RUN>

--yes alone is insufficient. OpenClaw rebuilds the plan and rejects consent if the source, destination or live configuration changed. MCP definitions, cron jobs, package capabilities, tool and sandbox effects are included in that plan.

Removal follows the same pattern. Referenced resources are retained by default, while broader cleanup choices must appear in both preview and apply and therefore become part of the plan digest.

Availability and verification

The three pull requests are merged into main:

• export at 6134fdfdcdb7830fc17a99b5926a1626d0e4bd44;
• cron ownership at 96e3051838f989d29863355a8c49ade228172ffb;
• MCP ownership at b56006babf071ea9c9274ef1710e8f3ed8b9d21d.

Their upstream descriptions report focused lifecycle tests, including 121 tests for the MCP slice and 59 for the cron slice. Those are upstream results, not an independent Academy execution.

OpenClaw Academy installed the official 2026.7.2-beta.3 npm package in a disposable directory and invoked it with a supported Node 24.15.0 runtime. openclaw claws --help returned Unknown command: openclaw claws, confirming that beta.3 did not contain the command surface. A source build of the merged main implementation was not run, so this article remains source and documentation analysis rather than an independent functional test of add, export or removal.

That package check is a historical boundary, not a claim about every later beta. Confirm the exact package you run for the relevant pull-request or merge commits before expecting Claw commands or canonical CLAW.md export.

Bottom line

The material change is not merely that Claws gained two more manifest fields. OpenClaw now has a coherent experimental ownership model spanning agent files, packages, Gateway scheduling and shared MCP configuration, plus an export path that preserves only portable state.

That makes the format worth evaluating for repeatable agent deployment. It does not make it ready for production distribution: the CLI remains explicitly gated and single-agent, while lifecycle diagnostics and grouped-update work continue around the now-merged canonical CLAW.md authoring path.

Verification note: OpenClaw Academy checked the official documentation, pull-request and commit records and merged chronology through 24 July 2026. We independently confirmed the command was absent from beta.3. Behavioural and test claims for the merged implementation are attributed to upstream evidence and were not independently executed.