What Is OpenClaw? Verified Guide for 2026

The short answer

OpenClaw is a self-hosted gateway for a personal AI assistant. It connects one or more AI models to messaging channels, a browser-based control interface and tools that can act on your behalf.

The useful mental model is:

Channels bring messages in. The Gateway routes and protects them. Models reason. Tools and skills do the work.

OpenClaw is not an AI model. It normally sends prompts to whichever model provider you configure—such as Anthropic, OpenAI or Google—and returns the provider’s response through WhatsApp, Telegram, Discord, Slack or another connected surface.

It can also use local models, but self-hosting the Gateway does not automatically mean every prompt stays on your machine.

What OpenClaw actually does

A running OpenClaw system has four practical layers:

The Gateway is the control plane. It keeps channel connections alive, maps messages to sessions, invokes an agent and enforces the configured tool and access policies.

That distinction matters. If someone describes OpenClaw as merely a chatbot, they are missing the part that creates both its value and its risk: the agent can be delegated real authority.

A typical request, end to end

Suppose you message your OpenClaw assistant on Telegram and ask it to summarise a document.

1. Telegram delivers the message to the Gateway.
2. The Gateway checks whether the sender and room are allowed.
3. OpenClaw selects the relevant agent and session.
4. The configured model receives the request and available tool descriptions.
5. The agent may read the document through a file tool.
6. The model produces the summary.
7. The Gateway sends the answer back through Telegram.

A more powerful request might use browser automation, run a command, query an API or schedule future work. Those actions should be constrained according to the people who can reach the agent and the damage a mistaken action could cause.

What stays local—and what does not

OpenClaw’s state and execution can live on your own laptop, server or VPS. Common local data includes:

• configuration and provider credentials;
• session history and workspace files;
• channel authentication state;
• tool execution and logs;
• locally installed skills.

But model prompts and responses go to a cloud provider when you configure a hosted model. Search, transcription, image generation and third-party skills may call additional APIs.

A precise privacy claim is therefore:

OpenClaw gives you control over the gateway, state and tool execution. Data sent to configured external providers is still governed by those providers.

For a map of features that can spend keys or send data externally, see the official API usage and costs reference.

Channels: use the assistant where you already work

OpenClaw supports a broad set of messaging and control surfaces. The current official channel index includes Telegram, WhatsApp, Discord, Slack, Signal, iMessage-related options, Microsoft Teams, Matrix, Google Chat and others.

Channel support is not identical. Each platform has different authentication, group, threading, delivery and rate-limit behaviour. Treat the official channels index as the current compatibility record.

For phone-based use, we consider Telegram the simplest starting point because setup uses a bot token. That is an operator judgement, not a measured speed benchmark. WhatsApp is production-ready through a linked WhatsApp Web session, but requires QR login and more deliberate sender controls.

Tools, plugins and skills are different things

These terms are often blurred together:

• Tools are callable capabilities such as browser control, file access or command execution.
• Plugins extend OpenClaw’s runtime with code, tools or integrations.
• Skills are instruction packages centred on a SKILL.md file. They teach an agent when and how to use tools.

Skills can be bundled, local, project-specific or installed from ClawHub. Current OpenClaw supports skill allowlists and verification metadata, but the official guidance is blunt: treat third-party skills as untrusted until reviewed.

A skill’s markdown is not a magic safety boundary. If the agent can execute shell commands or access powerful credentials, secure those capabilities separately with sandboxing, operating-system isolation and narrow permissions.

Is OpenClaw safe?

It can be operated safely for a trusted individual or team boundary, but it is not safe by default for hostile multi-tenant use.

The official security model assumes one trusted operator boundary per Gateway. If mutually untrusted people need assistants, use separate Gateways and preferably separate operating-system users or hosts.

The first controls to understand are:

1. Identity: pairing and allowlists decide who can trigger the agent.
2. Scope: tool policy, sandboxing and credentials limit what it can do.
3. Exposure: Gateway authentication and network binding protect the control plane.
4. Model resilience: assume prompts can manipulate the model and constrain the blast radius.

Run the built-in audit after installation and after material configuration changes:

openclaw security audit
openclaw security audit --deep

Read our current OpenClaw safety assessment for a practical verdict and checklist.

What OpenClaw costs

The software is open source. Operating it can still cost money through:

• model API tokens or hosted subscriptions;
• a VPS or cloud instance;
• web search, transcription, media generation or embedding APIs;
• commercial integrations used by skills;
• the time required to secure, monitor and update it.

The model is usually the variable cost that matters most. OpenClaw can show token usage and estimated costs when the provider supplies compatible metadata and local pricing is configured.

See our OpenClaw cost guide for a budget model and the commands that expose usage.

Who OpenClaw is for

OpenClaw is a strong fit when you:

• want one assistant across several channels;
• need tools, automation and persistent context rather than chat alone;
• are comfortable operating software and reviewing permissions;
• want control over the Gateway, state and integrations;
• can maintain a clear trust boundary.

It is a poor fit when you:

• want a zero-maintenance consumer chatbot;
• plan to expose a tool-enabled agent publicly without hardening it;
• need hostile users to share one Gateway as if it were a secure SaaS tenant;
• cannot review what credentials, files and systems the agent can reach.

How to get started

Use the verified installation guide for the official installers, an inspect-before-run alternative, current runtime checks and failure diagnosis. This overview deliberately does not duplicate the bootstrap flow: the install page owns that search intent and is maintained as the operational source of truth.

Do not skip the runtime requirement. As verified on 24 July 2026, the current package accepts Node 22.22.3+, 24.15+ or 25.9+ within the supported major ranges. A system running Node 24.13 is still too old.

Frequently asked questions

Is OpenClaw the same as ChatGPT or Claude?

No. ChatGPT and Claude are model products and interfaces. OpenClaw is a Gateway that can use supported providers and connect them to channels and tools.

Does OpenClaw run the AI locally?

Not necessarily. The Gateway is self-hosted, but prompts go to a cloud model when you configure one. You can connect local model infrastructure if it meets your needs.

Can OpenClaw control my computer?

It can use powerful tools when you enable and permit them. That is why sender policy, sandboxing, filesystem boundaries and credential scope matter.

Is OpenClaw officially affiliated with OpenClaw Academy?

No. OpenClaw Academy is an independent publication. We use official documentation and reproducible tests as evidence, but we do not represent the OpenClaw project.

What should I read next?

Start with installation, then security, then one channel. Add tools and third-party skills only after the basic trust boundary is working.