OpenClaw

What it is

OpenClaw is an open-source personal AI agent you run yourself. It installs as a single Gateway process on your own machine or a VPS, points at whatever model provider you already pay for, and takes instructions through chat apps your team already opens — WhatsApp, Telegram, Discord, Slack, Signal, iMessage, Microsoft Teams, Google Chat, Matrix, and Zalo ship as built-in channels, with others installed on demand as channel plugins. Peter Steinberger, who founded PSPDFKit, released it in November 2025; it shipped under the names Clawdbot and Moltbot before settling on OpenClaw. It is MIT licensed, and in early 2026 it passed React’s star count to become the most-starred repository on GitHub.

The part that decides a purchase is where the data and the bill sit. There is no vendor account, no seat, and no tenant. The Gateway is the single source of truth for sessions, routing, and channel connections, and it holds those on hardware you control. Model spend goes straight to your provider — Anthropic, OpenAI, Google Gemini, xAI, OpenRouter, GitHub Copilot, MiniMax, or any OpenAI- or Anthropic-compatible endpoint you configure.

Governance moved in 2026 and the order of events matters when you present this internally. OpenAI hired Steinberger in February 2026 — the person, not the project. On 8 July 2026 OpenClaw became a 501(c)(3) non-profit, the OpenClaw Foundation, with OpenAI, NVIDIA, Microsoft, Tencent, Red Hat, Atlassian, GitHub, Cloudflare, Vercel, and the University of Michigan (its largest donor) as sponsors rather than owners. The Foundation’s stated commitment is to keep OpenClaw MIT licensed and independent, and Steinberger keeps technical stewardship.

Why it lands on shortlists in regulated orgs

• The data boundary is one you drew. Dust and Lindy both ask you to connect your source systems to their cloud. OpenClaw asks you to install a daemon. For a legal team that cannot route privileged material through a third-party processor, or a RevOps team whose security review stalls on a new sub-processor, that difference is the whole evaluation — not a preference.
• MCP runs in both directions. As a client, OpenClaw connects to MCP servers over streamable HTTP, SSE, or stdio, defined under mcp.servers with toolFilter include/exclude patterns to narrow what the agent can call. As a server, openclaw mcp serve exposes its channel conversations to an external MCP client. MCP tools pass through the same access controls as native ones, so adding a server does not widen policy.
• The permission model is configuration you can read. Shell execution is off by default (tools.exec.security: 'deny'). Tool execution containerizes with agents.defaults.sandbox.mode: 'all', Docker as the default backend, and workspaceAccess: 'ro' to mount the workspace read-only while blocking /etc, /proc, /root, and credential directories. The Gateway binds to loopback by default and requires gateway.auth.mode: 'token' before anything reaches it over the network. openclaw security audit --deep probes a running Gateway; --fix tightens permission drift.
• Untrusted content is marked as untrusted. Fetched pages, emails, and extracted documents get wrapped in explicit untrusted-content boundary markers before reaching the model, and the browser tool ships with an SSRF policy that blocks private-network destinations unless you allowlist hostnames explicitly.

What it costs

The software is $0 and the license is MIT, so there is no seat line to model. Two real costs replace it. First, provider tokens — billed by whichever model you attach, and the only variable that scales with usage. Second, a host, if you want the agent reachable when your laptop is closed: the docs put the floor at 1 vCPU and 1 GB of RAM, recommend 2 GB or more once you run several channels or the browser tool, and suggest a 4 GB swap file below 2 GB. Install is npm install -g openclaw@latest then openclaw onboard --install-daemon, on Node 22.22.3 or a newer supported release, on macOS, Linux, or Windows.

Set that against the hosted poles for the same job: Dust starts at $31 per seat per month and Lindy at $50 per month. At one to three operators, OpenClaw’s provider bill lands under both. At thirty seats with a procurement process, the comparison inverts, because the cost that grows is the engineer who owns the Gateway.

Best for

• Legal ops and in-house counsel who need an agent over privileged material and cannot add a processor to the DPA
• RevOps and TA operators with a developer on the team who want a personal agent in the chat app they already live in, at provider cost rather than a seat price
• Anyone piloting agent workflows before there is budget for a platform, where the deliverable is “does this pattern work” rather than “roll it out to the department”

Alternatives — and when to pick them instead

• Dust — pick it when more than one person needs the same agents and procurement needs somebody to countersign. Its dual-layer permission model, audit trail, and managed cloud at $31 per seat answer the questions OpenClaw hands back to you. Its core is MIT too, so self-hosting is possible; almost nobody does it.
• Lindy — pick it when nobody will own a daemon. Usage-based from $50 per month, no host to patch, and a builder a non-engineer can drive. You accept that your Gmail, Slack, and CRM data flows through Lindy’s cloud.
• n8n — pick it when the job is a deterministic pipeline with an agent step in the middle, not a chat-native assistant. Self-hosting is free, cloud starts at $24 per month, and the visual canvas is easier to hand to a successor than a JSON config file.
• OpenClaw is itself the fastest-growing entrant in this segment — GitHub’s most-starred project inside 60 days of its 2026 surge — which is a reason to test it and a reason to pin a version rather than track latest.

Watch-outs

• The docs say it is not a multi-tenant security boundary. OpenClaw states plainly that it is not a hostile multi-tenant boundary for multiple adversarial users; sessionKey is routing, not authorization. Guard: run one Gateway per trust boundary — per person, not per team. session.dmScope: 'per-channel-peer' and dmPolicy: 'allowlist' cut cross-sender leakage, but a shared team Gateway is outside the design and no configuration makes it safe.
• Prompt injection is the live risk and the project says guardrails alone do not close it. An agent reading your inbox with tools attached is an agent taking instructions from strangers. Guard: keep tools.exec.security: 'deny', sandbox mode at all with a read-only workspace, and channel allowlists on; and attach a current frontier model — the security docs warn that injection risk with older or smaller models is too high for tool-enabled agents on untrusted inboxes.
• There is no vendor, so there is no artifact for procurement. No SLA, no support contract, no DPA, no SOC 2 report. Guard: the compliance file you hand legal has to be one you produce — openclaw security audit --deep output, your own DPIA, and named owner for patching — and it should be signed off before regulated data moves, not after the pilot works.
• Technical calls still route through one maintainer who now works at a model lab. The Foundation, the sponsor list, and the MIT pledge reduce that concentration; they do not remove it. Guard: pin a release rather than auto-updating a production Gateway, and treat channel plugins as supply chain — the audit tool has a plugins.* prefix for exactly that reason.
• Setup cost is your time, and it is the number people leave out. Two hours to a working agent is a good outcome; the ongoing cost is Node upgrades, channel breakage when a chat platform changes its API, and credential rotation. Guard: budget a named owner with a standing half-day a month, and if you cannot name that person, pick a hosted pole instead.