What Is OpenClaw and How Does It Work? The Architecture, Explained

Everything that happens under the hood when you text your AI agent at 2 AM: the Gateway, the command queue, the agent loop, memory, automations and skills. Updated for OpenClaw v2026.10.10 (November 3, 2026).

It was a Tuesday night, and I was watching my OpenClaw agent reply to a Slack message, browse a competitor's pricing page, summarize the findings, and drop the results into our team channel.

No one asked it to do the last part. It just... did.

That was the moment I stopped thinking of OpenClaw as a chatbot and started thinking of it as infrastructure. But I had no idea how any of it actually worked.

And if you're like most of the people behind OpenClaw's nearly 400,000 GitHub stars, you probably don't either. You installed it, followed a tutorial, maybe got it talking through Telegram. But what's actually happening between the moment you send "check my calendar" and the moment it replies with your schedule?

That's what this article is about.

Not another setup guide. Not a feature list copied from the README. We're going to open the hood and look at the engine. Every layer. Every decision. By the end, you'll understand how OpenClaw works, why it works the way it does, and where things get complicated when you run it yourself.

OpenClaw in one paragraph

OpenClaw is a free, open-source (MIT-licensed) AI agent that runs on your own machine and talks to you through the chat apps you already use. A single background process, the Gateway, receives every message from every channel, queues it per conversation, and hands it to an agent loop. The loop builds context, calls the model you picked, runs tools such as the browser or shell, writes what it learns to plain Markdown files, and replies. Automations let the same agent act on a schedule without being asked.

That's the whole thing. The rest of this article is what each of those pieces does.

A quick note on versions. OpenClaw 2.0 (v2026.8.1) was announced on August 30, 2026 and rebuilt a lot: a new web UI, sessions and transcripts in SQLite, and a new built-in memory system. Point releases have shipped every few days since. v2026.10.10, released November 3, 2026, is the latest stable release at the time of writing, and everything below reflects the current docs. If you're here for the GitHub repo, the release lines and install-from-source steps, they have their own sections further down.

The OpenClaw architecture at a glance

Here is the full picture before we zoom in.

The Gateway: OpenClaw's Nervous System

Everything in OpenClaw flows through a single process called the Gateway. In architecture terms, it's the control plane: the one place that knows which channels are connected, which sessions exist and who is allowed to talk to the agent.

Think of it as air traffic control. Every message from every chat platform, every scheduled job, every tool execution and every session change goes through this one process. It runs as a background service on your machine (systemd on Linux, launchd on macOS) and serves WebSocket and HTTP on one port, ws://127.0.0.1:18789 by default. The web Control UI, the CLI, the terminal UI (openclaw tui), the mobile apps and any paired devices all connect to it over that WebSocket.

The Gateway handles four critical jobs:

Routing. When a message arrives from WhatsApp, Telegram, Discord or any of the 30+ supported channels, the Gateway figures out which agent and session should handle it. With multi-agent routing, different channels or even different contacts can go to completely isolated agents with their own workspaces and models.

Session management. Each conversation gets its own session, and since 2.0 sessions and transcripts live in a per-agent SQLite database instead of loose files (recent releases also support PostgreSQL stores). The Gateway tracks who's talking, what context is loaded and which tools are available. Sessions can also run on paired devices or cloud workers, and since v2026.10.10 moving a session between your machine and a cloud environment is a first-class workflow.

Authentication. Gateway auth is required by default and fails closed: with no valid auth configured, the Gateway refuses WebSocket connections. Onboarding generates a token even for a local-only setup, and new devices have to be paired. An explicit auth.mode: "none" still exists, but the docs limit it to trusted loopback setups and onboarding never offers it.

Automations. Scheduled jobs run inside the Gateway process, not inside the model, which is why the Gateway has to be running for anything scheduled to fire. This used to be the "heartbeat". It has been rebuilt, and it gets its own section below.

The Gateway is a single point of failure. The docs are explicit: one Gateway per host. If it crashes, every connected channel goes silent until it restarts. Recent releases improved recovery a lot (interrupted turns resume, queued messages drain, unfinished subagent work survives restarts), but it's still one process. If it's misconfigured, your agent is either unreachable or, worse, reachable by the wrong people. That's fine for a weekend project. It's less fine when your agent handles client communications. Our OpenClaw gateway guide covers bind settings and remote access in detail.

How clients and nodes talk to the Gateway (the transport layer)

Under the hood, the Gateway speaks a typed protocol over WebSocket. If you've seen queries like "openclaw transport layer" or "node client architecture", this is what they're about.

• Transport: WebSocket text frames carrying JSON. Requests look like {type:"req", id, method, params}, responses {type:"res", id, ok, payload}, and server-pushed events {type:"event", event, payload}.
• Handshake: the Gateway sends a connect.challenge with a nonce, and the first frame a client sends must be connect. Device clients sign that nonce with their device identity. The Gateway answers with hello-ok, a snapshot of presence and health, and the client's effective role and scopes. The protocol is currently version 4, and the default connect deadline is 30 seconds.
• Roles: operator for control-plane clients (CLI, Control UI, apps, automations), node for capability hosts, and worker for cloud execution hosts.
• Scopes: operators get scopes such as operator.read, operator.write, operator.admin, operator.approvals and operator.pairing. Config and update methods require operator.admin.
• Nodes: a node is a companion device (macOS, iOS, watchOS, Android or a headless host) that connects with role: "node" and exposes commands like camera.*, screen.record or location.get. Nodes are peripherals. Chat messages still arrive at the Gateway, never at a node, and the Gateway treats each node's declared commands as claims and enforces its own allowlist.

A single agent request follows this path: the client sends agent, the Gateway immediately acknowledges with a runId and status: "accepted", streams agent events while the run works, then sends a final response with the run's status and summary.

The command queue: what happens when messages arrive mid-run

Here's a problem every chat agent hits. You send a message, the agent starts working, and you send two more before it finishes. What happens to them?

OpenClaw answers this with a small in-process command queue. It's one of the least-discussed parts of the architecture and one of the most important for reliability.

Lanes keep work isolated. The queue is lane-aware and first-in, first-out. Every session gets its own lane (session:<key>), which guarantees only one agent run touches a given conversation at a time. Separate lanes exist for background work (cron, subagent, nested and others), so a long scheduled job never blocks your real-time replies. Each lane has a concurrency cap: 1 for unconfigured lanes, 4 for main and 8 for subagent. It's pure TypeScript and promises, with no external queue service.

Queue modes decide what a mid-run message does. You set them with /queue <mode> in chat or in config:

steer doesn't abort tools that are already running. If you want the newest message to stop everything, that's interrupt.

Options control turn formation. Three settings decide how queued messages turn into agent turns:

• debounceMs (default 500): the quiet window before queued messages are drained. Several quick messages inside that window become one turn instead of three.
• cap (default 20): the maximum queued messages per session.
• drop (default summarize): what happens when the queue is full.

A config example:

{
  messages: {
    queue: {
      mode: "steer",
      debounceMs: 500,
      cap: 20,
      drop: "summarize",
      byChannel: { discord: "collect" },
    },
  },
}

Or per session, in chat: /queue collect debounce:0.5s cap:25 drop:summarize, and /queue reset to go back to defaults. Precedence runs from the per-session override, to messages.queue.byChannel, to messages.queue.mode, to the built-in steer. Typing indicators still fire immediately while a message waits, so the experience feels the same to the person chatting.

One more safety detail: each run records an active writer claim, and transcript writes must match it. A run that has been superseded can't commit stale output to the conversation history.

If your agent seems to ignore messages or answer them out of order, the queue mode is the first thing to check. Our guide to an OpenClaw agent stuck in a loop covers the related failure modes.

The Agent Loop: Input, Think, Act, Repeat

Once a message reaches the front of its lane, the agent runtime takes over. This is where the intelligence lives.

OpenClaw uses the familiar ReAct loop (Reason + Act). If you've worked with any modern agent framework, you've seen it before. But OpenClaw's implementation has some specific wrinkles worth understanding.

Here's the flow:

1. Run accepted. The agent request returns a runId straight away, and the run is tracked from there. Clients that want to block call agent.wait, which only observes the run (30-second default) and never stops it.
2. Context assembly. Before the model sees your message, OpenClaw builds the context window: the base system prompt, your workspace bootstrap files (AGENTS.md for operating rules, SOUL.md for persona, USER.md for your preferences, MEMORY.md for durable facts), conversation history, tool schemas and the skills available to the agent. You can see exactly what went in with /context list or /context detail. The context load is substantial, which is why most serious deployments use a frontier model.
3. Model inference. The assembled context goes to whichever model you configured. OpenClaw is model-agnostic. You set the primary model and fallbacks in ~/.openclaw/openclaw.json (agents.defaults.model.primary and agents.defaults.model.fallbacks), and the runtime rotates auth profiles and falls back across models when a provider fails. Our model routing guide covers how to set that up.
4. Tool execution. If the model decides it needs to act (browse a page, run a shell command, check your calendar), it emits a tool call. Arguments are validated against the tool's schema, the runtime executes it (in a sandbox if you configured one) and feeds the result back.
5. Loop or reply. The model looks at the result and decides: do I need more, or am I ready to answer? Complex tasks run several cycles. When the conversation nears the model's context limit, OpenClaw compacts older turns into a summary and keeps going.

Everything streams out on three channels: assistant (text as it's written), tool (tool start, update and end) and lifecycle (start, finishing, end, error). That's what the Control UI shows you live.

A few defaults worth knowing: each model attempt can run for up to 48 hours (agents.defaults.timeoutSeconds), cloud models get a 120-second idle timeout and self-hosted ones 300 seconds, and the runtime retries a small, bounded number of times after things like a malformed tool call or a cut-off response. Plugins can hook into the loop at points such as before_tool_call, where returning block: true stops a tool from running at all.

The key insight: OpenClaw isn't a chatbot that sometimes uses tools. It's an orchestration engine that happens to communicate through chat. The messaging interface is just the surface. Underneath, it runs the same loop you'd find in any enterprise automation framework.

But this is where it gets messy.

Skills, Memory, and the "It's All Just Files" Philosophy

One of the boldest design decisions in OpenClaw is that the agent's brain is a folder of files.

Your agent's personality? A Markdown file called SOUL.md. Its operating rules? AGENTS.md. Its long-term memory? MEMORY.md plus dated notes in a memory/ folder. Skills? Folders containing a SKILL.md file. All of it lives in the agent workspace (~/.openclaw/workspace by default), and you can open any of it in a text editor.

2.0 moved the machine-facing state (sessions, transcripts, the memory search index) into SQLite. But the parts you write and read are still plain Markdown.

This is both OpenClaw's greatest strength and its biggest operational headache.

The strength: You can version control your agent's workspace with Git (the docs recommend a private repo). You can inspect every rule, every memory and every skill. There's nothing hidden. For developers who value transparency, this is deeply satisfying.

The headache: You're now responsible for a growing pile of files across potentially several agent workspaces. MEMORY.md gets cut off in context if it outgrows the bootstrap budget. Skills need updating. And drift between what's in your files and what the agent actually does becomes a real problem over time. If your AGENTS.md is getting long, our AGENTS.md optimization guide and SOUL.md guide help.

Skills

Skills are modular capability packages that teach your agent how to use tools. Browse the web. Control your email. Manage GitHub repos. You can write your own or install them from ClawHub, the community registry, with a single command. Since 2.0, creating, validating, finding and installing skills is one connected flow, with a Skill Workshop that holds proposals and checks. Our list of the best OpenClaw skills is a good starting point.

But stay with me here: the skill registry has had security problems. Cisco's AI security team built a malicious third-party skill that exfiltrated data and injected prompts without the user noticing, specifically to show how the trust model could be abused. ClawHub now shows security audit results before you install, but you're still giving community-contributed packages access to your agent's tools.

Memory: how OpenClaw remembers

Memory got the biggest rebuild in 2.0, and it's now handled by Memory Core, the default memory plugin: plain files plus one SQLite index. The design rule is simple: the model only remembers what is written to files in the workspace. There's no hidden state.

Memory is split into tiers, each with its own trust level:

How things get written. The agent jots notes into the daily file as it works. Before compaction, a silent memory flush prompts it to save anything important (on by default). Every memory entry carries provenance in SQLite (owner, agent, untrusted or system), which the model can't change by writing prose. Anything from scheduled, heartbeat or subagent sessions can't become durable memory, and once a tool pulls in web content, the rest of that turn is treated as untrusted.

How things get promoted. Dreaming, on by default, runs as a background sweep. Its light and REM phases dedupe and stage candidates. Its deep phase promotes facts into MEMORY.md only after a rule-based ranking (relevance, recall frequency, recency, recurrence across days) and a bounded consolidation pass. Untrusted content is excluded before any prompt is built, and every accepted rewrite is logged to DREAMS.md so you can review it.

How things get recalled. Lane 1 is always on and costs zero model calls: MEMORY.md and USER.md at session start, ranked search through memory_search (hybrid relevance with a 30-day recency half-life), and trigger phrases attached to entries. The agent can read a specific file or line range with memory_get. Lane 2 is a recall subagent that runs a full search turn, by default only when your message shows recall intent and lane 1 found nothing strong.

Standing intents. "When X happens, do Y" instructions are stored through the intent tool and matched by rules, not by the model. Defaults: a 24-hour cooldown, 3 fires and a 90-day expiry.

It's far more reliable than the early file-only approach, and also more moving parts to understand. Our memory compaction guide and memory plugins comparison walk through how it behaves in practice.

Automations: what replaced the heartbeat

If you read an older guide, you'll see the heartbeat described as the thing that makes OpenClaw feel alive: every 30 minutes the Gateway woke the agent to check a HEARTBEAT.md checklist. That's changed.

Heartbeat monitors are retired. In current releases, heartbeat monitoring is just an ordinary automation job with its own schedule, prompt, scratch space, model, delivery settings and run history. Explicit setup creates one enabled job called Proactive check for your main agent, which runs every 30 minutes unless your model provider sets a different starting cadence. The HEARTBEAT.md workspace file is retired too.

Migrating an older setup is one command, then a review:

openclaw doctor --fix
openclaw automations list --all

Doctor converts each old monitor into an editable job, keeps its run history and scratch, and imports supported HEARTBEAT.md content (archiving the original first). From then on you manage it like any other job: openclaw automations show <job-id>, edit <job-id> --message "...", scratch <job-id>, disable or remove. Deleting the default Proactive check is permanent; restarts and config reloads won't recreate it.

Two behaviour changes catch people out after migrating: heartbeat-specific duplicate suppression is gone (repeated updates can now be delivered), and a missing delivery route no longer skips the run. Check your migrated jobs' delivery settings if you relied on either.

What automations can do:

• Run on a schedule (cron expressions or one-shot --at jobs that delete themselves after success)
• Fire from webhooks and Gmail push notifications
• Since v2026.10.10, fire from MCP events
• Run in their own lane, so they never block live conversations

Job definitions and run history live in the shared SQLite state database, so restarts don't lose schedules. Overdue jobs are rescheduled on startup rather than all replayed at once. Anything that must happen at an exact time, like a 7 AM briefing, belongs in a scheduled job. If yours aren't firing, our cron troubleshooting guide covers the usual causes.

Multi-Channel: One Agent, Every Platform

This is the feature that made OpenClaw go viral.

A single agent can connect to WhatsApp, Telegram, Slack, Discord, Signal, iMessage, Microsoft Teams, Google Chat, Matrix, SMS, WebChat and more than 20 other channels at once. A few ship with the core install; most are official plugins that install with one command during setup. Each channel adapter normalizes messages into a common format before handing them to the Gateway.

The practical implication: by default, a personal agent keeps one rolling "main session" across your direct chats. You text your agent from WhatsApp while commuting, switch to Slack at your desk, and it's the same conversation. Same session. Same memory. Different interfaces.

Each adapter handles platform-specific quirks. WhatsApp uses QR code pairing through the Baileys library. Discord and Slack use bot tokens. iMessage has a native plugin built on the imsg bridge. The adapters hide all of this, so the agent runtime doesn't need to know which platform it's talking to.

One agent or several. When one agent isn't enough, OpenClaw scales out in two ways. Multi-agent routing binds different channels or contacts to fully separate agents, each with its own workspace and model. Subagents let a parent agent hand a focused piece of work to a child (research, a long-running job, a plan broken into steps), which runs in the subagent lane and reports back. Recent releases made this much more dependable: subagent work now survives Gateway restarts and paused parents keep their results. Our multi-agent setup guide walks through both.

The real-world problem: Setting up even three channels means configuring three separate authentication flows, managing three sets of credentials and debugging three different failure modes. I've seen developers spend an entire weekend just getting WhatsApp, Telegram and Slack working together reliably.

And that's on a good day.

MCP, nodes and sandboxes: where tools actually run

When the agent "uses a tool", the work can happen in four different places. Knowing which one matters for both security and debugging.

On the host. By default, tools run on the machine running the Gateway. That's the simplest setup and the riskiest one.

In a sandbox. Sandboxing is off by default. When you turn it on (agents.defaults.sandbox, with modes such as non-main to sandbox everything except your own main chat), only tool execution moves into the sandbox; the Gateway always stays on the host. Docker is the default backend, and Podman and SSH are supported too. Tool allow and deny lists apply before sandbox rules, so a denied tool stays denied.

On a node. Commands can target a paired device: take a photo on your phone, read its location, or run a command on another Mac. The Gateway enforces each node's command allowlist.

Through MCP. OpenClaw works in two MCP roles:

• As an MCP client, it keeps a registry of external MCP servers under mcp.servers and projects their tools into agent runs. It supports stdio, SSE/HTTP and streamable HTTP transports, with OAuth login. openclaw mcp probe opens a live connection and lists what a server offers; openclaw mcp status --verbose shows what's saved without starting anything.
• As an MCP server, openclaw mcp serve lets an external MCP client (Claude Code, for example) read and send your channel conversations through tools like conversations_list, messages_read and messages_send, plus approval tools.

Every network request an MCP tool makes goes out from wherever that tool runs, which is why it's worth scoping MCP servers the same way you scope skills. Our exec approvals guide covers how to require sign-off before risky commands run.

What comes built in

A lot of people search for "what does OpenClaw do out of the box". Here's the short version of a default install:

For ideas on what to do with all of it, see our roundup of OpenClaw use cases and our browser automation guide.

The Security Question No One Can Ignore

Let's be direct. OpenClaw asks for a level of system access that would make any security engineer nervous.

It can read and write files. Run shell commands. Control your browser. Access your email, calendar and messaging accounts. And if you run it with broad host access and no sandbox (which many tutorials don't warn against), a compromised agent can do a lot of damage to your machine.

Prompt injection is the biggest threat. Because OpenClaw processes messages from outside sources (group chats, forwarded content, scraped web pages), a malicious prompt hidden in that data can hijack the agent's behaviour. CrowdStrike published a detailed analysis of this attack surface, noting that attackers can poison the inputs an agent reads and then hijack its tools. Our write-up on WhatsApp prompt injection shows how it plays out in practice.

OpenClaw's maintainers have been responsive. Gateway auth is required by default, unknown senders have to be approved through DM pairing, memory now tags untrusted content at write time, and openclaw security audit checks your configuration for common footguns (openclaw doctor covers broader health and migrations). The October releases kept tightening things: workspace-only file restrictions now reach tools built by the Gateway, unresolved Microsoft Teams allowlists stay closed, and credentials are kept out of MCP and log output. But as one of OpenClaw's own maintainers warned in Discord: "If you can't understand how to run a command line, this is far too dangerous of a project for you to use safely."

That's an honest assessment. And it's why the question of where and how you deploy OpenClaw matters as much as understanding how it works. Start with our OpenClaw security checklist.

You could have invented OpenClaw: the architecture from first principles

In February 2026, Nader Dabit published an essay called "You Could've Invented OpenClaw" that rebuilt OpenClaw's architecture from scratch, starting with nothing but a messaging API and a language model. It went viral because it shows that every piece of OpenClaw is the obvious answer to a problem you hit along the way.

Here's that build-up, mapped to the current architecture:

The essay's original version described heartbeats running through their own queue lane so they never block real-time messages. That idea still holds; today those checks are automation jobs in the cron lane.

The takeaway: OpenClaw isn't magic. It's a dozen sensible decisions stacked together. That's also why it's hard to run well. Every one of those layers is something that can break.

Felix: what a production OpenClaw agent looks like

The most famous real-world OpenClaw setup is Felix, the agent entrepreneur Nat Eliason built on a Mac Mini and made the "CEO" of his company. It's worth studying because it shows how the architecture above gets used when real money is involved.

In a March 2026 interview, Felix described its own stack:

• Brain: Claude Opus 4.6 at the time
• Body: OpenClaw, for sessions, heartbeats, cron scheduling, plugins and the runtime
• Channels: Discord as the main channel with Nat, Telegram for customers, and AgentMail for email
• Memory: a three-layer system with nightly consolidation, built on Tiago Forte's PARA method (projects, areas, resources, archives)
• Delegation: heavy coding handed off to Codex rather than done by Felix itself

A few design decisions stand out:

1. Information channels vs command channels. Felix treats public mentions and inbound email as information, not instructions. Only Nat's own authenticated channels can give orders. That's the single best defence against prompt injection, and you can copy it with DM pairing and per-channel tool policies.
2. The human still sets direction. Felix proposes a plan every night; Nat approves or edits it every morning. The heartbeat checklist, ticket priorities and escalation rules are Nat's design.
3. Mistakes become constraints. When Felix gets something wrong, Nat changes the system so it can't happen again, rather than just correcting the agent in chat.
4. Real stakes. Felix has a revenue target, its own accounts, and products to run. Reported lifetime revenue was about $177,000 across its products and marketplace by late March 2026.

People often search for Nat's system prompt. He has shared parts of his setup publicly, but the lesson isn't the exact wording. It's the structure: a clear persona, hard rules about which channels are trusted, a nightly planning loop and a morning human sign-off. In today's OpenClaw, Felix's heartbeat checklist would be an automation job and his nightly consolidation would map onto dreaming.

A short history of OpenClaw (and where it's based)

Where is OpenClaw based? It isn't a company with an office. It's an open-source project stewarded by the OpenClaw Foundation, with contributors worldwide. Its creator is Austrian and moved to the US when he joined OpenAI. OpenAI hired Steinberger; it did not buy OpenClaw, and the project stays MIT-licensed with no paid tier.

What changed in recent releases

If you last looked at OpenClaw around the 2.0 launch, these are the architecture-level changes since:

• Heartbeats became automations, with the default Proactive check job
• Cloud and desktop sessions: move a session between your machine and a cloud environment
• PostgreSQL stores as an alternative to SQLite, with backups that survive updates
• A rebuilt Control UI with a new navigation rail and session workspace
• Mobile nodes: Android gained system, photos, contacts, calendar and motion capabilities
• MCP apps and MCP-triggered automations
• Local models: managed llama.cpp setup for OCR, vision and embeddings
• Much more reliable subagents across restarts

Our latest version page tracks each release.

Where to actually find OpenClaw before you install the wrong thing

The canonical repository is openclaw/openclaw on GitHub. That is the one. It carries the MIT license, the TypeScript core, the Gateway, the docs, the release history and the issue tracker.

As of November 3, 2026 it sits at about 394,000 stars and 82,800 forks, which puts it among the most starred repositories in GitHub's history.

The popularity created a problem.

Search "openclaw github" and you'll get the real repo plus a swarm of mirrors, forks, tutorial sites and lookalike orgs. Some are harmless. Some are community projects with similar names. And some are typosquats waiting for a distracted developer to install the wrong package at midnight.

Three checks before you trust a repo claiming to be OpenClaw:

1. The org is openclaw, not openclaw-ai, open-claw or anything with a hyphen you didn't expect
2. The license file says MIT and the language breakdown is TypeScript with some Swift
3. The release history is dense and version numbers are date-based, like 2026.10.10

The official docs, the security guide, the sandboxing guide and the exposure runbook all come from that same project. Read the security guide before you expose the Gateway to anything.

OpenClaw on GitHub: the repo, releases and how to read the update issues

The repo. Everything lives in openclaw/openclaw: source, docs, releases and the issue tracker. The project is stewarded by the OpenClaw Foundation, a non-profit, and the README is explicit that it has no paid tier, hosted service or token.

The releases. Versions are date-based, and there are two lines on the Releases page worth telling apart:

You'll also see pre-releases such as 2026.10.10-beta.4 and beta.5 (October 27 and 30). Those are betas, not something to run an agent you depend on. Our latest version page covers what changed in each release, and how to update OpenClaw covers doing it safely.

The "Update failure: …" issues. Open the issue tracker and you'll see a steady stream of issues titled like Update failure: validating (2026.10.9). These aren't hand-written bug reports. When an update fails, OpenClaw's updater rolls back and builds an update failure report, which the user reviews and confirms before it's filed. Each one records the version the user was on, the platform and Node version, the install method, the update target, the phase that failed (for example validating, git-clone or reconcile), whether the rollback succeeded, and the recovery outcome. Triage then labels them by impact.

GitHub search shows 519 issues with "Update failure" in the title opened during October 2026. Read that number carefully. Only failed updates generate a report, so it tells you updates break often enough to matter, not what share of updates fail. Before you update, check the newest of these issues for your version and install method, and look at the rollback line: if it says the rollback succeeded, the reporter ended up back on their previous version. And back up first.

Installing. Most people don't need the source. The official installer script from openclaw.ai (a one-line curl command on macOS, Linux and WSL2, or a PowerShell one-liner on Windows) installs Node.js if it's missing, installs OpenClaw and launches onboarding. If you already manage Node yourself (24.16+ or 26.1+, with 24.22.1+ or 26.12.1+ recommended for security), install the published package:

npm install -g openclaw@latest --allow-scripts=openclaw
openclaw onboard --install-daemon

Drop the --allow-scripts flag on npm 11.15 and earlier.

Installing from source. The repository is a pnpm workspace, and a plain npm install at the root isn't supported. After cloning openclaw/openclaw:

cd openclaw
corepack enable
pnpm install && pnpm build && pnpm ui:build
pnpm add --global "openclaw@link:$PWD"
openclaw onboard --install-daemon

Then check everything with openclaw --version, openclaw doctor and openclaw gateway status. Our complete setup guide walks through every path step by step.

Where Self-Hosting Starts to Hurt

Understanding how OpenClaw works is one thing. Running it reliably is another.

Here's what the architecture overview doesn't tell you: you need a machine running 24/7. You need to manage Node.js versions, update OpenClaw without breaking your config (519 failed-update reports in a single month says a lot), handle credential rotation for every connected platform, watch the Gateway process, tune queue modes and automations, and have a plan for when things break at 3 AM. And if you want proper security, you need sandboxing, firewall rules, non-root execution and regular audits.

For developers who enjoy infrastructure, this is a fun weekend. For everyone else, it's a part-time ops job. If you do want to keep OpenClaw but hand off the server, our OpenClaw hosting guide compares managed hosts on real monthly price, renewal cost, security and server location, and our cost breakdown shows what the API side adds.

This Is Exactly the Problem We Built BetterClaw to Solve

BetterClaw is a no-code AI agent builder and a managed OpenClaw alternative. You get what we've covered in this article (the agent loop, multi-channel connections, skills, memory, scheduled tasks) without any of the infrastructure work:

• Deploy in under a minute. No config files, no terminal, no Gateway to babysit.
• 500+ connectors and unlimited skills, plus MCP support so your agents can use any MCP server.
• Projects: agents working together as a team, handing jobs to each other alongside your people.
• Your models, your key. Bring your own key for Claude, GPT, Gemini or OpenRouter with zero markup on inference, or run local models through the BetterClaw desktop app.
• Security by default. Sandboxed execution, a kill switch, AES-256 encryption, ISO 27001 certification, and EU hosting and custom DPAs for teams that need them.

Plans start at $19/month for Starter, with Pro at $49/month for 5 agents ($39/month billed annually) and Business at $149/month for 25 agents. Every plan starts with a 7-day trial.

The Big Picture: Why Architecture Matters

If you've made it this far, you understand something most OpenClaw users don't: this isn't just a chatbot. It's a distributed system with a control plane, a lane-based command queue, an execution runtime, tiered persistent memory, scheduled automations, multi-channel I/O and a modular capability layer.

That architecture is powerful. It's also why OpenClaw is one of the most interesting open-source projects in years. Peter Steinberger built something that makes the ideas behind every serious AI agent framework tangible and inspectable. Understanding OpenClaw's architecture means understanding how AI agents will work everywhere.

But understanding the architecture also means understanding the operational cost. Every layer we discussed, the Gateway, the queue, the agent loop, the file-based memory, the automations, the channel adapters, the security surface, is something you either manage yourself or let someone else manage for you.

The best developers I know are the ones who understand the engine and know when it makes sense to let someone else change the oil.

If you want to tinker and learn, self-host OpenClaw. The codebase is fascinating and the community is incredible. If you want a production-grade agent running reliably across your team's chat channels without the infrastructure overhead, give BetterClaw a try.

Either way, now you know what's happening under the hood. And that makes all the difference.

Frequently Asked Questions

What is OpenClaw and how does it work?

OpenClaw is an open-source (MIT-licensed) AI agent created by Peter Steinberger that runs on your own machine and connects to messaging apps like WhatsApp, Telegram, Slack and Discord. Every message goes through a central Gateway process (a WebSocket server on port 18789 by default), which queues it per conversation and hands it to an agent loop that builds context, calls your chosen model, runs tools and replies. Memory is stored as Markdown files in the agent's workspace, and automation jobs let it act on a schedule.

What does the OpenClaw architecture look like?

OpenClaw has seven main parts: channel adapters, the Gateway (the control plane, one per host), a lane-based command queue, the agent loop, tools (on the host, in a sandbox, on paired nodes or through MCP), memory and skills as workspace files, and state in SQLite or PostgreSQL. Clients like the Control UI, CLI and apps connect to the Gateway as operators; phones and other devices connect as nodes.

What does drop: "summarize" mean in OpenClaw's queue settings?

It controls what happens when a conversation's message queue is full (20 messages by default). With summarize, the default, OpenClaw drops the oldest queued messages but keeps short summaries of them and injects those as a follow-up prompt, so nothing is silently lost. old drops the oldest messages with no summary, and new rejects the newest message instead. debounceMs (500 ms by default) sets the quiet window before queued messages are drained into a turn.

How does OpenClaw memory work?

Memory Core, the default memory plugin, stores memory as Markdown in the agent workspace plus one SQLite index. AGENTS.md holds rules, MEMORY.md and USER.md hold curated facts loaded at session start, and dated daily notes in memory/ hold everything else until it's recalled. The agent searches with memory_search and reads files with memory_get. Dreaming, on by default, promotes durable facts into MEMORY.md in the background after two checks, and every entry is tagged with where it came from.

What happened to the OpenClaw heartbeat and HEARTBEAT.md?

Heartbeat monitors and the HEARTBEAT.md file are retired. Periodic checks are now ordinary automation jobs, and setup creates a default "Proactive check" job that runs every 30 minutes unless your provider sets a different cadence. Run openclaw doctor --fix to migrate an older setup, then openclaw automations list --all to review the converted jobs.

Does OpenClaw support MCP?

Yes, in both directions. As an MCP client it connects to external MCP servers listed under mcp.servers (stdio, SSE/HTTP and streamable HTTP) and exposes their tools to agents. As an MCP server, openclaw mcp serve lets clients like Claude Code read and send your channel conversations. Since v2026.10.10, MCP events can also trigger automations.

Who owns OpenClaw? Is it an OpenAI product?

No. OpenClaw is stewarded by the non-profit OpenClaw Foundation and stays MIT-licensed with no paid tier. Its creator, Peter Steinberger, joined OpenAI in February 2026, and OpenAI supports the foundation, but OpenAI hired Steinberger rather than buying the project.

How do I deploy OpenClaw without managing Docker and infrastructure?

The fastest way to skip that work is a managed AI agent platform like BetterClaw, which handles infrastructure, sandboxing, security and multi-channel setup for you. You get a running agent in under a minute with no config files, no terminal commands and no server management. Plans start at $19/month, Pro is $49/month for 5 agents, and every plan starts with a 7-day trial.

Is OpenClaw safe and secure enough for business use?

Only with careful configuration. It asks for broad system permissions, and prompt injection is a known risk. Best practice is to keep the Gateway on loopback with token auth, approve unknown senders through pairing, turn on sandboxing, scope file access, treat public channels as information rather than commands, review skills and MCP servers before installing them, run openclaw security audit, and never run it as root. Managed platforms like BetterClaw include sandboxed execution, a kill switch and AES-256 encryption by default.

How much does it cost to run an OpenClaw AI agent?

OpenClaw itself is free (MIT-licensed), but you pay for model API usage and for the machine it runs on. API cost depends heavily on the model: Claude Sonnet 5.5 is $2/$10 per million input/output tokens, Claude Opus 5.5 is $4/$20, and smaller models cost far less. Add a VPS or an always-on machine on top. Managed options like BetterClaw start at $19/month for Starter and $49/month for Pro, which removes the infrastructure time.

Related Reading

• OpenClaw vs Hermes: Head-to-head on setup, models, channels, hosting and cost
• Is OpenClaw Dead?: Commit activity, the security crisis, and what's actually happening
• Claude Subscription and OpenClaw: The Ban, the Reversal, and What To Do: What changed in Anthropic's terms and your options now
• OpenClaw Memory Wiki Guide: The persistent-memory layer, set up end to end
• OpenClaw Multi-Agent Setup: Routing, subagents and agent teams
• Model Does Not Support Tools: The Fix: The most common error when wiring local models to OpenClaw
• Complete OpenClaw Setup Guide: Install, configure and run your first agent
• What OpenClaw Actually Costs to Run: API fees, hosting, and the overhead no one budgets for