OpenClaw — Complete Feature Inventory

01CLI surface [top]

Global flags

Setup & onboarding

Gateway & system

Models & inference

Messaging & agents

Channels, nodes, network

Automation

Security & ops

Miscellaneous

02Chat-app channels supported [top]

03LLM provider integrations [top]

Major hosted providers

Self-hosted / local

Provider features summary

• Fallback chains — models fallbacks defines primary→fallback ordering; auto-routed on rate-limit or outage.
• Per-job model override — cron / hooks payload can override default model.
• Streaming — SSE + WebSocket native; OpenAI-compatible streaming flush improved v5.5.
• Vision — wherever upstream supports it; imageModel is a separate config from text model.
• Tool use — universal where the model supports it; tool streaming default-on for Grok.
• Extended thinking — Claude, Gemini adaptive, Moonshot K2-thinking.
• App-attribution headers — applied only on verified routes (OpenRouter) and native traffic (OpenAI).

04Built-in tools / capabilities [top]

MCP client — first-class. OpenClaw both serves MCP (its own tools exposed to other clients) and consumes any MCP server. Filesystem MCP, Chrome DevTools MCP, Browser Tool MCP all officially supported.

05Skills system / ClawHub [top]

ClawHub categories (11 official)

SKILL.md contract

• Frontmatter — name, description, metadata.openclaw.requires (env vars, binaries, Nix plugins).
• Body — natural-language instructions the agent reads when the skill triggers.
• Supporting files — scripts, templates, examples referenced from the body.
• Versioning — semantic via ClawHub; pin / unpin / update via clawhub CLI.
• Dynamic loading — Skill Watcher refreshes available tools mid-session.

Registry catalog stats

• 5,400+ skills filtered + categorized from the official registry (VoltAgent count).
• One-click install via openclaw skills install <slug> or clawhub install <slug>.
• Search across 6 registries with quality filtering (added v4.1).
• Security — every install runs ClawScan + VirusTotal Code Insight (critical findings block by default).

06Memory / persistence [top]

Storage tiers

Search backend

• Hybrid search — FTS5 BM25 keyword + vector similarity, combined.
• Chunking — ~400-token segments with 80-token overlap.
• Embedding providers — OpenAI, Gemini, Voyage, Mistral (auto-detected from API keys).
• Indexing tracker — files table tracks mtime, size, content hash → skip re-indexing unchanged files.

Memory tools and behaviors

• memory_search — semantic search across notes.
• memory_get — read specific file or line range.
• Memory flush — silent background turn before compaction; saves important context to MEMORY.md.
• Dreaming — optional scheduled consolidation: short-term notes promoted to MEMORY.md by score / recall frequency / diversity thresholds.
• Active Memory plugin (v2026.4.10) — optional sub-agent pulls relevant context before each main reply.
• People Wiki (v2026.4.29) — provenance views, per-conversation Active Memory filters, structured claims.

Alternative backends

• QMD — local-first sidecar with reranking + query expansion.
• Honcho — cross-session AI-native memory with user modeling.
• LanceDB — plugin with local Ollama embedding support.
• Hindsight — third-party RAG memory plugin (Vectorize).

07Gateway features [top]

Daemon

• Runs under launchd (macOS), systemd (Linux), or Windows service.
• Default port 18789; configurable.
• Bind modes: loopback (default), lan, tailnet, custom address.
• Hot reload — Gateway watches ~/.openclaw/openclaw.json and applies changes without restart.

Multi-user / multi-machine

• Operator roles with fine-grained scopes: admin, approvals, pairing, read, talk.secrets, write.
• Mobile + desktop nodes connect via WebSocket; mDNS/NSD for LAN discovery.
• Profile isolation: --profile <name> for multi-instance on one host.

Remote access

• SSH tunnel (universal fallback) — local-forward to remote Gateway WS.
• Tailscale direct connect + Tailscale Serve for Control UI exposure.
• Cloudflare Tunnel + Cloudflare Access — Zero Trust remote access pattern.
• TLS cert pinning via gateway.remote.tlsFingerprint.
• Trusted-proxy auth mode for identity-aware reverse proxies.

Control UI / Dashboard

• Web dashboard at the Gateway port; modular overview redesign in v2026.3.12 (Dashboard v2).
• Raw-config diff panel with redaction options (v4.26).
• Persistent auto-scroll mode for Control UI / WebChat (v5.12).
• PWA install + Web Push notifications (v4.25).
• iOS Home canvas (v2026.3.11).
• Device-identity issued in secure contexts (HTTPS / localhost).

Telemetry / observability

• Prometheus — scrape /api/diagnostics/prometheus, gateway auth applies. No external collector needed.
• OpenTelemetry — built-in OTLP/HTTP push for metrics, traces, logs (v2026.2+).
• Exported metrics — token usage, cost, context size, run duration, message-flow counters, queue depth, session state.
• Structured logs — exported over OTLP when enabled.
• Health URL — documented endpoint for liveness probes.

08Security features [top]

Access control

• Device pairing — loopback auto-approves; remote requires explicit token, expires in 1h.
• DM policies — pairing (default), allowlist, open (requires "*"), disabled.
• Mention gating — in groups, bot ignores messages unless mentioned.
• Session isolation — session.dmScope = per-channel-peer or main.
• Single-use pairing tokens — default limit 3 pending per channel.

Tool & execution hardening

• Sandboxing — Docker default; OpenShell or Nix alternatives. Per-session / per-agent scope.
• Exec approval — tools.exec modes: deny, ask, full. Approvals bind exact request context.
• fs-safe — root-bounded filesystem primitives; tools.fs.workspaceOnly: true prevents escape.
• Tool allow/deny lists — per-agent; profiles like "messaging" disable runtime tools by default.
• Elevated mode — tools.elevated, gated by allowlists.

Gateway network auth

• Shared bearer token (gateway.auth.mode: "token") or password auth.
• Trusted-proxy mode validates identity via headers; loopback proxies require allowLoopback: true.
• Tailscale identity headers (allowTailscale: true).
• TLS termination + HSTS via strictTransportSecurity (v2026.2.23).

Content & model safety

• External content wrapping — untrusted content wrapped with <<<EXTERNAL_UNTRUSTED_CONTENT ...>>> markers.
• Special-token sanitization — strips Qwen/ChatML, Llama, Gemma, Mistral, Phi chat tokens.
• Context visibility filtering — quoted replies, thread history only from allowlisted senders.

Supply chain

• ClawScan — 10 categories of prompt-injection detection, credential stealers, reverse shells, invisible-unicode attacks. openclaw plugins install runs it.
• VirusTotal Code Insight — LLM-powered security analysis of every published skill on ClawHub.
• Skill watcher — refreshes available tools mid-session; restrict who can edit skill folders.
• --dangerously-force-unsafe-install — break-glass only; does not bypass before_install hook blocks.

Network egress

• Proxyline — Node-process global routing layer; installs process-wide network routing through configured proxy.
• SSRF policy — browser blocks private/internal destinations by default; dangerouslyAllowPrivateNetwork override exists.
• Operator-managed outbound proxy routing (v4.27).

Logging / audit

• Log redaction on by default; logging.redactSensitive: 'tools', custom redactPatterns.
• Session transcript permissions — recommend 700 dirs / 600 files.
• Security audit — openclaw security audit [--deep] [--fix] checks 6 surfaces.
• Legacy import scrubbing — static API keys in auth.json auto-removed.
• Workspace .env blocking — OPENCLAW_* keys in workspace .env ignored.

Credential storage

• ~/.openclaw/credentials/ — channel creds, OAuth imports, pairing allowlists.
• ~/.openclaw/agents/ — agent-specific auth profiles.
• SecretRef providers: env, file, exec.
• Auth profile encryption keys at ~/.config/openclaw.

09Mobile / cross-device [top]

Android — ClawNode

iOS

• OpenClaw Messenger — App Store. Real-time chat, push notifications, image attachments.
• Voice Companion — Voice interaction app on App Store.
• Tabs — Connect / Chat / Voice / Canvas / Camera / Screen capture / Android-style device commands.
• iOS Home canvas shipped v2026.3.11.

macOS

• Menu-bar app — operator surface.
• Native iMessage bridge (channel #6).
• Remote-mode app with automatic transport selection.

Push / notifications

• iOS APNs through OpenClaw Messenger.
• Web Push (PWA) for browser dashboard (v4.25).
• Host alerts via Telegram for ops events.

10Routines / scheduling [top]

Schedule formats

Execution styles

Delivery modes

• announce — fallback delivery to chat channel if agent didn't send directly.
• webhook — POST finished-event payload to URL.
• none — no runner fallback (agent can still send via tool).
• Channel targeting: Slack/Discord/Mattermost use channel:<id> / user:<id>; Telegram supports forum-topic IDs.

HTTP webhook ingress

• POST /hooks/wake — fire-and-forget trigger for the main session.
• POST /hooks/agent — trigger isolated agent turn; fields: message, name, agentId, wakeMode, deliver, channel, to, model, fallbacks, thinking, timeoutSeconds.
• Custom mappings — hooks.mappings transforms arbitrary payloads (templates or code transforms).
• Auth — Authorization: Bearer or x-openclaw-token header; query-string tokens rejected.
• /steer endpoint — active-run steering (v5.3).

External event sources

• Gmail PubSub — wizard via openclaw webhooks gmail setup; auto-renews on Gateway boot.
• GitHub webhooks — via /hooks/wake or custom mapping (CI failure, PR event, etc.).
• Stripe / n8n / Hookdeck — same pattern; webhooks-are-events.

Job operations

• Failure notifications — global cron.failureDestination or per-job override.
• Staggering — top-of-hour jobs randomized into 5-min windows; --exact forces precise timing.
• Concurrency — maxConcurrentRuns cap.
• Retry — exponential backoff for rate-limits / network / 5xx.
• Session retention — isolated sessions pruned after 24h.
• Phase watchdogs — setup / runner-init / first-model-call have separate timeouts.
• Disable cron — cron.enabled: false or OPENCLAW_SKIP_CRON=1.

11Developer / extensibility [top]

Plugin SDK

• 28 lifecycle hooks exposed by the plugin SDK.
• Hook categories: model resolution, agent lifecycle, message flow, tool execution, sub-agent coordination, gateway lifecycle.
• Key hooks: before_agent_reply (can short-circuit + inject synthetic reply for caching / rate-limiting), onMessageReceived, onResponseGenerated, before_install.
• Plugin SDK v2 — typed contract system on 2026 roadmap.
• npm-first plugin system migration (v5.2) — plugins distributed as npm packages.
• Externalized providers — Bedrock, Slack, OpenShell, Anthropic Vertex split out of core (v5.12).

Skill SDK

• SKILL.md frontmatter declares runtime requirements (env vars, binaries, Nix plugins).
• Body is natural-language; model decides when to invoke.
• Supporting files reference scripts, templates, examples.
• Versioned via ClawHub; one-click install via clawhub install.

MCP (Model Context Protocol)

• Client — consume any MCP server (filesystem, Chrome DevTools, browser tools, GitHub, etc.).
• Server — openclaw mcp serve exposes OpenClaw's tools to other MCP clients.
• Operations — mcp list/show/set/unset.

ACP (Agent Communication Protocol)

• Introduced v4.2 — inter-agent messaging bus.
• Thread-bound persistent sessions for long-running multi-agent tasks.
• Label-based sub-agent spawning.
• ACP fallback runtime support (v5.12).

Configuration surface

• ~/.openclaw/openclaw.json (JSON5) — primary config. Hot-reload.
• OPENCLAW_CONFIG_PATH — override config location.
• ${VAR_NAME} substitution inside config strings.
• Env resolution order: process env → workspace .env → config env.vars.
• Config sections: channels, models, tools, plugins, cron, hooks, sessions, media, networking, ui, gateway, logging.

Deployment patterns

Docker env vars (selected)

• OPENCLAW_IMAGE — remote image override.
• OPENCLAW_EXTENSIONS — bundle plugin helpers at build time.
• OPENCLAW_HOME_VOLUME — persist /home/node.
• OPENCLAW_SANDBOX — enable sandbox bootstrap.
• OPENCLAW_DOCKER_APT_PACKAGES — extra system deps at image build.
• OTEL_EXPORTER_OTLP_ENDPOINT — OTel collector endpoint.

Release channels

• stable / beta / dev — three update tracks.
• Updater — openclaw update wizard (source installs only).

12Voice / audio [top]

TTS providers (14)

STT providers

• OpenAI Whisper — 90+ languages.
• Deepgram — streaming STT for Voice Call (v4.22).
• ElevenLabs — streaming STT for Voice Call (v4.22).
• Mistral — streaming STT for Voice Call (v4.22).
• Codex — audio transcription metadata support (v5.4).

Voice features

• Persona system — stable spoken identity across providers.
• Per-agent voice overrides — different voice per assistant.
• Model-driven TTS directives — [[tts:...]] inline tags in replies.
• Auto-TTS — messages.tts.auto: "always"; summarizes long replies, skips short text.
• Slash commands — /tts audio, /tts status, /tts limit, /tts summary.
• Chat-scoped auto-TTS controls — per-chat enable (v4.25).
• Native voice notes — Feishu, Matrix, Telegram, WhatsApp (Opus); MP3 fallback elsewhere; auto-transcode.
• Phone-call surface — Twilio + Plivo; PCM/Ulaw streams for telephony.
• Voice Call transcription (v4.22) + paced audio with backpressure-aware buffering (v5.4).
• Talk Mode — continuous duplex listening + speaking.
• Push-to-talk — Mic mode on Android/iOS nodes.
• Voice wake — wake-word on macOS/iOS/Android.
• Google Meet participant — agent joins Meet call as participant (v4.24).

13Vision / image / video [top]

Image input

• Formats: local file path or HTTP(S) URL.
• Auto-resize + recompress to JPEG, max side 2048px.
• 50 MB ingest cap; 10 MB understanding cap (tools.media.image.maxBytes).
• Magic-byte detection (not extension-only).
• Multi-attachment via tools.media.<cap>.attachments.

Image generation

• OpenAI image gen + reference-image editing via Codex OAuth (v4.23).
• OpenRouter image generation (v4.23).
• xAI media generation (v4.22).
• fal provider support (v5.16-beta.4).
• Per-call timeoutMs for generation tools (v4.23).

OCR

• OCR via skills (image-ocr, ocr-reader, OCR Local V2) — not core; ClawHub Utility category.
• Top-rated Screenshot & OCR skill captures window/URL/region then extracts text.
• Ocr-reader integrates with openclaw browser CLI for full-page / element screenshots.

Video

• Pass-through up to 16 MB.
• MP4 + gifPlayback: true for looping on mobile.
• Understanding cap 50 MB (tools.media.video.maxBytes).
• Video generation tool (video_generate).
• video-editor-ai skill — chat-driven MP4 edit, BGM/subtitles/effects, TikTok/Reels/Shorts export.

Vision capabilities

• Native vision via upstream model (Claude 4.6 Vision called out as champion for structured-JSON extraction from screenshots).
• Auto image description + caption preservation.
• Audio attachments transcribed; transcript enables slash-command parsing.
• Screenshot capture in browser tool + canvas commands on mobile nodes.
• Documents up to 100 MB with filename preserved.

14Recent additions (last 90 days) [top]

May 2026

April 2026

February–March 2026

15Missing / explicitly NOT supported [top]

Roadmap (in-flight)

• Native multi-agent orchestration — running multiple agents that coordinate (partially shipped via ACP).
• Plugin SDK v2 — typed, testable contract system for skills + integrations.
• Built-in vector memory — native ChromaDB support for long-term recall without external RAG plumbing.
• Improved web dashboard — for non-technical operators.
• Deeper enterprise integrations — Microsoft Teams, Salesforce.
• Event-driven cron — webhook:received, job chaining, reactive triggers (RFC #28584).
• Agent-scoped cron in multi-agent setups (issue #16053).

Explicit non-goals / known by-design limits

• Hostile multi-tenancy not in threat model. Personal-assistant deployment, one trusted operator per Gateway. Adversarial shared infra requires separate Gateways / OS users / hosts.
• Memory of all chat history is not "infinite." File-first; older daily logs searchable but not auto-loaded.
• Raspberry Pi compatibility removed in v2026.4.24 (breaking).
• Skills as untrusted code — skill folders treated as trusted; if you can edit them you can RCE; restrict edit access.
• System prompts are soft guidance — hard enforcement is access control + scope + tool policy, not prompts.
• No promise of "risk-free" agent — explicitly stated in Five-Point Security Plan.

Open feature requests with traction

• Improved Cron / Scheduling — simpler API + sub-agent execution + job history (issue #5825).
• Native Prometheus / OTel exposition (now partially shipped per docs; original ask #13608).
• Release roadmap / changelog preview (issue #52481).
• 11 platform-gap meta bundle from intensive daily use (issue #65824).

Governance

• OpenClaw Foundation since Feb 14, 2026; quarterly community calls where operators vote on priorities.
• Public RFC process for roadmap items.
• MIT license; OpenAI sponsorship under foundation stewardship.