Open Source

Secure autonomous AI agents in 60 seconds.

The OpenClaw alternative that doesn't compromise your security.
Docker isolation. Hard guardrails. Zero inbound ports.

Terminal
"RIP OpenClaw. How to deploy a secure, autonomous AI agent available on all your devices — in 60 seconds"

The setup that went viral. We made it 1-click.

Why we built seclaw

OpenClaw has serious security holes

68K+ stars on GitHub. Zero container isolation. Your API keys, SSH keys, and browser cookies — all accessible to any tool the agent decides to install.

API keys exposed to MCP servers

Critical

OpenClaw passes all environment variables to every MCP container. Your Anthropic key, Stripe key, database credentials — all visible to any tool the agent installs.

env_file: .env # every secret, every container

No filesystem isolation

Critical

The agent has full read/write access to your entire home directory. It can read ~/.ssh/id_rsa, ~/.aws/credentials, browser cookies, and anything else on your machine.

volumes: ~/:/host # your entire home directory

Containers run as root

High

MCP containers run with full root privileges. Combined with host mounts, this means the agent can modify system files, install backdoors, or escalate to host root.

# no user directive, no cap_drop, no read_only

No action confirmation

High

OpenClaw has a "permissions" system, but it's enforced in the prompt — not in the runtime. A jailbroken agent can ignore all rules and send emails, delete files, or post on your behalf.

# "Please don't do bad things" — in the system prompt

Inbound ports open to internet

Critical

OpenClaw exposes n8n on port 5678 with no authentication. Anyone who finds your IP can access your workflow editor, see your credentials, and modify your agent.

ports: 5678:5678 # open to the world

No resource limits

Medium

No memory or CPU limits on any container. A runaway agent or cryptominer can consume all system resources, crash your machine, or mine crypto on your hardware.

# no deploy.resources.limits — infinite resources

These aren't theoretical — they're in the default docker-compose.yml that 68K+ people cloned.

Security model

Hard guardrails, not suggestions

OpenClaw enforces rules in the system prompt. We enforce them in Docker. One can be jailbroken. The other can't.

Your agent can't:

  • Can't access your API keys

    Keys live in the agent's env only. MCP containers have zero access to secrets.

    env isolation per container
  • Can't modify its environment

    Filesystem is immutable. The agent can't install backdoors or modify its own code.

    read_only: true
  • Can't access folders you haven't shared

    Only the /workspace mount is visible. Your home directory, SSH keys, and browser data are invisible.

    explicit volume mounts only
  • Can't escalate privileges

    Zero Linux capabilities. Can't become root, can't mount filesystems, can't access raw network.

    cap_drop: ALL + no-new-privileges
  • Can't use unlimited resources

    512MB RAM, 1 CPU core. A runaway agent or cryptominer gets killed, not your machine.

    deploy.resources.limits
  • Must get your confirmation

    Sending emails, posting on social media, deleting files — all require explicit approval via Telegram.

    permissions.yml whitelist

But it can still:

  • Reply to your Telegram messages
  • Read and write to /workspace files
  • Access Gmail, Drive, Notion, Linear via Composio
  • Run scheduled tasks via Inngest (cron + timezone)
  • Pause and wait for your Telegram approval (HITL)
  • Execute terminal commands (sandboxed)
  • Learn from past interactions (memory buffer)
  • Wake up regularly and do overnight work

The goal: maximum capability within minimum attack surface. Your agent does real work — it just can't escape its sandbox.

Side-by-side comparison

Every row is a real security boundary. Green means it exists. Red means it doesn't.

Security BoundaryOpenClawseclaw
Container isolationNone — shared envPer-container with bridge networks
API key protectionAll keys in every containerEnv-only, sealed per service
Filesystem accessEntire home directory/workspace mount only
Root privilegesRunning as rootNon-root + cap_drop ALL
Permission enforcementPrompt-based (bypassable)Runtime guardrails (permissions.yml)
Network exposurePort 5678 open to internetZero inbound via CF Tunnel
Resource limitsNone (infinite)512MB / 1 CPU per container
Filesystem mutabilityFull read/writeread_only: true + tmpfs
Setup time30+ minutes manual config60 seconds via CLI

How it works

The stack behind seclaw

Every component is open source. Every container is isolated. Your data never leaves your machine.

# Your machine

agent-net (internal network)

agent— Telegram + LLM + Composio + MCP Client
inngest— cron schedules, retries, human-in-the-loop
desktop-commander— MCP, read_only, cap_drop ALL
cloudflared— outbound-only tunnel, zero open ports
--->Telegram(via Cloudflare Tunnel)

Agent Runtime

Node.js

Lightweight Node.js server with Telegram Bot API, OpenAI SDK (multi-provider), and Composio for integrations. No framework overhead — just a single agent.js handling webhooks, LLM calls, and tool execution.

Inngest

Scheduler

Self-hosted workflow engine for scheduled tasks. Cron with timezone support, step-level retries, and human-in-the-loop approvals via Telegram. Dashboard at localhost:8288. Free forever.

Claude / GPT-4o / Gemini

LLM

Opus 4.6, Sonnet 4.5, Haiku 4.5 — or GPT-4o, Gemini, 100+ models via OpenRouter. Smart routing picks the right model per task. Complex reasoning? Opus. Quick reply? Haiku.

Desktop Commander

MCP Server

Gives your agent file read/write and terminal access — inside a locked-down container. read_only filesystem, zero Linux capabilities, 512MB limit. The agent can work, but can't escape.

Composio

Integrations

Managed OAuth for Gmail, Google Calendar, GitHub, Slack, Notion, Linear, and more. Your agent never sees raw credentials — Composio handles token refresh and API auth.

Cloudflare Tunnel

Secure Access

Access your agent from anywhere — phone, laptop, any device. Outbound-only connection: zero inbound ports. No firewall rules. No exposed IPs. Auto-created by CLI in 30 seconds.

Why Inngest for scheduling?

Self-hosted, free forever

No cloud fees, no execution limits. Runs as a single Docker container with SQLite storage. Dashboard included.

Human-in-the-loop

Scheduled actions can pause and wait for your Telegram approval before executing. Approve or reject with one tap.

Durable execution

Each step retries independently. If the LLM call fails, it retries without re-fetching data. No lost work.

Zero inbound ports with Cloudflare Tunnel

Without tunnel

Port 3000 open to the internet. Anyone who finds your IP can send requests to your agent. Port scanning bots find these in hours.

With Cloudflare Tunnel

Zero open ports. Your server makes an outbound connection to Cloudflare's edge. Access via your custom domain with Cloudflare Access for authentication. Auto-created by our CLI in 30 seconds.

Setup in 60 seconds

Three steps. That's it.

1

Run the CLI

npx seclaw

Pick a template, enter your LLM provider and Telegram token. The CLI scaffolds Docker Compose, permissions, and Cloudflare Tunnel.

2

Start the stack

docker compose up

Agent, Inngest scheduler, Desktop Commander, and Cloudflare Tunnel — all start in isolated containers.

3

Message your bot

Open Telegram

Your agent is live. Scheduled tasks run automatically, integrations are connected, and every action is sandboxed.

npx seclaw

One-time purchase. Forever yours.

No subscriptions. Self-hosted. Your data stays on your machine.

17 agent templates from Free to $149

2 free templates included. 15 paid templates, one-time purchase.

Browse All Templates

Your only real cost: LLM API

Everything else is free — Docker, Inngest, Cloudflare Tunnel, Telegram, Composio free tier.

~$6

/month — Haiku only

~$15-30

/month — Smart routing

~$100+

/month — Opus heavy