Interactive tool
Deployment config planner
Answer four questions, get a deployment plan you can paste into a runbook: the current official entry points plus a review checklist. The output does not certify a host and should never be treated as a deploy script without verification.
Illustrative starting point, not a substitute for the official docs or for a security review. Nothing you select is stored or sent.
Your plan
# OpenClaw deployment plan
# Generated at https://openclaw.mu/tools/config: an illustrative starting point.
# The config schema moves fast; verify every step against the current
# official docs (docs.openclaw.ai) before running anything.
## 1. Prerequisites
# Current docs: Node 24.15+ is the default target; 22.22.3+ and 25.9+ are also listed.
# Provider chosen: Anthropic Claude. Never commit or paste the key into chats.
## 2. Install (official entry points)
curl -fsSL https://openclaw.ai/install.sh | bash
# or: npm install -g openclaw@latest
# Treat container settings, volumes and network exposure as part of the review.
## 3. Onboard
openclaw onboard --install-daemon
# run mode: Docker (compose) with a restart policy
# channels to pair: WhatsApp
## 4. Hardening checklist (posture: strict)
[ ] Gateway authentication verified; do not infer current settings from defaults
[ ] Gateway binding is intentional; loopback is the documented default, while
container auto-binding can differ and proxies can change reachability
[ ] DM and group sender policy reviewed for every configured channel
[ ] Official release notes and advisories are part of the update process
[ ] Least-privilege credentials only; the agent gets its own accounts,
never your personal admin logins
[ ] Risky tools isolated using supported sandboxing and host controls
[ ] Approval policy reviewed for consequential shell, file and outbound actions
[ ] Provider budget and usage alerts configured where the provider supports them
[ ] Every added skill or plugin reviewed for provenance, code and requested scope
[ ] Isolated browser profile if browser automation is enabled; no logged-in
banking/admin sessions in its reach
[ ] Disk encryption + restrictive file permissions: session transcripts and
agent memory live on this host in plain files
## 5. Before go-live
openclaw security audit
# Consider the documented --deep mode, then review any proposed --fix changes.
# Official model: identity first, scope next, assume model manipulation.
# If this boundary is unfamiliar, keep the host isolated and seek qualified help.Use the Copy result button above to take the whole plan. Checklist items are grounded in current official OpenClaw guidance; verify the generated plan against the linked sources.