CLI Reference

Clawkeeper is a single bash script that provides an interactive security scanner for OpenClaw deployments. Run it with no arguments to get an interactive menu, or pass a command directly.

Interactive menu

When you run clawkeeper.sh with no arguments (or clawkeeper.sh start), you get an interactive menu:

What would you like to do?

  1) Scan existing OpenClaw  — audit your current installation (read-only)
  2) Deploy OpenClaw securely — full setup wizard with hardened defaults
  3) Uninstall OpenClaw      — securely remove and wipe all data

Choose [1/2/3]:

Commands

`setup`

Interactive hardening wizard. Runs all phases of checks with auto-remediation prompts. This is the default experience when you choose option 2 from the menu.

clawkeeper.sh setup

`deploy`

Forces a full deployment even if OpenClaw is already installed. Same checks and prompts as setup.

clawkeeper.sh deploy

`scan`

Read-only security audit. Runs all checks but never modifies your system. Equivalent to choosing option 1 from the interactive menu.

clawkeeper.sh scan

`uninstall`

Securely removes OpenClaw and wipes sensitive data (containers, images, volumes, configs).

clawkeeper.sh uninstall

`agent`

Manages the Clawkeeper SaaS monitoring agent. The agent runs scheduled scans and reports results to the dashboard.

clawkeeper.sh agent --install     # Configure API key + install scheduled scans
clawkeeper.sh agent --status      # Show agent status
clawkeeper.sh agent --uninstall   # Remove agent and config
clawkeeper.sh agent run           # Run a one-off agent scan (used by scheduler)

`help`

Shows usage information.

clawkeeper.sh help

Flags

Flag	Description
`--non-interactive`	Don't prompt for fixes. Equivalent to `scan` mode.
`--report FILE`	Save a text report to the specified file path.
`--help`, `-h`	Show usage information and exit.

Deployment modes

During setup or deploy, Clawkeeper asks you to choose a deployment mode:

native — runs OpenClaw directly via npm. Simpler setup, no container overhead.
docker — runs OpenClaw in Docker. Better isolation, recommended for production.

Scan phases

Every scan runs checks across 5 phases in order:

Host Hardening (18 checks) — OS-level security: firewall, disk encryption, SSH hardening, services, user accounts
Network (6 checks) — network isolation, exposed services, open ports, mDNS
Prerequisites (7 checks) — required software: Homebrew/apt, Node.js, Docker (varies by platform and deployment mode)
OpenClaw Installation — deployment mode selection and OpenClaw setup (not scored)
Security Audit (24 checks) — OpenClaw runtime config, credential exposure, skills vetting, SOUL.md integrity, session hardening, CVE vulnerability audit, container security (Docker mode)

See Security Checks for the full list of what's checked in each phase.

CVE vulnerability audit

Phase 5 (Security Audit) includes a live CVE vulnerability check. The scanner:

Fetches the latest CVE feed from the OpenClawCVEs repository
Detects your installed OpenClaw version
Compares it against known affected version ranges
Reports individual FAILs for each matching CVE with severity, CVSS score, and upgrade guidance

This check requires network access and python3 for version comparison. It degrades gracefully if either is unavailable (reported as SKIPPED).

Report output

When using --report, the output file contains a plain-text summary:

Clawkeeper Security Report
Host: my-macbook.local
Platform: macOS 15.3
Date: 2026-02-17

Phase 1: Host Hardening
  PASS  macOS Firewall
  FAIL  FileVault Disk Encryption
  ...

Phase 5: Security Audit
  FAIL  CVE-2026-25253 (critical, CVSS 9.8): Remote Code Execution
  PASS  OpenClaw CVE Audit (no known vulnerabilities)
  ...

Score: 72%
Grade: C

Exit codes

0 — scan completed (regardless of grade)
1 — error (unknown command, missing arguments)