Clawkeeper vs OpenClaw Native Security
How Clawkeeper compares to OpenClaw's built-in openclaw security audit command.
OpenClaw's audit tells you if the front door is locked. Clawkeeper checks the front door, back door, windows, foundation, roof, alarm system, and the neighborhood. Clawkeeper starts where OpenClaw's audit stops.
At a Glance
| Clawkeeper | OpenClaw Native | |
|---|---|---|
| Type | External scanner + fleet dashboard | Built-in CLI command |
| Checks | 55 automated across 5 phases | ~10-15 (config + permissions) |
| Scope | Full-stack: host + network + container + config + credentials | OpenClaw config and runtime only |
| Auto-Fix | Interactive remediation for 20+ issues | --fix flag for some issues |
| Dashboard | Web dashboard with history and alerts | None (terminal output) |
| Requires OpenClaw | No (pure bash, zero deps) | Yes |
| Grading | A-F letter grade + 0-100 score | Pass/warn/fail per check |
OpenClaw Configuration
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| gateway.bind mode | ||
| Gateway authentication | ||
| Web control UI (controlUI) | ||
| mDNS discovery mode | ||
| exec.ask consent mode | ||
| Log redaction | ||
| Config file permissions | ||
| Sandbox mode | ||
| DM scope & policy | ||
| Filesystem restriction |
Advanced Gateway Security
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| Elevated tool access | ||
| Browser control exposure | ||
| Group access policy (requireMention) | ||
| Plugin allowlist | ||
| Trusted proxy configuration | ||
| Dangerous tool deny list | ||
| Live gateway probe (--deep) |
Host OS Hardening
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| Firewall (macOS + Linux UFW) | ||
| Disk encryption (FileVault + LUKS) | ||
| User account security | ||
| Bluetooth / AirDrop / Siri | ||
| Analytics & telemetry | ||
| Auto-login / Location / Spotlight | ||
| SSH hardening (Linux) | ||
| Fail2ban | ||
| Auto-updates | ||
| Unnecessary services |
Network Security
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| mDNS broadcast detection | ||
| Open ports audit | ||
| Network isolation review | ||
| Remote login / screen sharing |
Container Security
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| Non-root user | ||
| Capabilities (drop ALL) | ||
| Privileged mode | ||
| no-new-privileges | ||
| Read-only root filesystem | ||
| Port binding (localhost only) | ||
| Memory / CPU limits | ||
| Network mode isolation | ||
| Sensitive volume mounts |
Credentials & Secrets
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| Config file credential scan | ||
| Shell history scan | ||
| MEMORY.md credential scan | ||
| Session log credential scan | ||
| Credential store permissions | ||
| OAuth profile permissions | ||
| .env file permissions | ||
| Session prompt injection scan | ||
| Memory prompt injection scan | ||
| Session rogue command scan | ||
| Log file content scan | ||
| detect-secrets CI integration |
Skills & SOUL.md
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| Dangerous install commands | ||
| Secret injection detection | ||
| Data exfiltration patterns | ||
| SOUL.md prompt injection | ||
| SOUL.md base64 / Unicode steganography | ||
| SOUL.md credential leaks | ||
| Skills prompt injection detection |
CVE & Version
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| Known CVE detection | ||
| Version currency check |
Monitoring & Reporting
| Feature | Clawkeeper | OpenClaw |
|---|---|---|
| A-F letter grade + score | ||
| Fleet dashboard | ||
| AI-powered security insights | ||
| Score trend tracking | ||
| Historical trending | ||
| Email & webhook alerts | ||
| Skill Marketplace (13K+ skills) | ||
| Team management |
Where OpenClaw Native Excels
Live gateway probing — The --deep flag probes live gateway connections, detecting real-time exposure that static config analysis can miss.
Zero setup — Already built into OpenClaw. No additional installation or configuration needed.
detect-secrets CI integration — Provides a CI-level secret scanning baseline workflow for code repositories.
OpenClaw's openclaw security audit is a CLI command for OpenClaw gateway internals. It has no awareness of Claude Code and cannot monitor, manage, or enforce policies on Claude Code sessions.
| Feature | Clawkeeper | OpenClaw Native |
|---|---|---|
| Claude Code Runtime Shield (55+ patterns, PreToolUse blocking) | ||
| Claude Code workstation fleet management | ||
| Claude Code team policies (blocked tools, paths, commands, skills) | ||
| MCP skill monitoring and policy enforcement | ||
| GitHub integration (auto-PR hooks config) | ||
| JAMF / MDM deployment support | ||
| Identity provider sync (Entra, Google, Okta) |
OpenClaw's native audit is scoped to the OpenClaw gateway. It cannot monitor Claude Code tool calls, enforce team policies, or manage developer workstations.
Recommendation
Use both. Run openclaw security audit for its built-in checks and live probing. Run Clawkeeper for the 40+ additional checks covering your host OS, containers, network, credentials, CVEs, and skills. For Claude Code security monitoring, Clawkeeper is the only option available. The CLI is free — there's no reason not to layer both.