Installation

Looking for Claude Code setup? See Claude Code Setup for hooks configuration, or JAMF / MDM Deployment for fleet-wide deployment.

This page covers installing the Clawkeeper CLI security scanner.

CLI (recommended)

One command installs the scanner. Pure bash with an optional gum dependency for styled output (auto-installed on first run, with ANSI fallback).

curl -fsSL https://clawkeeper.dev/install.sh | bash

This downloads clawkeeper.sh to your machine and makes it executable. Run clawkeeper.sh to launch the interactive menu, or pass a command directly:

clawkeeper.sh scan        # Read-only security audit
clawkeeper.sh setup       # Interactive hardening wizard
clawkeeper.sh deploy      # Full install + deployment

The CLI is free — no account needed. All 55 checks, auto-fix, and local grading work without a dashboard account.

Supported platforms

• macOS — 11 host hardening checks, 4 network checks, full prereq + audit suite
• Linux — Ubuntu, Debian, RHEL, CentOS, Fedora, Arch. 7 host hardening checks, 2 network checks, full prereq + audit suite
• Windows — install WSL2, then run Clawkeeper from within WSL

Dashboard setup

After installing the CLI, you can optionally connect scans to the web dashboard:

1. Create an account at clawkeeper.dev/signup
2. Generate an API key in Settings
3. Install the agent:

export CLAWKEEPER_API_KEY="ck_live_..."
clawkeeper.sh agent --install

The agent runs scheduled scans and uploads results automatically. Free accounts get 1 host, 1 Claude Code workstation, and 7-day history. Upgrade to Pro for 3 workstations, or Team for unlimited — plus CVE intelligence, AI insights, and alerting.

Cloud Deploy (Pro / Team / Enterprise)

Deploy a fully managed OpenClaw instance without installing anything locally. The wizard provisions a hardened VM with the agent, Runtime Shield, and Tailscale Console pre-configured. Cloud hosts are sold as an add-on starting at $20/mo (Small) — see the Plans page for pricing details.

1. Upgrade to a paid plan
2. Go to Hosts → Deploy Cloud Instance
3. Pick a region, plan, and paste your LLM API key
4. Click Deploy — the instance is ready in 2–4 minutes

See Cloud Deploy for the full reference and Console for the security model.

macOS Desktop App (Coming Soon)

A native macOS app with a visual interface for scanning and deployment. The desktop app is currently in development.

Kubernetes (Enterprise)

Kubernetes deployment with hardened defaults is available for Enterprise customers — contact sales to get started.

Environment variables

Set your API key before running the agent:

export CLAWKEEPER_API_KEY="ck_live_..."
clawkeeper.sh agent --install

See Configuration for more details.