Continuous Security Monitoring

Automate Clawkeeper scans, track grades over time, and get alerted when your security posture drops.

Agent Installation

Install the Clawkeeper agent

$ clawkeeper agent --install

The agent registers your host with the Clawkeeper dashboard and configures automated scanning. It runs as your user (not root).

API key required

You need a Clawkeeper API key. Generate one at Settings → API Keys.

Automated Scheduling

The agent installs a scheduler that runs Clawkeeper at regular intervals.

launchd configuration

The agent creates a launch agent at:

~/Library/LaunchAgents/dev.clawkeeper.agent.plist

dev.clawkeeper.agent.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>dev.clawkeeper.agent</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/bin/clawkeeper</string>
    <string>scan</string>
    <string>--upload</string>
  </array>
  <key>StartInterval</key>
  <integer>3600</integer>
  <key>StandardOutPath</key>
  <string>/tmp/clawkeeper.log</string>
  <key>StandardErrorPath</key>
  <string>/tmp/clawkeeper.err</string>
</dict>
</plist>

$ launchctl load ~/Library/LaunchAgents/dev.clawkeeper.agent.plist

Verify the scheduler

$ launchctl list | grep clawkeeper

Grading System

Clawkeeper assigns a letter grade (A-F) based on the percentage of passed checks.

Grade	Score	Meaning
A	95 – 100	Excellent — nearly everything passing
B	85 – 94	Good — a few issues to address
C	70 – 84	Fair — multiple security gaps
D	50 – 69	Poor — significant hardening needed
F	0 – 49	Critical — most checks failing

All checks are weighted equally. Skipped checks are excluded from the denominator and do not penalize your score. See the Grading docs for the full scoring formula.

Dashboard & Alerts

View scan history on the dashboard

Paid plan dashboards (Pro, Team, Enterprise) show grade history over time, per-check trends, and drift detection (when a previously-passing check starts failing).

Paid feature

Grade history and trend charts require a Pro, Team, or Enterprise plan. Free users see their latest scan only.

Configure alerts

Set up email alerts for grade drops. You'll be notified when:

Your grade drops by one or more letters
A critical check starts failing
A new CVE affects your OpenClaw version

Configure alerts at Dashboard → Settings → Alerts.

Grade Drop Triage

Investigate a grade drop

$ clawkeeper scan --json | jq '.checks[] | select(.status == "FAIL")'

This shows only failing checks. Common causes of grade drops:

OS update — system preferences can reset (firewall, FileVault)
New OpenClaw version — config format changes, new check requirements
Skill install — new skill triggers a skills_security finding
Config change — someone modified config.json or .env

Grade drop investigation

$ clawkeeper scan --json | jq '.checks[] | select(.status == "FAIL")'

{

"check_name": "firewall",

"status": "FAIL",

"detail": "macOS firewall is disabled"

}

→ macOS update reset firewall setting

Multi-Host Scaling

Scale to multiple hosts

For teams running OpenClaw across multiple machines, install the agent on each host. The dashboard aggregates results per-host with a fleet-wide security overview.

$ for host in web1 web2 web3; do ssh $host 'curl -fsSL https://clawkeeper.dev/install.sh | bash -s -- agent --install'; done

Deploys the agent to three hosts via SSH.

Enterprise feature

Fleet-wide dashboards, role-based access, and SSO are available on the Enterprise plan.

Automate these checks with Clawkeeper

One command scans your entire OpenClaw deployment and gives you an A-F security grade.