Harden macOS for OpenClaw

Lock down your Mac before running AI agents. Covers all 15 Clawkeeper macOS security checks (11 host hardening + 4 network).

Critical Settings

These three checks carry the highest weight in Clawkeeper's scoring. Fix them first.

Enable the macOS Firewall

$ sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

The firewall blocks unsolicited inbound connections. Without it, any service OpenClaw starts (like a local MCP server) could be reachable from the network.

firewall

Verifies the macOS application firewall is enabled

Enable FileVault

$ sudo fdesetup enable

FileVault encrypts your startup disk. If your laptop is stolen, your OpenClaw config, API keys, and conversation history stay protected.

filevault

Checks that FileVault full-disk encryption is active

Save your recovery key

When you enable FileVault, you'll get a recovery key. Store it in a password manager — not on the same Mac.

Use a standard (non-admin) account

Create a standard user for daily work and only switch to admin for installations. This limits what a compromised OpenClaw skill can do.

$ System Preferences → Users & Groups → Add non-admin account

admin_user

Warns if the current user has admin privileges

Privacy & Telemetry

Disable features that leak data. Each is a separate Clawkeeper check.

Siri & Dictation

Disable Siri to prevent voice data from being sent to Apple servers.

System Preferences → Siri & Spotlight → Disable "Ask Siri"

siri

Checks that Siri is disabled

Location Services

Unless you need location-aware skills, disable system-wide location services.

System Preferences → Privacy & Security → Location Services → Off

location_services

Checks that location services are disabled

Bluetooth

Disable Bluetooth when not in active use to reduce the wireless attack surface.

$ sudo defaults write /Library/Preferences/com.apple.Bluetooth ControllerPowerState -int 0

bluetooth

Checks Bluetooth is disabled when not needed

AirDrop

AirDrop enables file receiving from nearby devices. Set to "No One" or "Contacts Only".

$ defaults write com.apple.sharingd DiscoverableMode -string "Off"

airdrop

Checks that AirDrop is restricted or disabled

Analytics & Diagnostics

Opt out of sharing analytics data with Apple and third-party developers.

System Preferences → Privacy & Security → Analytics & Improvements → Disable all

analytics

Verifies analytics sharing is disabled

Spotlight Suggestions

Spotlight sends search queries to Apple. Disable Spotlight Suggestions to keep searches local.

System Preferences → Siri & Spotlight → Uncheck "Spotlight Suggestions"

spotlight

Checks that Spotlight Suggestions are disabled

iCloud Sync

If your OpenClaw workspace is in an iCloud-synced folder, config files and secrets get uploaded to Apple servers. Move your workspace outside of iCloud.

icloud

Warns if workspace is inside an iCloud-synced directory

Automatic Login

Disable automatic login so a password is required at boot. Especially important for laptops.

$ sudo defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null

automatic_login

Checks that automatic login is disabled

Network Services

Disable sharing services that expose your machine to the local network.

Disable Screen Sharing

$ sudo launchctl disable system/com.apple.screensharing

screen_sharing

Verifies Screen Sharing (VNC) is disabled

Disable Remote Login (SSH)

$ sudo systemsetup -setremotelogin off

If you need SSH, restrict it to specific users with AllowUsers in sshd_config.

remote_login

Checks that Remote Login (sshd) is disabled or restricted

Disable Bonjour / mDNS

$ sudo defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements -bool true

mdns_bonjour

Checks that mDNS/Bonjour advertising is suppressed

Enable Network Isolation

If you run OpenClaw in Docker, ensure the container can't reach your LAN. Use Docker's internal network mode.

network_isolation

Verifies network isolation between OpenClaw and the LAN

Complete 15-Check Checklist

clawkeeper — host hardening + network

$ npx clawkeeper scan --phase host_hardening,network

PASS firewallPASS filevaultPASS admin_userPASS siriPASS location_servicesPASS bluetoothPASS airdropPASS analyticsPASS spotlightPASS icloudPASS automatic_loginPASS screen_sharingPASS remote_loginPASS mdns_bonjourPASS network_isolation

─────────────────────────────────

15/15 checks passed. Grade: A

Automate it

Run clawkeeper scan after every macOS update — system preferences can reset during upgrades.

Automate these checks with Clawkeeper

One command scans your entire OpenClaw deployment and gives you an A-F security grade.