Clawkeeper by RAD Security
Tutorials

How to Install OpenClaw Securely

Three installation methods with security verification for each approach.

Prerequisites

You need Homebrew and Node.js 18+ installed.

Install Homebrew

$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Install Node.js

$ brew install node
homebrew

Verifies Homebrew is installed and up to date

node

Checks Node.js version meets minimum requirements

Skip manual installation with Cloud Deploy
Clawkeeper Cloud Deploy provisions a fully managed instance with OpenClaw pre-installed and hardened. Choose from three frameworks: OpenClaw, NemoClaw (with NVIDIA NeMo Guardrails), or NanoClaw (lightweight channel bots).

Method 1: npm Native Install

The simplest approach — installs OpenClaw directly on your host machine.

1

Install OpenClaw globally

$ npm install -g @anthropic-ai/openclaw
2

Verify the installation

$ openclaw --version

Confirm you see a version number like 0.2.x or later.

3

Run your first scan

$ npx clawkeeper scan
native_openclaw

Detects native OpenClaw installation path and version

Recommended
Use a version manager like nvm or fnm to avoid global npm permission issues.

Method 2: Docker (Recommended)

Docker isolates OpenClaw from your host, reducing the attack surface.

1

Install Docker

$ brew install --cask docker

Then launch Docker Desktop from Applications.

docker_installed

Checks Docker is installed and the daemon is running

2

Pull and run OpenClaw

$ docker run -it --rm -v $(pwd):/workspace anthropic/openclaw
3

Verify with Clawkeeper

$ npx clawkeeper scan
linux_docker

Validates Docker group membership and daemon status on Linux

Why Docker?
Docker adds a layer of isolation — if a skill is compromised, it can't reach your host filesystem directly. See the Docker Deployment tutorial for a full production setup.

Method 3: VPS / Cloud Server

Running OpenClaw on a remote server requires additional hardening.

1

Secure SSH access

$ ssh-keygen -t ed25519 -C openclaw-server

Copy the public key to your server and disable password authentication.

linux_ssh_hardening

Audits SSH config: key auth, root login, port settings

2

Configure the firewall

$ sudo ufw allow 22/tcp && sudo ufw allow 443/tcp && sudo ufw enable
linux_firewall

Ensures UFW/firewalld is active with sensible rules

3

Create a dedicated user

$ sudo adduser openclaw --disabled-password && sudo usermod -aG docker openclaw

Never run OpenClaw as root.

linux_user_account

Verifies a non-root user account is in use

4

Install and scan

$ su - openclaw -c 'npm install -g @anthropic-ai/openclaw && npx clawkeeper scan'

What a First Scan Looks Like

clawkeeper scan

$ npx clawkeeper scan

Running 55 security checks...

PASS homebrew — Homebrew is installed

PASS node — Node.js v20.11.0

PASS docker_installed — Docker 24.0.7

FAIL firewall — macOS firewall is disabled

FAIL filevault — FileVault is not enabled

─────────────────────────────────

Security Grade: C (72/100)

2 critical issues found. Run with --fix for remediation steps.

Common Mistakes

Don't run as root
Installing OpenClaw with sudo npm install -g can lead to permission issues and weakens the security boundary between OpenClaw and your system.
Don't skip verification
Always run openclaw --version after installation. A failed install can leave a partial binary that silently breaks skills.

Automate these checks with Clawkeeper

One command scans your entire OpenClaw deployment and gives you an A-F security grade.