OpenClaw Orange Book - A Complete One-Stop Manual from Beginner to Expert (PDF File)

Each Agent has an independent workspace directory in the file system, and all configurations, memories, and skills exist as plain text files. The core files include:

All configuration files are in pure Markdown or JSON format and can be modified directly with a text editor, without any specialized tools. This is the embodiment of the OpenClaw philosophy: everything is text.

Behind OpenClaw's technical choices is a clear design philosophy, directly inherited from the Unix philosophy: small tools, composable, text streams. Founder Peter Steinberger's view is very clear: "The CLI is the ultimate interface for agents to connect to the world." There is no need to write an integration for every service; as long as the Agent can run command-line commands, it can operate everything.

OpenClaw's system prompt may be the shortest among all AI Agent frameworks. There are only 4 core tools: Read (read files), Write (write files), Edit (edit files), Bash (execute commands). This is not a lack of functionality, but intentional. 4 tools are enough to cover almost all operating-system-level tasks. Fewer tools mean a shorter system prompt, less Token consumption, and faster responses.

MCP (Model Context Protocol) is a tool protocol standard proposed by Anthropic. Almost all AI Agent frameworks are integrating MCP, but OpenClaw deliberately does not support it.

OpenClaw's alternative is: the Agent directly calls CLI programs through the Bash tool, without the need for an intermediate protocol layer; for scenarios that truly require MCP, it bridges through the built-in mcporter skill; it forces the Agent to extend its own capabilities rather than consume prebuilt MCP tool sets.

The OpenClaw Agent can write, reload, and test its own extensions at runtime. This is one of the key reasons it appears "smarter" than other Agents: when it encounters an operation it does not know how to perform, it writes a skill to accomplish it; when it finds a bug in a skill, it modifies and reloads it, continuously improving its own toolchain in the loop.

Deployment Options

Overview of Deployment Methods

• Local Installation: suitable for developers and users who want complete control over their data, requires Node.js 22+, recommended for macOS/Linux users, completely free with no built-in model, relatively low difficulty.
• Docker Deployment: suitable for scenarios that require environment isolation, easy migration, or long-term operation on a server, requires Docker Engine, the first choice in China and beginner-friendly, no built-in model, medium difficulty.
• One-Click Deployment by Domestic Cloud Providers: the first choice for most domestic users, all mainstream cloud providers already support it, and the differences are mainly in pricing strategy and IM ecosystem integration.
• Alibaba Cloud: the platform with the richest domestic community resources, with preinstalled images, ready to use out of the box. Configured with 2 vCPU + 2 GiB memory + 40 GiB ESSD system disk, limited-time flash sale price of 9.9 yuan/month, annual regular discount as low as 68 yuan/year. Includes the qwen3.5-plus model by default, Bailian Coding Plan Lite is 10 yuan for the first month (18,000 times/month). Supports IM channels such as DingTalk and Feishu.
• Tencent Cloud: Four major IMs fully supported, and the Coding Plan model packages offer high cost-effectiveness. A 2-core 4GB configuration is recommended (the golden configuration), and a minimum 2-core 2GB can run it. The newcomer package 2-core 4GB is about 17 yuan/month, starting at 99 yuan/year. The Coding Plan starts at 7.9 yuan for the first month and includes models such as HY 2.0 Instruct, GLM-5, kimi-k2.5, and MiniMax-M2.5. It supports full coverage of the four major IMs: WeCom, QQ, DingTalk, and Feishu, and supports the "limited-time same-price renewal" campaign.
• Baidu AI Cloud: Lowest trial-and-error cost, with a first-month experience for 0.01 yuan (limited to 500 units per day). A 2-core 4GB 4M bandwidth configuration is recommended, normally 70-140 yuan/month. It integrates Wenxin series, Qwen series, and DeepSeek series models from the Qianfan platform. Its specialty is Baidu Search/Baidu Baike exclusive capabilities, and 7 official Qianfan Skills are already available on ClawHub.
• Huawei Cloud: Strongest enterprise-level security and compliance capabilities, suitable for enterprise users already in the Huawei ecosystem. The Flexus L instance price is about 85-155 yuan/month, with no particularly outstanding new user discount. AI models must be enabled separately in the MaaS console, and deployment takes more than 5 steps (create instance -> EIP -> security group -> install -> configure model). Advantages are enterprise-level security compliance, support for auto scaling, and a rich set of MaaS models.
• Volcano Engine: Deep Feishu integration, and the 19.8 yuan/month server + model combination package is currently the most cost-effective overall solution. A 2-core 4GB is recommended, and it supports two deployment methods: cloud server and cloud phone. The promotional price is 9.9 yuan/month, and the Ark Coding Plan combination package is 19.8 yuan/month (server + model). The Ark platform has a rich set of models and built-in availability. It supports Feishu (deep integration), WeCom, DingTalk, and QQ.
• Coze Code: A zero-threshold solution that requires no server, no coding, and no environment setup, completing deployment in 1 minute. A membership must be subscribed to deploy OpenClaw: ¥49/month (Basic) or ¥99/month (Advanced); the free version is not supported. Multiple built-in models are available: Seed 2.0, DeepSeek, GLM-4.7, etc., and third-party APIs can be connected. Its specialty is that models, web search, and image generation Skills are all configured by default, and Coze Code Skills can be loaded directly.

Skills are the capability extension units of OpenClaw. OpenClaw's Skills have three sources, listed from highest to lowest priority:

If a Skill with the same name exists at multiple levels, the higher priority overrides the lower priority. This means you can "rewrite" the behavior of a built-in Skill at the workspace level without affecting other projects.

ClawHub is OpenClaw's official skill marketplace, providing publishing and version management for public Skills, vector-search-based Skill discovery, download statistics and community ratings, and VirusTotal-partnered security scanning (but with limited coverage).

The OpenClaw Skills system has serious security risks. The ClawHavoc supply chain attack that broke out in early 2026 resulted in about 20% of Skills on ClawHub being confirmed as malicious, affecting more than 135,000 devices. Attackers "brainwashed" Agents by tampering with the SOUL.md and MEMORY.md files and implanted information-stealing trojans. Even more dangerous is that once installed, Skills have the same full permissions as the OpenClaw instance, with no sandbox isolation. An audit in March 2026 also found more than 100 newly added malicious Skills, including cryptocurrency stealers and backdoors. Users must review the source code before installing, and must never execute a Skill that asks to download files or enter passwords.

Model configuration

Model provider overview

• Built-in Providersincluding Anthropic, OpenAI, Google, Zhipu (zai), and others. No additional configuration is needed; just set the API Key to use them.
• Custom Providersincluding DeepSeek, Doubao, Kimi, and others, need to be manually added in models.providers.
• Fallback mechanismis the most core money-saving strategy: automatically switch to an alternative when the primary model is unavailable.

International models

• Anthropic Claudeis OpenClaw's default model provider and is recognized by the community as the model with the best Agent task performance. Claude Sonnet 4.6 is significantly ahead of other models in tool-calling accuracy and stability, with an input price of $3.00/1M tokens, an output price of $15.00/1M tokens, and a 200K context window.
  • Note: Anthropic has blocked OAuth authentication. Users who use Claude Pro/Max subscription accounts to connect to OpenClaw via OAuth will receive warnings or even have their accounts locked. The only currently legal path is to use an API Key (pay-as-you-go).
  • Money-saving tips: The Batch API offers a 50% discount (half price for both input and output), and Prompt Caching can reduce repeated context costs by up to 90%.
• OpenAI GPTseries, GPT-5.4 is the latest flagship, with an input price of $2.50/1M tokens (doubling to $5.00 after exceeding 272K context), an output price of $15.00/1M tokens, and a context window of 272K (standard) or 1.05M (ultra-long).
• Google Gemini's exclusive advantages are a 2M context window and generous free quota (Flash has free requests every day). Its multimodal capabilities are the strongest among the three. Gemini 3 Flash has an input price of only $0.50/1M tokens and an output price of $3.00/1M tokens, making it suitable as the model for Heartbeat and Cron jobs.

Domestic models

• DeepSeekIt is the king of value for money. DeepSeek-V3.2.2 input pricing is only $0.14/1M tokens, output $0.28/1M tokens, making it the most commonly used low-cost model in the OpenClaw community today. However, DeepSeek occasionally has latency or is even unavailable during peak hours, so it is not recommended as the only Provider—be sure to pair it with a Fallback model as a backstop.
• Zhipu GLMIt is the strongest choice for coding capability among domestic models. GLM-5 achieved the highest score among open-source models on SWE-bench, with pricing of only $0.80/1M input, $2.56/1M output. Even better, OpenClaw has a built-in zai Provider, making configuration extremely simple. GLM-4.5-Flash and GLM-4.7-Flash are completely free, making them very suitable for heartbeat tasks and simple conversations.
• Tongyi Qianwen Qwen 3.5 is the latest version released by Alibaba in February 2026 (397B total parameters/17B activated, MoE architecture, already open-sourced). Qwen 3.5 Coder input pricing is only $0.22/1M tokens, output $1.00/1M tokens, offering extremely high cost-effectiveness for coding-specific use.
• Doubao Seed 2.0 Pro input pricing is $0.47/1M tokens, output $2.37/1M tokens. It is a flagship reasoning model, benchmarked against GPT-5.2. Doubao 1.5 Lite-32k input pricing is only $0.042/1M tokens, making it one of the cheapest options currently available.
• Kimi K2.5 input pricing is $0.60/1M tokens, output $3.00/1M tokens. It is Moonshot AI's latest flagship, performing excellently in Chinese Agent and long-context scenarios.
• MiniMax M2.5 (230B parameters) scored 80.2% on SWE-Bench, with outstanding coding capability, input pricing $0.50/1M tokens, output $2.00/1M tokens.

Five Recommended Configuration Plans

• Plan One: Ultimate Cost Saving (monthly average <$5) Use DeepSeek-V3.2 ($0.14/$0.28) as the primary, Qwen 3.5 Plus ($0.40/$1.20) as the backup, GLM-4.5-Flash (free) for heartbeat/Cron, and DeepSeek-R1 ($0.55/$2.19) for reasoning tasks. Suitable for individual developers and learning/exploration. The risk is DeepSeek latency during peak hours, requiring Fallback as a backstop.
• Plan Two: Domestic Cost-Effectiveness (monthly average $5-15) Use GLM-5 ($0.80/$2.56) as the primary, DeepSeek-V3.2 ($0.14/$0.28) as the backup, Kimi K2.5 ($0.60/$3.00) for enhanced reasoning, and GLM-4.5-Flash (free) for simple tasks. Suitable for domestic users pursuing Chinese-language experience and stability. GLM-5 has strong coding capability and low latency.
• Plan Three: International Balance (monthly average $10-30) Use Claude Sonnet 4.6 ($3.00/$15.00) as the primary, Claude Haiku 4.5 or Gemini Flash for lightweight use, Claude Opus 4.6 for complex tasks (upgrade as needed), and Gemini Flash (free quota) for heartbeat/Cron. Suitable for users pursuing optimal Agent performance with sufficient budget. Claude performs best in Agent/tool-calling scenarios.
• Plan Four: Hybrid Optimal (monthly average $5-20, recommended) Use Claude Sonnet 4.6 for complex tasks, DeepSeek-V3.2 for daily conversation, Gemini Flash or local Ollama for heartbeat/scheduled tasks, and set the Fallback chain to Sonnet→Haiku→DeepSeek-V3.2. This is the best choice for most users, balancing performance and cost, with the Fallback mechanism automatically handling rate limits.
• Plan Five: Completely Free Option A is local Ollama + Qwen3.5-Coder:32B or Devstral-24B (requires 32GB RAM). Option B is a free API combination—GLM-4.5-Flash + ERNIE Speed + Gemini Flash. Suitable for privacy-sensitive and purely experimental use. The local option requires decent hardware.

Security and Cost

Security Model

• DM Pairing Protection: When an unknown user sends a direct message to your OpenClaw through any messaging channel (WhatsApp, Telegram, etc.), the system will not process the message but instead returns a pairing code; only after you manually approve it will the user's messages be processed. This prevents strangers from abusing your Agent (and your API quota).
• Group Sandbox Mode: In group environments, OpenClaw runs in sandbox mode by default. Each group's session is isolated from the others, and MEMORY.md (long-term memory) is loaded only in the main session of private chats and is not visible to groups. You can configure requireMention so that it responds only when @-mentioned.
• Tool Access Control: You can configure an allowlist (whitelist mode, allowing only the listed tools to be called) or a denylist (blacklist mode, prohibiting the listed tools). You can also completely disable browser (browser automation), canvas (Canvas visualization), and nodes (local device node control such as camera and screen recording).

Known Security Incidents

• CVE-2026-25253 is a remote code execution vulnerability: by forging the Origin header to bypass WebSocket verification, an attacker can connect to an unauthenticated instance and execute arbitrary code.
• ClawHavoc supply chain attack: about 20% of Skills on the ClawHub platform were implanted with malicious programs, affecting more than 135,000 devices.
• Anthropic bans OAuth: due to abuse issues, Anthropic prohibits Claude subscription accounts from connecting to OpenClaw via OAuth, retaining only the API Key access method.
• Google account ban incident: a large number of users triggered abuse detection due to high-frequency API calls by the Gmail Skill, resulting in their entire Google account being banned without warning.
• 30,000+ unauthenticated exposed instances: security scans found that a large number of public OpenClaw instance ports were completely open, posing serious risks of data leakage and remote control.
• MIIT security alert (March 8-9, 2026): for the first time, a domestic official institution issued a document on an open-source AI Agent project, pointing out that its "blurred trust boundary" characteristic makes it a high-value attack target.
• Malicious npm package impersonation incident (March 2026): a fake official installer distributed the GhostLoader remote access trojan via npm, stealing user credentials and crypto wallets.
• ClawJacked zero-click vulnerability (early March 2026): a malicious website could silently attack through the browser and completely take over the user's local OpenClaw instance without any user interaction.

Cost Control