clawopsBLOCK
Deploy and operate self-hosted OpenClaw on AWS, GCP, Azure or your own VM, from the command line or from your agent. A CLI and an MCP server over one implementation, with reviewable deploy plans, day-two operations, hardening, and private Tailscale networking.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@clawops/cli) [](https://www.npmjs.com/package/@clawops/cli) [](https://glama.ai/mcp/servers/dfridkin/clawops) [](https://mcpservers.org/servers/dfridkin/clawops)
MCP-native infrastructure ops for OpenClaw, with read-only mode, destructive-action confirmation, and audit logs built in.
clawops is a CLI and MCP server for deploying and operating self-hosted OpenClaw instances. Provision on AWS, GCP, Azure, or any Linux VM, then manage day-to-day operations from the terminal, or let Claude Code and Cursor drive them through typed MCP tools with explicit safety controls.
What's new: 2.0.1 and 2.0 release notes below, and the full history in CHANGELOG.md.
Who this is for
- OpenClaw users who want the simplest path to self-hosting across cloud or local VMs, with
reliable deploy, status checks, logs, backups, and upgrades in a single CLI.
- Claude Code / Cursor / MCP users looking for a real-world reference implementation of safe
infrastructure operations through MCP. Typed tool schemas, read-only mode, destructive-action confirmation, and audit logs.
- Self-hosted AI and local-first developers who want to run their own AI assistant without
committing to Kubernetes, a managed SaaS platform, or a single cloud provider.
What clawops does
- Provisions and tears down OpenClaw infrastructure on AWS, GCP, Azure, and local VMs using
the Pulumi Automation API. You do not install Pulumi; clawops installs the CLI it needs into ~/.clawops/.pulumi-cli on first use.
61ae9c0019c0OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add cli -- npx -y @clawops/[email protected] mcp serve
Exposed tools (35)
16 read · 14 write · 5 destructive. Blast radius: 5 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
TODO_VERB | read | TODO: one sentence describing what the command does |
agents | read | Manage OpenClaw agents (list | logs <name>) |
apply | write | Apply a Maker plan JSON produced by |
audit | read | Report missing secrets and unresolvable $secret: refs |
backup | write | Create an OpenClaw backup, or restore one into a staging directory |
bad | read | nope |
bug | read | Open a pre-filled GitHub issue with system context from clawops doctor |
clawops | write | Deploy and manage self-hosted OpenClaw instances across clouds |
config | write | Manage OpenClaw gateway configuration (get | set | unset) |
delete | destructive | Remove a stored secret |
destroy | destructive | Destroy all resources in a stack (irreversible) |
doctor | read | Check system prerequisites, config, SSH keys, and cloud credentials |
down | destructive | Destroy all provisioned resources for a stack |
gateway | write | Manage the OpenClaw gateway daemon (status | restart | update [version]) |
harden | write | Apply security hardening modules to a deployed stack |
help | read | Show available commands and global flags |
init | read | Initialise clawops: choose provider, configure state backend, generate SSH key |
install | write | Interactively wire clawops into AI editors (Claude Desktop, Claude Code, Cursor, ...) |
list | read | List all stored secrets and their status |
logs | read | Stream gateway logs from the remote instance |
mcp | read | MCP server operations |
migrate | write | Move a 1.x OpenClaw deployment onto the 2.0 runtime contract |
monitor | read | Live dashboard: gateway health, container status, resource usage, log tail |
plan | write | Generate a Maker deploy plan without applying it |
rotate | write | Update a secret and re-apply config to a running stack |
secret | destructive | Manage clawops secrets (list | set | delete | rotate | audit) |
serve | write | Start the clawops MCP server |
set | write | Create or update a secret |
setup | write | Interactive wizard: configure and deploy an OpenClaw stack |
ssh | read | Open an SSH session to the stack instance |
stacks | destructive | Manage clawops stacks (list | delete <name>) |
status | read | Show current stack status: outputs, region, provisioned time |
tunnel | read | Forward the OpenClaw gateway port to localhost |
up | write | Provision and deploy an OpenClaw stack |
wire | read | Wire the gateway AI as an MCP client of clawops (WO-28) |
Trust audit
BLOCKgrade F · trust 53/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (18 observation(s))
- Network
- declared (9 observation(s))
- Shell
- declared (15 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const spec = yaml.load(raw) as McpSpec
const catalog = yaml.load(fs.readFileSync("spec/models.yaml", "utf8"));const catalog = yaml.load(fs.readFileSync("spec/integrations.yaml", "utf8"));const modelsRaw = yaml.load(readFileSync(path.join(specDir, 'models.yaml'), 'utf-8'))
const integrationsRaw = yaml.load(readFileSync(path.join(specDir, 'integrations.yaml'), 'utf-8'))
file: 'src/harden/modules/tailscale.ts', from: " const r = await exec(`${sudo}sh -c ${shellQuote(join)}`, { stdin: key })", to: " const r = await exec(`${sudo}sh -c ${shellQuote(join + '\\n' + kfile: 'src/openclaw/restore.ts', from: ' const asideErr = await move(exec, stateDir, preserved)', to: ' const asideErr = await exec(`rm -rf ${shellArg(stateDir)}`).then(() => null)', test: 'tests/opfile: 'src/openclaw/restore.ts', from: ' const parkErr = await move(exec, stateDir, keptFailed)', to: ' const parkErr = await exec(`rm -rf ${shellArg(stateDir)}`).then(() => null)', test: 'testsconst { stdout: sentinel } = await exec(`test -f ${SENTINEL} && echo yes || echo no`)const { stdout: active } = await exec(ssh: { keyPath: path.join(home, 'id_ed25519'), knownHostsPath: path.join(home, 'known_hosts') },ssh: { keyPath: '/probe/id_ed25519', knownHostsPath: '/probe/known_hosts' },message: `SSH private key file: (the key file on your computer used to log in — e.g. ~/.ssh/id_ed25519)`,
const authorizedKeysPath = path.join(os.homedir(), '.ssh', 'authorized_keys')
success('SSH public key is already in authorized_keys.')'http://169.254.169.254/latest/meta-data/instance-id',
'http://169.254.169.254/metadata/instance?api-version=2021-02-01',
'http://metadata.google.internal/computeMetadata/v1/instance/id',
'-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIPPf60xCO0DaINAtOfOAMqn1MD4023YeF98CSxEQy2lG\n-----END PRIVATE KEY-----\n',
-----BEGIN OPENSSH PRIVATE KEY-----
writeFileSync(wrongKeyPath, '-----BEGIN OPENSSH PRIVATE KEY-----\ninvalid\n-----END OPENSSH PRIVATE KEY-----\n')
'-----BEGIN PRIVATE KEY-----\n' +
delete, destroy, down, secret, stacks
import { success, failure, info } from '../../output/human.js'import { printJson, jsonOk } from '../../output/json.js'Gates applied: no_behavioural_pass.
61ae9c0019c0full audit observations/trust-audit/mcp-server/dfridkin__clawops.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 61ae9c0019c0 | BLOCK | F | 53 | first audit |
Questions
What is the clawops MCP server?
Deploy and operate self-hosted OpenClaw on AWS, GCP, Azure or your own VM, from the command line or from your agent. A CLI and an MCP server over one implementation, with reviewable deploy plans, day-two operations, hardening, and private Tailscale networking.
What tools does clawops expose?
35 in total: 16 read-only, 14 that write, and 5 that can delete or overwrite (delete, destroy, down, secret, stacks). Every one is listed on this page with its risk.
Is clawops safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (53/100) and found 18 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 5 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does clawops need?
No credential environment variables were found in its source, so it appears to need none.
How does clawops run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as clawops-site at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (61ae9c0019c0), read on 2026-10-11. The repository is watched and re-audited when it changes.