Last verified

OpenClaw Foundation · OpenClaw

OpenClaw: a personal assistant that runs on your machine

Free software with a real bill attached — and the widest blast radius of anything we cover.

OpenClaw is a personal AI assistant, not a coding agent. It runs as a daemon on your own computer, answers you inside WhatsApp, Telegram, Slack or iMessage, and can reach your files, your shell and your browser. The client is MIT-licensed and free; you pay whichever model you attach. That combination — full system access, free to install, wired to your inbox — is both the appeal and the whole risk.

Cheapest way in Free — you pay the model
Free tier Yes
Ways to buy it 5
Oldest check 2026-08-21
§ 01 / WHAT IT IS

What it actually is.

The name arrives in a category it does not belong to, so start with the correction.

OpenClaw is not a coding agent. It is a personal assistant — the vendor's own description is an assistant that runs on your devices and meets you in the channels you already use. In practice that means it sorts your inbox, manages a calendar, drives a browser and answers you in the messaging app you already have open, from a daemon it calls the Gateway running on your own hardware.

It can write code, and this is where the confusion starts. Coding is one installable skill among many, and the popular way to do it is stranger still: a community plugin runs Claude Code and Codex as managed background sessions. So the honest description of OpenClaw-as-coding-tool is a front end that delegates to the agents we cover elsewhere — which is why this page does not compare it to them on coding, and why the first entry under "who it is wrong for" sends you to them.

The scale is not in doubt. The repository carries 386,947 stars and shipped 246 published versions of its package; it started life as Clawdbot in late 2025, spent three days as Moltbot, and settled on OpenClaw at the end of January 2026. What it does not have is a company. The copyright sits with the OpenClaw Foundation, the licence is MIT, and there is nobody to buy a support contract from.

We have not run it ourselves. Doing so honestly would mean installing a daemon with access to a real filesystem and pairing it to real messaging accounts, and this desk does not sign into personal accounts to test software. Everything below is read from the vendor's own repository and documentation, dated, and linked — and where a claim needs evidence we do not have, the page says so instead of implying a test.

§ 02 / WHAT IT COSTS

What it costs.

Full pricing →

Nothing, and then rather more than nothing. The client is free software with no paid tier, no hosted edition and no fee on its plugin registry — so every route on the pricing page buys a model rather than the tool. Run it against a model on your own machine and the bill is genuinely zero. Attach it to a Claude or ChatGPT plan and it spends an allowance you already bought. Hand it an API key and it bills per token — plus four other taps that an assistant living in your messages opens quietly, which is the part nobody counts.

Route Bought as Price
Local model Own hardware Your hardware
Your own API key API key At model rates
Claude Pro Subscription $20/mo $17/mo billed annually
ChatGPT Plus Subscription $20/mo
GitHub Copilot Pro Per seat $10/seat/mo
§ 03 / WHEN NOT TO

Who it is wrong for.

Structural reasons rather than complaints about quality — the cases where no amount of configuration makes this the right tool.

You want something to write code Then you want a coding agent, and the two we cover in depth are better answers. OpenClaw's coding ability arrives as a skill, and the popular implementation of that skill launches Claude Code or Codex underneath — so choosing OpenClaw for coding usually means choosing one of them anyway, with an extra layer in between. The layer earns its place only if you specifically want to kick off work from a chat window while away from your desk.
More than one person will use it The vendor draws this line itself, in unusually plain words: OpenClaw is not a hostile multi-tenant security boundary for multiple adversarial users sharing one agent or gateway. If several people who do not fully trust each other can message the same tool-enabled agent, they share its delegated authority over your machine. The documented answer is a separate gateway per trust boundary — ideally a separate operating-system user or host — which means a team deployment is several installations, not one.
The machine holds something you cannot risk This is an agent with shell access wired to inbound messages from the internet, and its own documentation tells you to treat those messages as untrusted input. The published record reflects the difficulty: 752 security advisories for the package between 4 February and 2 July 2026, including 26 rated critical. Read that carefully in both directions — the volume is real, and so is the fact that the rate fell from 334 in March to 41 in July as the project was audited after going viral. It is a codebase being actively hardened, not an abandoned one. But the recent fixes are exactly the failure you would fear: message-channel callbacks slipping past command allowlists, permissions bound to a display name someone can change. On a machine holding client data or production credentials, that risk is structural rather than a matter of configuration.
You need someone to be accountable There is no vendor here. No SLA, no support contract, no invoice, no company to escalate to — the copyright belongs to a foundation and the licence disclaims warranty in the usual terms. For regulated work, or anywhere procurement needs a counterparty, that ends the conversation regardless of how good the software is.
You will not keep it updated Free software with this much surface area carries an operating cost that is measured in attention rather than money. Releases move across four channels at once — stable, extended-stable, beta and alpha — on calendar versioning, and security fixes land in that stream continuously. An install that ran fine six months ago and was never touched again is the worst configuration on this page.
§ 04 / HOW IT COMPARES

Nothing to set it beside, yet.

All comparisons →
!
No head-to-head covers this tool yet. Comparisons live at /compare/, where every pair is written and dated on its own terms, and nobody has written one involving this tool. We will not manufacture a pair here to fill the slot: a second copy of a comparison competes with the real one for the same query. The pairs worth writing are against other assistants rather than the coding agents, which OpenClaw delegates to rather than competes with.
§ 05 / ALTERNATIVES

If not this.

See the list →

Eight tools, grouped by the reason you are actually leaving — wanting a coding agent, wanting a company behind it, wanting something that does not need a machine of its own, or wanting a smaller blast radius. Each carries its own published entry price, read on the day of writing.

Frequently asked.

What people search next.

Q · 01 Is OpenClaw a coding agent? +
No. It is a personal assistant that can also code, and its popular coding setup runs Claude Code or Codex as background sessions underneath. If coding is the job, start with those two — this page exists because the brand is large enough that people arrive looking for it by name, not because we think it is the right coding tool.
Q · 02 Is OpenClaw safe to install? +
It depends entirely on what else is on the machine. It is designed to have shell and filesystem access and to accept messages from the internet, so its worst case is severe by construction. The package accumulated 752 published advisories between February and July 2026, with the rate falling sharply through that period as the project was audited. A dedicated machine or virtual server, sandboxing enabled and the built-in security audit run after any config change is the shape of a sensible install; the family laptop is not.
Q · 03 Who makes OpenClaw, and can I pay them? +
The copyright belongs to the OpenClaw Foundation and the project began as one developer's side project under a different name. You cannot pay them for it — there is no commercial edition, hosted offering or support plan, and the plugin registry charges nothing. Whether that is a feature or a dealbreaker depends on whether you need someone accountable when it breaks.
Q · 04 Why was it renamed twice? +
It shipped as Clawdbot, became Moltbot in January 2026, and became OpenClaw within days. The package registry corroborates the timing — the current package was first published on 29 January 2026, while the repository dates to November 2025. The reasons given for the first rename circulate widely in the press but we could not confirm them from a primary source, so this page does not repeat them as fact.
Q · 05 Do I need to know how to code to run it? +
Not to use it, but yes to look after it. Installation is a single command and onboarding walks through model access, but it is a daemon you are responsible for: keeping it patched across four release channels, deciding on sandboxing, reviewing what the security audit reports, and revoking keys when you stop. Nobody else is going to do any of that.
§ 06 / EXPLORE

Keep reading.

Brand hub →
PRICING
What OpenClaw costs
Five routes, five taps
↗ ALTERNATIVES
If not OpenClaw
Eight tools, by reason
↗ TOOL HUB
Claude Code
The coding agent it delegates to
↗ TOOL HUB
Codex
The other one it delegates to
↗ CALCULATOR
Subscription vs API
Which route is cheaper for you
↗ SECTION
Every agent we cover
Priced and dated
↗
Y
Researched + verified by Yaroslav Vikhariev Founder · AI//COST · Verified Aug 21, 2026 · repository, docs, npm registry, GitHub Advisory Database
Methodology Report a correction More by Y.V.