OpenClaw Harness

OpenClaw is an open-source (MIT), local-first personal-assistant harness in TypeScript by Peter Steinberger (Peter Steinberger) and the OpenClaw Foundation. Unlike the coding-agent harnesses, its center of gravity is a long-lived Gateway daemon that connects one agent runtime to the ~20 messaging channels you already use — and it can orchestrate Claude Code / Codex as sub-CLIs. Kevin treats it as the swappable alternate to Hermes on Agent Machines.

It is a standalone codebase (github.com/openclaw/openclaw) with its own embedded, provider-agnostic runtime — not a fork of Claude Code (and not the unrelated "Captain Claw" game engine). Install npm i -g openclaw@latest then openclaw onboard --install-daemon. Source: openclaw/openclaw repo

Kevin starred openclaw/openclaw on 2026-06-28; the GitHub API snapshot listed 380,858 stars and a 2026-06-28 push timestamp. Treat that as a strong watch signal for harness comparison and personal-assistant runtime architecture, not as a default replacement for Codex/Claude Code in repo work. Source: raw/github/kevin-starred-repos-2026-06-28.json

Gateway architecture

A single Gateway daemon is the control plane (default 127.0.0.1:18789); it does not itself reason — it owns connections and runs one embedded agent runtime per gateway. Clients (macOS app, CLI, web admin, automations) and Nodes (macOS/iOS/Android/headless devices declaring capabilities) connect over a typed WebSocket protocol (TypeBox → JSON Schema → generated Swift models; events agent/chat/presence/health/cron). One WhatsApp/Telegram/Slack/Discord/Signal/iMessage session is owned per host. Source: OpenClaw architecture docs

The run loop

The agentic loop: intake → context assembly → model inference → tool execution → streaming replies → persistence. An agent RPC validates and returns {runId} immediately; the runtime serializes runs per session lane (plus an optional global lane) to prevent tool/session races, streams assistant/tool/lifecycle deltas, and enforces timeouts (default agent run up to 48h; cron runs own their own). Mid-run inbound messages are steered into the active run by default (alternatives: followup / collect / interrupt), guarded by a file-based session write lock; long conversations auto-compact. Source: OpenClaw agent-loop docs

Skills, rules, hooks

• Skills follow the cross-tool AgentSkills SKILL.md spec with load precedence workspace → project .agents/skills → personal ~/.agents/skills → managed ~/.openclaw/skills → bundled; eligible skills compile into an XML block injected into the system prompt, snapshotted at session start. Registry is ClawHub; installs run a dangerous-code scanner with builtin/official/trusted/community trust tiers. Source: OpenClaw skills docs
• The public OpenClaw Agent Skills repo is the shared-workflow bundle for autoreview, handoff, crabbox, agent-transcript, and session-viewer. Kevin has adopted autoreview and handoff, documents crabbox, and treats the transcript/session tools as candidates pending privacy review. Source: openclaw/agent-skills README, 2026-06-30
• "Rules" = injected bootstrap files concatenated into the first-turn Project Context: AGENTS.md (instructions + editable "memory"), SOUL.md (persona), TOOLS.md, IDENTITY.md, USER.md, one-time BOOTSTRAP.md.
• Two hook systems: gateway/event hooks (agent:bootstrap, /new, /reset) and plugin lifecycle hooks (before_model_resolve, before_prompt_build, before_tool_call/after_tool_call, before_install, before/after_compaction, session_start/end) where {block:true} is terminal.

Tools, MCP, sandbox, memory

• Built-in tools read/exec/edit/write (+ optional apply_patch), plus browser, canvas, nodes, cron, and sessions_* (list/history/send/spawn). Exec approvals gate shell commands.
• MCP both directions: client (stdio + Streamable HTTP) and server (exposes its own tools over MCP), plus ACP and a Codex-supervisor extension — see MCP Server Architecture.
• Sandboxing: tools run on the host for the main session ("when it's just you"); agents.defaults.sandbox.mode: non-main sandboxes other sessions, Docker as the default backend (SSH/OpenShell also). Inbound DMs are treated as untrusted input (pairing codes, allowlists).
• Memory/persistence: durable workspace dir (bootstrap files re-injected), AGENTS.md as editable memory, append-only JSONL session transcripts, and a Skill Workshop that queues agent-proposed skills for human approval. Scheduling via cron + webhooks + Gmail Pub/Sub; multi-agent routing maps channels to isolated per-agent workspaces. Source: OpenClaw agent docs

VisionClaw gives this gateway architecture a wearable-client example. The mobile app streams Meta Ray-Ban or phone-camera context to Gemini Live and exposes a single execute tool; when OpenClaw is configured, that call crosses the phone-to-Mac network boundary and runs through the local gateway's connected skills/apps. That makes OpenClaw the action plane behind an ambient voice-and-vision surface, while also raising the ordinary gateway concerns: LAN exposure, token auth, consent, side-effect preview, and recoverable failures. Source: Intent-Lab/VisionClaw README, 2026-07-04

Security caveat

The skills supply chain is a real attack surface: the early-2026 "ClawHavoc" campaign poisoned ClawHub with ~1,000+ malicious skills that smuggled the Atomic macOS Stealer via fake "Prerequisites" in SKILL.md instructing the agent to run curl | bash — a Markdown file acting as an installer. ClawHub added publisher verification, mandatory scans, and community reporting; the Security and Review Skills skill (from useai-pro/openclaw-skills-security) and the three-gate install chain exist for exactly this. Treat third-party skills as untrusted code (Agent Guardrails Architecture). Source: Antiy Labs ClawHavoc analysis

Contrast

OpenClaw sits a layer above the coding agents: where Claude Code, Codex, and Cursor are repo/IDE-centric copilots, OpenClaw is a multi-channel assistant gateway that also codes and can drive those CLIs as sub-agents (it even materializes its skill snapshot as a temporary Claude Code plugin). Versus Hermes: both are "install an agent on a persistent machine, point it at an OpenAI-compatible endpoint," which is why Agent Machines treats them as swappable runtimes — but they share a deployment contract, not internals (Hermes is Nous's Python runtime; OpenClaw is a TS channel/node/canvas gateway, and Hermes ships claw migrate as its successor).

Ahmad's "switch to Hermes" bookmark is preserved here as an external operator preference, not as a deletion of the OpenClaw capsule. The practical rule stays: prefer Hermes when persistent self-owned memory/cron/goals/approvals are the load-bearing primitives; prefer OpenClaw when the gateway/channel/node topology or OpenClaw skill ecosystem is the subject under review. Source: X/@TheAhmadOsman, 2026-06-22

Gemini Spark is the managed-Google counterpart some observers compare to OpenClaw: a Gemini 3.5 Flash + Antigravity personal agent inside the Gemini app, with Google app connections, tasks, skills, schedules, and background execution. Keep the boundary explicit. Spark is a hosted consumer/productivity agent in Google's control plane; OpenClaw is a local-first gateway/runtime with user-owned channels, skills, memory, and MCP/ACP surfaces. Source: Gemini Spark overview, 2026-07-04; Source: X/@sarbjeetjohal, 2026-05-19

---

Timeline

• 2026-07-04 | Added VisionClaw as a concrete OpenClaw client: a Meta Ray-Ban / phone-camera app forwarding Gemini Live tool calls into the local OpenClaw gateway, with LAN/auth/privacy caveats. Source: Intent-Lab/VisionClaw
• 2026-07-04 | Added Gemini Spark as the managed-Google comparison point for OpenClaw: hosted Gemini app agent versus local-first gateway/runtime. Source: Gemini Spark overview, 2026-07-04
• 2026-06-02 | Page created from github.com/openclaw/openclaw and docs.openclaw.ai. Captured the MIT/Steinberger/OpenClaw-Foundation identity (standalone, not a Claude Code fork), the Gateway-daemon/WebSocket topology, serialized run lanes + steering + 48h timeout, AgentSkills SKILL.md + ClawHub trust tiers, bootstrap-file "rules", the two hook systems, MCP client+server + ACP, Docker sandbox, JSONL memory + cron + multi-agent routing, the ClawHavoc security incident, and the Hermes/Agent-Machines relationship. Source: github.com/openclaw/openclaw
• 2026-06-28 | Kevin's GitHub stars snapshot added openclaw/openclaw; keep as harness-watch / architecture reference rather than a default coding-agent route. Source: GitHub Starred Repos Harvest - 2026-06-28
• 2026-06-30 | Added OpenClaw Agent Skills as the shared workflow bundle attached to this harness capsule. Local decision: keep autoreview/handoff, document crabbox, defer agent-transcript/session-viewer until privacy audit. Source: X/@hungv47, 2026-06-05
• 2026-07-03 | Added Ahmad's OpenClaw/Hermes bookmark as an operator-preference signal while preserving OpenClaw as the gateway/channel/node capsule rather than treating Hermes as a universal replacement. Source: X/@TheAhmadOsman, 2026-06-22