📱 ClawApp — OpenClaw AI 智能体手机聊天客户端 | 流式对话 · 图片收发 · 工具调用 · PWA + APK | Mobile chat client for OpenClaw AI Agent
# Add to your Claude Code skills
git clone https://github.com/qingchencloud/clawappLast scanned: 5/21/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@babel/plugin-transform-modules-systemjs: @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@rollup/plugin-terser: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tar: tar has Hardlink Path Traversal via Drive-Relative Linkpath",
"severity": "high"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "workbox-build: Vulnerability found",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-05-21T07:54:00.326Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}clawapp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by qingchencloud. 📱 ClawApp — OpenClaw AI 智能体手机聊天客户端 | 流式对话 · 图片收发 · 工具调用 · PWA + APK | Mobile chat client for OpenClaw AI Agent. It has 438 GitHub stars.
clawapp returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/qingchencloud/clawapp" and add it to your Claude Code skills directory (see the Installation section above).
clawapp is primarily written in JavaScript. It is open-source under qingchencloud on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh clawapp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
🦀 ClawPanel — 内置 AI 助手的 OpenClaw 可视化管理面板(桌面端) | 🇨🇳 OpenClaw 汉化版 — 全中文 CLI + Dashboard
OpenClaw 是一个强大的 AI 智能体平台(中文汉化版),但它的 Gateway 默认只监听本机(127.0.0.1:18789),手机无法直接连接。
ClawApp 解决了这个问题:
手机浏览器(任意网络)
↓ WebSocket (WS / WSS)
代理服务端(ClawApp Server,端口 3210,离线缓存)
↓ WebSocket + Ed25519 设备签名
OpenClaw Gateway(端口 18789)
代理服务端自动完成 Ed25519 设备签名握手认证(兼容 OpenClaw 2.13+),同时提供 H5 聊天页面,打开就能用,不需要装 App。
curl -fsSL https://raw.githubusercontent.com/qingchencloud/clawapp/main/install.sh | bash
irm https://raw.githubusercontent.com/qingchencloud/clawapp/main/install.ps1 | iex
脚本会自动检测环境、克隆仓库、安装依赖、构建前端、交互式配置 Token,并支持 PM2 常驻运行。如果本地已安装 OpenClaw,会自动读取 Gateway Token。
git clone https://github.com/qingchencloud/clawapp.git
cd clawapp
在项目根目录创建 .env 文件:
# 手机连接时的密码(自己设一个)
PROXY_TOKEN=my-secret-token-123
# OpenClaw Gateway 的 Token(在 ~/.openclaw/gateway.yaml 里找)
OPENCLAW_GATEWAY_TOKEN=你的gateway-token
# 或者使用密码认证(Tailscale Funnel 场景必须用 password 模式)
# 设置后自动切换为 password 认证,优先级高于 token
# OPENCLAW_GATEWAY_PASSWORD=你的gateway-password
启动:
docker compose up -d --build
git clone https://github.com/qingchencloud/clawapp.git
cd clawapp
npm run install:all
npm run build:h5
cp server/.env.example server/.env
# 编辑 server/.env,填入你的 token
npm start
ifconfig | grep "inet " | grep -v 127.0.0.1ipconfigip addrhttp://你的电脑IP:3210适合家庭/办公室使用,手机和电脑在同一 WiFi 下。
git clone https://github.com/qingchencloud/clawapp.git
cd clawapp && npm run install:all
npm run build:h5
cp server/.env.example server/.env
# 编辑 server/.env 填入 token
npm start
# 创建 .env
cat > .env << 'EOF'
PROXY_TOKEN=my-token-123
OPENCLAW_GATEWAY_TOKEN=你的gateway-token
ALLOWED_ORIGINS=
EOF
# 构建并启动
docker compose up -d --build
# 查看日志
docker compose logs -f
Docker 环境下会自动使用 host.docker.internal 连接宿主机的 Gateway。
# 安装 pm2
npm install -g pm2
# 启动
pm2 start server/index.js --name clawapp
# 开机自启
pm2 save && pm2 startup
不在同一网络时,有以下方案:
cftunnel 是 Cloudflare Tunnel 一键管理 CLI,免费、自动 HTTPS、无需公网 IP。
💡 为什么推荐 cftunnel? 浏览器的语音输入(🎤)功能要求 HTTPS 安全上下文,局域网 HTTP 访问无法使用麦克风。cftunnel 自动提供 HTTPS,一条命令即可解锁语音输入等高级功能。
临时分享(零配置):
# 安装 cftunnel
curl -fsSL https://raw.githubusercontent.com/qingchencloud/cftunnel/main/install.sh | bash
# 一条命令穿透
cftunnel quick 3210
# ✔ 隧道已启动: https://xxx-yyy-zzz.trycloudflare.com
固定域名(需要 Cloudflare 账号 + 自有域名):
cftunnel init # 配置 CF API Token
cftunnel create my-tunnel # 创建隧道
cftunnel add clawapp 3210 --domain chat.example.com # 添加路由(自动创建 DNS)
cftunnel up # 启动
cftunnel install # 注册开机自启
详见 cftunnel 文档 · 也有 桌面客户端 可视化管理
需要一台有公网 IP 的服务器。
# 在你的电脑上执行
ssh -f -N \
-o ServerAliveInterval=15 \
-o ServerAliveCountMax=4 \
-R 0.0.0.0:3210:127.0.0.1:3210 \
user@你的服务器IP
⚠️ 服务器需要:
/etc/ssh/sshd_config中设置GatewayPorts yes- 防火墙放行 3210 端口
手机访问 http://服务器IP:3210
⚠️ SSH 隧道默认是 HTTP,语音输入功能不可用。如需语音输入,请配合 Nginx SSL 或改用 cftunnel。
server {
listen 443 ssl;
server_name clawapp.你的域名.com;
ssl_certificate /path/to/cert.pem;
ssl_certificate_key /path/to/key.pem;
location / {
proxy_pass http://127.0.0.1:3210;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_read_timeout 86400;
}
}
| 方案 | 优点 | 缺点 |
|---|---|---|
| cftunnel(推荐) | 一条命令,免费,自动 HTTPS,开机自启 | 依赖 Cloudflare 服务 |
| SSH 隧道 | 简单,无需额外软件 | 需要公网服务器,隧道可能断开 |
| Nginx 反代 | 完全可控,自定义域名 | 需要服务器 + SSL 配置 |
| Tailscale/ZeroTier | P2P 直连,加密 | 手机也要装客户端 |
打开 H5 页面后会看到连接设置页,需要填写两个字段:
填写运行 ClawApp Server 的电脑 IP 和端口。
局域网访问(手机和电脑同一 WiFi):
# 查看电脑 IP
# Mac
ifconfig | grep "inet " | grep -v 127.0.0.1
# Windows
ipconfig
# Linux
ip addr
然后在 App 中填入 你的电脑IP:3210,例如 192.168.1.100:3210
外网访问:填入公网地址,例如 你的服务器IP:3210 或 cftunnel 生成的域名 xxx-yyy.trycloudflare.com
本机访问:直接填 localhost:3210
App 登录页的 Token 是你在部署时自己设置的 PROXY_TOKEN,相当于访问密码。
脚本会交互式引导你设置 Token,设置完后记住即可。如果忘了,查看配置文件:
cat server/.env | grep PROXY_TOKEN
Token 在 .env(Docker)或 server/.env(手动部署)文件中配置:
# 这个是 App 登录密码,自己随便设一个
PROXY_TOKEN=my-secret-token-123
# 这个是 OpenClaw Gateway 的认证 Token(见下方获取方式)
OPENCLAW_GATEWAY_TOKEN=你的gateway-token
PROXY_TOKEN 是你自己定义的密码,设什么 App 里就填什么。
这个 Token 在 OpenClaw 的配置文件 ~/.openclaw/openclaw.json 中(JSON5 格式):
# 查看 Gateway Token
cat ~/.openclaw/openclaw.json | grep token
在配置文件中找到类似这样的结构:
{
gateway: {
port: 18789,
auth: {
mode: "token",
token: "你的-gateway-token" // ← 复制这个值
}
}
}
把 gateway.auth.token 的值复制到 .env 的 OPENCLAW_GATEWAY_TOKEN 中即可。
如果你的 Gateway 使用 password 模式(例如通过 Tailscale Funnel 暴露),需要用 OPENCLAW_GATEWAY_PASSWORD 代替 Token:
// ~/.openclaw/openclaw.json
{
gateway: {
auth: {
mode: "password",
password: "你的-gateway-password" // ← 复制这个值
}
}
}
在 server/.env 中设置:
# 密码认证(设置后自动优先于 token)
OPENCLAW_GATEWAY_PASSWORD=你的-gateway-password
💡
OPENCLAW_GATEWAY_PASSWORD和OPENCLAW_GATEWAY_TOKEN二选一。设置了 password 后会自动使用密码模式,优先级高于 token。
💡
PROXY_TOKEN(App 登录密码)和OPENCLAW_GATEWAY_TOKEN/OPENCLAW_GATEWAY_PASSWORD(Gateway 认证)是两个不同的概念。前者自己设,后者从 OpenClaw 配置中获取。
💡 通过 HTTPS 访问时(如 Cloudflare Tunnel),WebSocket 会自动切换为 WSS 加密连接。
点击聊天页右上角 ⚙️ 图标:
| 变量 | 必填 | 默认值 | 说明 |
|---|---|---|---|
PROXY_PORT |
否 | 3210 |
代理服务端端口 |
PROXY_TOKEN |
是 | - | H5 客户端连接密码 |
OPENCLAW_GATEWAY_URL |
否 | ws://127.0.0.1:18789 |
Gateway 地址(Docker 下自动设为 host.docker.internal) |
OPENCLAW_GATEWAY_TOKEN |
二选一 | - | Gateway 认证 token |
OPENCLAW_GATEWAY_PASSWORD |
二选一 | - | Gateway 密码认证(Tailscale Funnel 场景,优先级高于 token) |
MEDIA_ALLOW_ALL |
否 | 0 |
设为 1 允许访问任意路径的媒体文件(默认仅 /tmp/ 和 /var/folders/) |
ALLOWED_ORIGINS |
否 | - | 额外 CORS 白名单,逗号分隔 |
clawapp/
├── server/ # WebSocket 代理服务端
│ ├── index.js # Express + WS 代理 + Gateway 握手
│ ├── package.json
│ ├── Dockerfile
│ └── .env.example
├── h5/ # H5 移动端前端
│ ├── src/
│ │ ├── main.js # 入口 + 连接页
│ │ ├── ws-client.js # WebSocket 协议层
│ │ ├── chat-ui.js