🦞 Clawdboss

Pre-hardened, multi-agent OpenClaw setup by NanoFlow.

One script to go from zero to a fully secured, multi-agent AI assistant on Discord — with prompt injection defense, security auditing, WAL Protocol for context persistence, and best practices baked in.

What You Get

• Multi-agent architecture — Main agent + optional specialist agents (Comms, Research, Security)
• Security-first — Prompt injection defense, anti-loop rules, content tagging, credential isolation
• WAL Protocol — Write-Ahead Log for corrections, decisions, and details that survive context loss
• Working Buffer — Danger zone logging to survive context compaction without losing work
• Discord integration — Bot bound to your server with channel-per-agent routing
• Telegram integration — Chat via Telegram bot with DM and group support
• Web dashboard — ClawSuite Console with chat, file browser, terminal, cost analytics (optional)
• Env-based secrets — All API keys in .env, never in config files
• Automated security audits — Security agent runs scheduled hardening checks
• Knowledge graph — Graphthulhu for structured memory across agents (optional)
• API discovery — ApiTap intercepts web traffic to teach agents how APIs work (optional)
• Web scraping — Scrapling for anti-bot-bypassing data extraction (optional)
• Browser automation — Playwright MCP for full GUI workflows (optional)
• GitHub integration — Issues, PRs, CI/CD via gh CLI (optional)
• Token compression — OCTAVE protocol for 3-20x compression in multi-agent handoffs (optional)
• Observability — Clawmetry dashboard for token costs, sessions, live message flow (optional)
• Security suite — ClawSec for file integrity, advisory feed, malicious skill detection (optional)
• AI text humanizer — Humanizer detects and removes AI writing patterns (optional)
• Continuous learning — Self-Improving Agent captures errors and lessons across sessions (optional)
• Skill discovery — Find Skills helps agents install new capabilities on-the-fly (optional)
• Marketing toolkit — 15+ marketing reference skills for copywriting, CRO, SEO, and more (optional)
• Host hardening — Healthcheck audits firewall, SSH, updates, and exposure (optional)

Quick Start

Ubuntu VPS (Fresh Install)

SSH into your server and run:

# 1. Clone Clawdboss
apt-get update && apt-get install -y git
git clone https://github.com/NanoFlow-io/clawdboss.git
cd clawdboss

# 2. Run the setup wizard (auto-installs Node.js 22, Python, build tools, OpenClaw)
./setup.sh

That's it. The wizard auto-installs all dependencies (Node.js 22, Python, git, build-essential, OpenClaw) and walks you through everything else.

What You'll Need Ready

• An LLM provider — one of:
  • GitHub Copilot subscription (cheapest — uses copilot-api proxy)
  • OpenAI API key (sk-...)
  • Anthropic API key (sk-ant-...)
• A Discord bot token — create one here (if using Discord interface)
• A Telegram bot token — create one via @BotFather (if using Telegram interface)
• Optional: Brave Search API key, ElevenLabs API key, OpenAI key for image gen/whisper

The setup wizard will:

1. Ask about you — name, role, what you do, how you want to use your agent
2. Ask about your agent — name, personality, mission, domain expertise
3. Prompt for your API keys and Discord/Telegram credentials
4. Create your .env file (gitignored, never committed)
5. Generate openclaw.json with ${VAR} references to your .env
6. Create agent workspaces with security rules + WAL Protocol pre-baked
7. Offer optional tools: Graphthulhu, ApiTap, Scrapling, GitHub, Playwright, OCTAVE, Humanizer, Self-Improving Agent, Find Skills, Marketing Skills, Healthcheck, Clawmetry, ClawSec
8. Run OpenClaw's built-in skills wizard (Whisper, Nano Banana Pro, mcporter, TTS, email, etc.)
9. Start the gateway

Your agent starts its first session knowing who you are, what you do, and what personality it should have — zero manual config file editing needed.

Configuration Tiers

File Structure

clawdboss/
├── README.md
├── setup.sh                    # Interactive setup wizard
├── .env.example                # Template showing required variables
├── .gitignore                  # Protects secrets
├── templates/
│   ├── openclaw.template.json  # Config with ${VAR} placeholders
│   ├── workspace/              # Main agent workspace files
│   │   ├── AGENTS.md           # Operating rules + WAL Protocol + security
│   │   ├── SOUL.md
│   │   ├── USER.md
│   │   ├── TOOLS.md
│   │   ├── IDENTITY.md
│   │   └── HEARTBEAT.md
│   └── agents/                 # Specialist agent templates
│       ├── comms/
│       ├── research/
│       └── security/
└── docs/
    ├── security.md             # Security architecture + WAL Protocol overview
    ├── customization.md        # How to customize your setup
    ├── recommended-tools.md    # Vetted ecosystem tools (Clawmetry, ClawSec)
    └── octave.md               # OCTAVE protocol guide

Interface Options

During setup, choose your preferred interface:

ClawSuite Console is an open-source web dashboard — see ClawSuite on GitHub (MIT license).

Context Persistence (WAL Protocol + 3-Layer Memory)

Clawdboss agents don't lose your corrections and decisions when context resets:

• 3-Layer Memory — L1 (Brain, loaded every turn) → L2 (Memory, searched semantically) → L3 (Reference, opened on demand)
• L1 File Budget — 500-1,000 tokens per workspace file to prevent agents from skimming
• SESSION-STATE.md — Agent writes important details here BEFORE responding (Write-Ahead Log)
• Working Buffer — At ~60% context, every exchange is logged to survive compaction
• Compaction Recovery — Agent reads buffer + state files after context loss, never asks "what were we doing?"
• Breadcrumbs — Topic-organized files in memory/ that point to deep reference docs
• Trim — Weekly maintenance to keep L1 files lean, move excess to L2/L3
• Recalibrate — Drift correction, forces re-read of all files and behavior comparison

See docs/security.md for the full architecture.

Security

All API keys are stored in ~/.openclaw/.env and referenced via ${VAR_NAME} syntax in the config. Keys never appear in JSON config files.

All agents come with:

• Prompt injection defense (content isolation, pattern detection)
• Anti-loop rules (prevent token-burning attacks)
• External content security (emails, web pages treated as data-only)
• Relentless resourcefulness + VBR (Verify Before Reporting)

See docs/security.md for the full security architecture.

Recommended Ecosystem Tools

The setup wizard offers each of these individually. All are free and open-source:

See docs/recommended-tools.md for detailed install guides.

After Install — Getting Your Agent Running

Once the wizard finishes, follow the next steps it shows:

1. Start the LLM Provider

GitHub Copilot (proxy):

# First run — shows a device auth URL + code. Open the URL, enter the code,
# authorize with a GitHub