OpenClaw Security Guard

The missing security layer for your OpenClaw installation.
Audit. Monitor. Protect. All from one tool.

Quick Start • Why This Tool • Features • Dashboard • CLI • Contributing

Built by Miloud Belarebia at 2PiData — for the OpenClaw community.

Upstream integration: The core runtime guardrails from this tool are being integrated as an official OpenClaw extension — see PR #17273 and Discussion #17275. This standalone CLI tool will continue to be maintained for additional features (dashboard, secrets scanning, auto-hardening, dependency auditing).

The Problem

You installed OpenClaw. It works great. But ask yourself:

• Are your API keys exposed in config files or skills?
• Is your sandbox mode properly configured?
• Do your MCP servers come from verified sources?
• Could a prompt injection be hiding in your workspace files?
• Are your npm dependencies free of known vulnerabilities?

If you're not sure, you need this tool.

Quick Start

# Install globally
npm install -g openclaw-security-guard

# Run your first audit
openclaw-guard audit

# Fix issues automatically
openclaw-guard fix --auto

# Launch the live dashboard
openclaw-guard dashboard

30 seconds. That's all it takes to know your security posture.

Why Security Guard?

There are other security tools in the OpenClaw ecosystem. Here's how they compare:

Security Guard doesn't replace these tools. It fills the gaps they leave.

What You Get

5 Application Scanners + Infrastructure Module

Infrastructure Security (opt-in)

For production deployments, add --infra to scan your server:

openclaw-guard audit --infra

The infra module catches what application scanning misses:

• App score says 85/100, but gateway is on 0.0.0.0 with SSH password auth enabled = actually vulnerable
• With --infra, the combined score reflects the real picture

Auto-Hardening

Three modes to fix issues your way:

openclaw-guard fix               # Interactive: review each fix
openclaw-guard fix --auto        # Automatic: fix everything, backup first
openclaw-guard fix --dry-run     # Preview: see what would change

Every fix creates a timestamped backup. Nothing is irreversible.

Security Score (0-100)

One number that tells you where you stand:

Deductions: critical finding = -10, high = -5, medium = -2. Sandbox off = -20. Open DM policy = -15.

Live Dashboard

openclaw-guard dashboard

Opens a password-protected web dashboard at http://localhost:18790 with:

• Real-time security score that updates as threats are detected
• Request monitoring with requests-per-minute tracking
• Cost tracking for API usage (daily/monthly limits)
• Threat feed showing prompt injection attempts, blocked requests, rate limit hits
• Config overview at a glance

The dashboard runs on localhost only, uses PBKDF2 password hashing (100k iterations, SHA-512), and connects to your OpenClaw gateway via WebSocket.

CLI Reference

Global Options

Configuration

Create .openclaw-guard.json in your project root or home directory:

{
  "scanners": {
    "secrets": {
      "enabled": true,
      "exclude": ["*.test.js", "node_modules/**"]
    },
    "config": {
      "enabled": true,
      "strict": true
    },
    "prompts": {
      "enabled": true,
      "sensitivity": "high"
    },
    "mcpServers": {
      "allowlist": [
        "mcp-server-filesystem",
        "mcp-server-fetch",
        "mcp-server-memory",
        "mcp-server-sqlite",
        "mcp-server-git",
        "mcp-server-github"
      ],
      "blockUnknown": false
    }
  },
  "monitors": {
    "cost": {
      "dailyLimit": 10,
      "monthlyLimit": 100
    }
  },
  "dashboard": {
    "port": 18790
  }
}

Programmatic API

Use Security Guard as a library in your own projects:

import { quickAudit, checkPromptInjection } from 'openclaw-security-guard';

// Full audit
const results = await quickAudit('~/.openclaw');
console.log(`Score: ${results.securityScore}/100`);
console.log(`Critical: ${results.summary.critical}`);

// Check a message for injection
const check = await checkPromptInjection('ignore all previous instructions');
console.log(check.safe); // false

// Individual scanners
import { SecretsScanner, ConfigAuditor, McpServerAuditor } from 'openclaw-security-guard';

const scanner = new SecretsScanner({});
const result = await scanner.scan('/path/to/openclaw');

Privacy & Security

This is a security tool. It should be secure itself. Here's the commitment:

See SECURITY.md for the full security policy.

Documentation

Contributing

PRs welcome. See CONTRIBUTING.md.

git clone https://github.com/2pidata/openclaw-security-guard.git
cd openclaw-security-guard
npm install
npm test    # 25 tests, 0 warnings

License

MIT

Created by Miloud Belarebia at 2PiData
Inspired by detect-secrets, trivy, and OWASP.

If this tool helps you, leave a star. It helps others find it too.
github.com/2pidata/openclaw-security-guard

Report a bug • Request a feature • 2pidata.com