OpenClaw Safe Setup Guide: A Battle-Tested Walkthrough
This guide exists because we set up OpenClaw from scratch on a MacBook and documented everything that went wrong.
OpenClaw is an open-source AI personal assistant that connects large language models to your messaging apps — Telegram, WhatsApp, Discord, Slack, and more. It can browse the web, read and write files, run shell commands, and send messages on your behalf. It runs 24/7 on your own machine.
It exploded in popularity in January 2026, going from 9,000 to over 140,000 GitHub stars in days. Thousands of people rushed to set it up. Most of them hit the same walls we did.
This is what we learned — and how you can skip the painful parts.
Context: This guide is a companion to our article Running an AI Agent in Production: What Nobody Tells You, where we document the full cost and security investigation we ran after deploying Eva on OpenClaw. Read that first if you want to understand why these settings matter.
The Easiest Way to Get Started
This guide covers terminal commands, Docker configurations, and security settings. If that sounds intimidating — you do not need to understand any of it to get this running. Here’s how.
Option A: Use Claude’s Cowork Mode (Recommended)
This entire guide was created through a conversation with Claude in Cowork mode. Claude wrote the scripts, debugged the errors, and walked a non-technical user through every step. You can do exactly the same thing.
What is Cowork? Cowork is a feature of the Claude desktop app that lets Claude run code, create files, and execute terminal commands on your computer — inside a safe sandbox. Think of it as having a technical friend sitting next to you, except they can actually type commands for you.
How to do it:
- Download the Claude desktop app from claude.ai/download
- Open Claude and switch to Cowork mode (look for it in the mode selector)
- Select a folder on your computer for Claude to work in
- Share this guide with Claude (drag the file into the chat or paste the link)
- Say: “Help me set up OpenClaw safely on my Mac, following this guide step by step.”
- Claude will create the scripts, run the commands, and ask for your input only when needed (passwords, API keys, Telegram token)
Tip: Claude in Cowork mode can write files directly to your computer, run terminal commands, and debug errors in real time. You just need to approve each step. It’s like pair-programming with someone who already read the entire guide.
Option B: Copy-Paste the Commands Yourself
If you prefer not to use Cowork, you can follow this guide manually. Open Terminal on your Mac (search for “Terminal” in Spotlight) and copy-paste each command. The guide is written in execution order — just go top to bottom.
Important: If a command fails, don’t panic. Read the error message. Most errors in this guide have a “GOTCHA” box right next to them explaining what went wrong and how to fix it. These gotchas are real errors we encountered during our installation.
Option C: Use the Setup Script
We also created an automated setup script (openclaw-setup.sh) that walks you through the entire process interactively. It pauses at each decision point and asks for your input. However, we found that some interactive prompts can be finicky inside scripts. If the script gets stuck, fall back to Option A or B.
What You’ll Need
Even with Claude guiding you, there are a few things only you can do:
| Action | Why |
|---|---|
| Enter your Mac password | Docker and system-level changes require admin access |
| Get an Anthropic API key | Go to console.anthropic.com, create an account, and generate a key. Costs around $5–20/month depending on usage |
| Create a Telegram bot | Open Telegram, message @BotFather, send /newbot, pick a name. Takes 2 minutes |
| Scan a QR code (WhatsApp) | Only if you connect WhatsApp. You scan it with your phone like linking a new device |
| Approve pairing in Telegram | Send a message to your bot, get a code, tell Claude to run the approve command |
Everything else — creating directories, writing configuration files, pulling Docker images, hardening security settings — Claude handles for you.
Security Without Technical Knowledge
You don’t need to understand Docker, containers, or networking to be safe. Here’s what matters in plain language:
| Concept | What It Means for You |
|---|---|
| Docker container | OpenClaw runs in a sealed box on your computer. It cannot see your files, photos, passwords, or anything else unless you explicitly give it access |
| Read-only filesystem | If a hacker tricks the AI, it cannot install anything permanent on your machine. Restarting the container wipes any changes |
| Loopback-only | Nobody outside your computer can reach OpenClaw. Not your neighbor, not someone on your Wi-Fi, not anyone on the internet |
| Manual confirmation | Before OpenClaw sends a message, deletes a file, or takes any action, it asks you first. You say yes or no. This is your safety net |
| Frontier model | Using Claude (a top-tier AI) instead of a small local model means the AI is much harder to trick. Think of it as hiring a senior security guard instead of a trainee |
The single most important rule: NEVER turn off manual confirmation. As long as you review and approve every action the AI takes, you are in control.
Key Lessons from Our Setup
Based on our experience (documented in detail in the production article), here are the most critical things to get right:
Lock down your messaging channels from day one. Set WhatsApp dmPolicy to “disabled” and groupPolicy to “allowlist” before connecting. Every open channel is a cost multiplier — we learned this the hard way when 70% of our bill came from unauthorized WhatsApp group messages.
Set your cache TTL to at least 1 hour. The default 5-minute TTL means every gap in conversation triggers a full cache rewrite. For a personal assistant you check a few times a day, that’s constant cold starts.
Clean up transcript files, not just session metadata. OpenClaw’s session reset command only clears the index. The actual JSONL transcript files survive on disk and get reloaded on restart. Delete them manually if you need a fresh start.
Set the model config as an object, not a string. The model needs to be set with a “primary” key: {"primary": "google/gemini-2.5-pro"} — not just "google/gemini-2.5-pro". A plain string silently fails with no error.
Consider your model’s pricing structure. Claude Sonnet 4.5 charges $3.75/M for cache writes on top of $3/M for input. Gemini 2.5 Pro charges a flat $1.25/M. For an always-on agent, the pricing structure matters more than the per-token price.
Treat workspace files like production code. Every markdown file in the agent’s workspace gets injected into the system prompt on every request. A forgotten file, a duplicate, an oversized doc — they all compound silently.
How This Guide Was Made
This guide is not theoretical. It was created by a real user (with the help of Claude in Cowork mode) who went through the entire setup from scratch on a MacBook with 16GB RAM. Every error in the “Known Gotchas” sections is an error we actually hit. Every command in this guide is a command we actually ran. The security recommendations come from published research by Cisco, Adversa.ai, and the OpenClaw security docs.
The total setup took about 45 minutes, including debugging. If you use Cowork mode, expect a similar timeframe.
Want the full PDF guide? Download the OpenClaw Safe Setup Guide — the complete document with all commands, configurations, and gotchas.
This guide is a companion to Running an AI Agent in Production: What Nobody Tells You. If you want to understand the economics of running an always-on AI agent — and what happens when you don’t get the setup right — start there.
— Eliran Keren, Founder of Deeplica
