← All reportsPublic report

openclaw/openclaw

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

388k stars TypeScript View on GitHubprofiled 14d ago
Try GitZoid
400PRs this week
51Contributors
111Deps scanned
0Issues found
01 · Repo overview

How openclaw is put together

OpenClaw is a single-operator, multi-channel AI assistant gateway written primarily in TypeScript and distributed as an npm package (`openclaw`). A local Gateway acts as the control plane for sessions, tools, events, and messaging-channel connections, while a Control UI, CLI, and TUI connect to it; inbound chat messages from channels (WhatsApp, Telegram, Slack, Discord, etc.) are routed to model providers and tool/skill/plugin runtimes. The codebase is a pnpm monorepo workspace whose functionality is largely delivered through bundled extensions/plugins (e.g. ACPX ACP runtime, admin HTTP RPC, model providers like Amazon Bedrock), companion native apps (iOS, Android, macOS, Linux), and Python skills. Data flows from untrusted inbound channel messages through pairing/approval gating into the Gateway's session and tool execution layers, with plugin-owned state persisted via keyed stores and SQLite.

Languages

TypeScriptJavaScriptPythonSwiftKotlinRubyShell

Frameworks

VitestZodAgent Client Protocol (ACP)FastlaneGradle (Android)Swift Package Manager

Datastores

SQLiteFilesystem-backed plugin/keyed state stores

Infrastructure

Docker / docker-composeFly.ioRenderCloudflare WorkersGitHub Actions CI

Major components

Gateway (core src/)

Local control plane managing sessions, tools, events, agents, and messaging-channel connections.

Bundled extensions/plugins (extensions/)

Pluggable runtime capabilities including ACP backends, model providers, admin RPC, and active-memory delivered as workspace packages.

ACPX extension

Agent Client Protocol runtime backend with plugin-owned session, process-lease, and transport management.

Model provider extensions (amazon-bedrock, amazon-bedrock-mantle, alibaba)

Integrate hosted model providers for chat, embeddings, and media generation, including AWS credential refresh.

Companion native apps (apps/)

iOS, Android, macOS, and Linux device apps adding voice, camera, screen, and device-local actions.

Skills (skills/, custodian-skills/)

Python and script-based extensible task capabilities plus maintainer/custodian operational skills.

Scripts & E2E/QA harness (scripts/, qa/, test/)

Build, release, Docker, and end-to-end/QA-lab tooling driven by path from package scripts and workflows.

admin-http-rpc extension

Exposes an administrative HTTP RPC endpoint for the Gateway.

02 · Weekly changes

A busy week polishing chat integrations, tightening Claude account authentication, and cleaning up tests and dead code.

1 weeksWeek of 2026-08-24

Over the past week the team focused heavily on hardening messaging integrations (WhatsApp, Telegram, Discord, Slack) so that replies, mentions, and formatting are preserved correctly, alongside a major cleanup of authentication handling for Claude/Anthropic accounts. Alongside the fixes, they shipped a few user-facing improvements like collapsible Workboard columns and a unified mobile picker, and did substantial housekeeping by deduplicating test fixtures and removing obsolete code.

Fix

Safer message mentions and formatting across chat apps

WhatsApp, Discord, and Telegram now avoid triggering accidental mentions inside code snippets and preserve the exact text and quoted replies people send.

Fix

More reliable Claude account sign-in and status

The app now correctly keeps and reports Claude/Anthropic login details, recognizes authorization headers regardless of formatting, and cleans up outdated credentials.

Feature

Collapsible Workboard columns

Users can now collapse columns on the Workboard to reduce clutter and focus on the work that matters.

Feature

Unified agent and session picker on Android

The Android app combines the separate agent and session selectors into a single, simpler picker.

Chore

Deduplicated and refreshed test fixtures

Repeated test setup for daemons, delivery, and system runs was consolidated and authentication test data was refreshed to keep the suite clean and accurate.

Refactor

Removed obsolete code and unified browser detection

Old fallback scripts and dead status code were deleted, and browser executable detection was consolidated so the app more consistently finds the right browser.

03 · Security check

Dependencies and code review

111 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 111 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required