Is my agent safe? We can't promise that. We can show you what's exposed.
Your agent holds your API keys, inbox and files. Paste your OpenClaw audit and get a plain-English answer in minutes: what we checked, what we found, and the exact commands to fix it.
Look-only. We read what you paste. We never log in, try passwords or change anything.
What we checked and found as of 2026-10-18 14:00 UTC
Sample result
Anyone who can reach it can use your keys on your bill.
Slow it to 1h:
openclaw config set agents.defaults.heartbeat.every 1hMove them to env references, then rotate.
Node 24.16+ required from 2026.9.3.
How the free check works
Two minutes, no terminal skills beyond copy and paste.
Step 1
Run two commands
openclaw security audit --deep, plus openclaw --version (optional, for the known-vulnerability check). Paste both outputs.
Step 2
Paste it
Your browser hides anything that looks like a key or token before it's sent. You can see the hidden version first.
Step 3
We explain it
We turn OpenClaw's findings into plain English and add our own checks for risky settings, such as API keys handed to skills, surprise-bill risks and missing security fixes.
Step 4
Get your result
Red, amber or green with the most important fix. If the check can't finish, we say so. It's never green.
What we check that others don't explain
Built for people who run an agent, not a security team.
Key-theft check
API keys saved in plain text, keys handed to skills, files other users can read, and versions with known token-stealing bugs.
Surprise-bill check
No hard spend limits, heartbeats waking a premium model all day, open gateways and DMs others could use on your dime.
Upgrade watch
Missing security fixes for your exact version, plus the breaking changes to read before you upgrade. New-release alerts are coming soon with Solo ($9/month).
Plain-English fix list
Every finding with what it means, why it matters and copy-paste commands, plus a ready-made prompt for your coding agent.
Outside checks only for agents you control
Coming soon: a look-only check of your agent's public address. Before we contact anything, you prove it's yours in one of three ways.
A small file
Serve your one-time code at /.well-known/ismyagentsafe-verify.txt.
A DNS record
Add a TXT record at _ismyagentsafe.yourdomain containing your code.
A header
Have your proxy send X-IsMyAgentSafe-Verify: your-code.
Not live yet. Codes will be single-use and expire after 24 hours. We never check private or internal addresses. About our scanner.
Start free, pay for the full picture
Prices in US dollars.
Free check
- Red, amber or green result
- Count of findings
- Your most important fix
Green means no issues found in the checks we ran.
Full report
- Every finding in plain English
- Copy-paste fix list
- Key-theft, surprise-bill and upgrade sections
- Prompt for your coding agent
- Key-rotation checklist
- Automatic refund if the check can't finish
Solo
- Emails you when a new release or advisory affects your version
- Breaking-change notes before you upgrade
- Scheduled re-checks of the last audit you pasted
- Cancel any time
Agency
- 20 founding seats
- $0 to reserve
- Billing starts only once the connector and the all-clients view are live
- $99/month, price locked for your first 12 paid months. After that, it moves to the then-current Agency price, with at least 30 days' email notice. Cancel any time.
- Offer conditions
- Up to 25 client agents per seat
What a result means: Limits of the check
What a result can't tell you
The name asks a question we can't answer with a yes. Every result says what we checked and found, and when (in UTC). A green result means no issues found in the checks we ran. It's not a guarantee.
- Point-in-time: things change after we look.
- Look-only: we don't log in, exploit or break anything.
- Not a penetration test, code review or certification.
- We don't check the computer your agent runs on, prompt injection, or what your agent does with your data.
Learn the basics, in plain English
Agents and AI security, explained
Agents & AI Security, explained: one short email a week. Free. Unsubscribe any time.
We'll only use your email to send the newsletter. The newsletter is sent by beehiiv, which records opens and link clicks. Privacy policy.
Questions, answered
Which agents do you support?
OpenClaw (including older Clawdbot/Moltbot installs). Others may come later.
So, is my agent safe?
We can't promise that, and nobody honest can. We can tell you what we checked and found, when, and how to fix it.
What happens to what I paste?
Your browser hides secret-looking values before sending. We keep results for 90 days so you can view your report, then delete them. Privacy policy.
What if the check can't finish?
The result is never green, and checkout stays closed until it's complete. If a paid check can't finish, we refund you automatically. Refund policy.
Do you change anything on my machine?
No. You run the commands. We only read what you paste.