OpenClaw Security for Agencies and MSPs: Trust Boundaries, Packaging and Handoff
Published 2026-10-19 · Updated 2026-10-19 · By The Is My Agent Safe team
Short answer
OpenClaw's security docs assume one trusted operator per Gateway. For agencies and MSPs, use a separate Gateway and credentials per client. Package a pre-handoff audit, a private Gateway, dedicated keys with spend caps, and a written kill switch into setup; sell a recurring re-audit as care. Our agency features have a preview planned for early November. Today, the free check at /check works one paste at a time.
- One client, one Gateway (and ideally one OS user or host). OpenClaw is not a hostile multi-tenant boundary.
- Setup deliverable: deep audit clean or documented, latest release, private bind, dedicated keys, kill switch.
- Care deliverable: weekly or monthly re-audit, updates, exposure re-check, short client note.
- Our agency features and Solo version alerts are not live yet. Use /check per client until then.
Who this is for
Agencies, freelancers and MSPs who install or manage OpenClaw for more than one customer. If you only run your own agent, use the 12-point checklist instead.
The rule that changes packaging
OpenClaw's security docs set a clear scope: one trust boundary per Gateway. The product assumes a single operator, or a team whose members trust each other. It is not a hostile multi-tenant boundary for customers who must not share secrets or sessions.
Practical read for agencies:
- One client → one Gateway, one set of provider keys, one state directory.
- Prefer separate OS users or hosts when clients are separate companies.
- Do not put Client A's mail or CRM credentials on Client B's agent "to save a VPS".
That single rule is why "security for agencies" is mostly isolation and process, not a different OpenClaw binary.
What to sell at setup
Turn OpenClaw's own pre-flight ideas into a fixed deliverable:
| Deliverable | Source of truth |
|---|---|
| Deep audit with criticals resolved or written exceptions | openclaw security audit --deep (running the audit) |
| Latest release (2026.10.5 as of October 19, 2026) | openclaw --version and openclaw update --dry-run. For context, 2026.8.1 is the floor for high-severity Gateway and CLI fixes, including CVE-2026-100552 (rated high) |
| Private Gateway pattern documented | Exposure runbook: prefer loopback + SSH or Tailscale Serve |
| Dedicated keys + spend caps per client | Provider dashboards; rotate on handoff |
| Written kill switch | Operator incident response |
Walk the full sequence in How to audit a client's OpenClaw.
What to sell as monthly care
If you sell monthly care, such as security updates or health reports, you can deliver it with OpenClaw's own commands:
- Re-run the deep audit and keep dated JSON.
- Check updates (
openclaw update status/ dry-run) and advisories for that version. - Re-test exposure from outside.
- Send a short, secret-free summary.
The step-by-step cadence is in Weekly OpenClaw security checks for clients.
What we offer today vs later
- Live: paste a client's audit and version into /check. It explains the findings, checks for risky settings (such as API keys handed to skills) and checks the version against published security advisories. Look-only, one paste at a time, nothing installed into the agent you're checking. It doesn't review skill code or detect malicious skills. The $29 full report is also live.
- Coming soon: Solo: version alerts ($9/month), which re-check the last audit you pasted when a new release or advisory comes out.
- Planned: agency features, with a preview planned for early November. That is not a promise. Optional connector (planned for early November): a short script you run on your host, outside OpenClaw. It runs OpenClaw's own
security audit(never its fix option) and sends us a minimal summary (check IDs, severity levels, finding counts and version numbers), never file paths, hostnames, configuration or secrets. No plugin, no skill, nothing installed into your agent. - Don't promise any of these to your clients until they're live.
- Newsletter: subscribe if you want product and advisory notes when they ship.
Common agency mistakes (and the OpenClaw doc behind each)
- Shared Gateway for several clients. Conflicts with the one-trust-boundary scope in the security overview.
- Handoff PDF that includes live API keys. Put secrets in a vault; rotate at handoff. Incident response assumes tokens can be burned.
- Public Gateway "so the client can open the dashboard". Use SSH tunnel or Tailscale Serve instead of a raw public port (exposure runbook).
- Skipping
--deep. The best-effort live Gateway checks, plugin-owned security checks and OpenClaw's skill and plugin code scans only run with--deep(CLI security, audit checks). - Treating
--fixas a full harden. It applies a narrow set of fixed repairs. It doesn't rotate keys, change bind or remove skills (CLI security).
Where next
- How to audit a client's OpenClaw
- Weekly OpenClaw security checks for clients
- openclaw security audit explained
- VPS hardening
Frequently asked questions
Can several clients share one OpenClaw Gateway?
OpenClaw's security guidance says it is not a hostile multi-tenant boundary for mutually adversarial users on one agent or Gateway. For mixed-trust or separate customers, split trust boundaries: separate Gateway and credentials, ideally separate OS users or hosts.
What should an agency include before handoff?
At minimum: openclaw security audit --deep with criticals fixed or accepted in writing, the latest release (2026.10.5 as of October 19, 2026; 2026.8.1 is the floor for high-severity Gateway and CLI fixes), Gateway on loopback or another documented private pattern, dedicated provider keys with spend limits, and a written stop-and-rotate procedure. See the client audit guide for the step list.
Do you have an agency plan today?
Not yet. A preview of the connector and all-clients view is planned for early November, but that is not a promise. Founding seats are $99/month, with the price locked for your first 12 paid months. Billing starts only after both features are generally available and you confirm. Live today: the free paste check and the $29 full report.
How do MSPs differ from OpenClaw setup agencies?
Same trust-boundary rule. MSPs usually already have change control, credential vaults and incident contacts. Map OpenClaw's Gateway, tokens and provider keys into those existing processes rather than inventing a second secret store in a PDF.
Sources
- OpenClaw docs: security overview (one trust boundary per gateway)
- OpenClaw docs: security trust model
- OpenClaw docs: Gateway exposure runbook
- OpenClaw docs: running the security audit
- OpenClaw docs: access control and allowlists
- OpenClaw docs: operator incident response
- OpenClaw docs: openclaw security (CLI)
- OpenClaw docs: security audit checks
- OpenClaw docs: openclaw update (CLI)
- GitHub advisory GHSA-wwcw-jfpp-gpxw (CVE-2026-100552)
- OpenClaw release 2026.10.5
- OpenClaw release v2026.8.1
Get the weekly plain-English agent security brief
Agents & AI Security, explained: one short email a week. Free. Unsubscribe any time.
We'll only use your email to send the newsletter. The newsletter is sent by beehiiv, which records opens and link clicks. Privacy policy.