The Core Idea

• Your messaging channels become the UI — WhatsApp, Telegram, Discord, Slack, iMessage, Signal, Teams, and more
• One AI assistant that follows you everywhere across every platform
• Extensible via 52 bundled skills and a marketplace of 31K+ community skills on ClawHub
• Backed by any LLM: Claude, GPT-4o, Gemini, Llama, Mistral, DeepSeek — with automatic failover

What It Does

• Routes messages between 17+ channel adapters and the agent runtime
• Manages sessions — each conversation is a JSONL file
• Serves the Control UI (Lit web components)
• Coordinates with macOS, iOS, and Android native apps via Bonjour/mDNS discovery
• Handles authentication, rate limiting, and skill sandboxing

RPC Surface

50+ RPC methods, 15+ event types pushed over WebSocket.

Core Mechanics

• Auth profile rotation — multiple API keys per provider, round-robin with exponential backoff on rate limits
• Model failover chain — e.g., Claude Opus 4.6 → Sonnet 4.5 → GPT-4o → local Llama. Seamless degradation
• Session as JSONL — every conversation serialized line-by-line. Git-friendly. Replayable. Typically stored in ~/.openclaw/sessions/
• Streaming response chunking — LLM output streamed token-by-token, chunked at sentence boundaries for messaging UX

System Prompt Assembly

// The system prompt is composed from:

1. Identity block
   "You are {name}, a personal AI..."

2. Active skills
   // Injected tool definitions
   // from 52 bundled + ClawHub

3. Memory context
   // Key facts, preferences
   // from better-sqlite3 store

4. Tool definitions
   // 20+ built-in tools
   // exec, browser, canvas...

5. Channel context
   // "You are in WhatsApp group
   //  with 4 participants..."

Built-in Tools

Bundled Skills (52)

Top Contributors

Community Growth Over Time

% of commits from non-Peter contributors per month

Claude Co-Authored Commits

Other AI Contributors

Pre-Commit Hook Pipeline

CI Workflows (7 total)

• ci.yml — Main: lint, type-check, unit tests
• e2e.yml — Playwright end-to-end tests
• release.yml — CalVer tagging & publishing
• docker.yml — Build & push Docker image
• codeql.yml — GitHub code scanning
• native.yml — Swift & Kotlin builds
• benchmark.yml — Performance regression checks

Process

• Trunk-based development — everything merges to main. No long-lived feature branches. Short-lived branches with squash-and-merge
• Squash-and-merge — every PR becomes one commit on main. Clean linear history despite 510 contributors
• "Thanks @" culture — Peter personally attributes every contribution in merge commits. Builds community loyalty
• AGENTS.md files — instructions for AI contributors in each package directory. "If you are an AI reading this..."
• 500 LoC per file discipline — enforced by convention, files split when they grow too large

Engineering Standards

• Subsystem logging with automatic PII redaction — phone numbers, API keys, emails stripped from logs
• Conventional Commits at 81% adoption — automated changelogs from commit history
• Documentation = 18% of all commits — unusually high, shows commitment to onboarding
• Monorepo with pnpm workspaces — ~35 packages, each independently testable

The Threat Surface

Notable Reactions

What Worked

• Release every 1.7 days — continuous deployment with proper CI. CalVer removes the "is this a major or minor?" bikeshed
• AI as first-class contributor — AGENTS.md, 500 LoC file limits, AI-ergonomic architecture. Design your codebase for LLMs to navigate
• Attribution creates community — "Thanks @" in every merge. Contributors feel valued. 0.3% → 83.3% community share
• Modern tooling — oxlint > ESLint, tsdown > webpack. Rust-based tools enable speed at scale
• Documentation = 18% of commits — treat docs as a first-class deliverable, not an afterthought

What to Watch Out For

• Bus factor of 1 — 79% of commits from one person is a sustainability risk. Build leadership depth early
• Security defaults matter — 135K exposed instances because the defaults were insecure. Secure-by-default or pay later
• "Ship code I don't read" — AI-generated code still needs review. The 3 CVEs and 341 malicious skills are the cost of speed without scrutiny
• Marketplace trust — 31K skills with insufficient vetting. NPM learned this lesson. ClawHub is learning it now