OpenClaw App Security Checklist

OpenClaw is a local-first personal AI gateway with 29 chat channels, client and server MCP and a managed registry via openclaw mcp CLI and Control UI. To ship apps securely with OpenClaw, pin ~/.openclaw/openclaw.json as security policy, set toolFilter allowlists and timeouts per server, validate channel inputs that can trigger repo writes, use TLS or mTLS for remote transports and enforce diff-aware SARIF gates with human review on auth and payment paths.

Record the exact OpenClaw version, enabled channels, MCP server definitions, tool filters and authentication method with each acceptance run. A successful static config check establishes syntax only; use doctor --probe for connection evidence and retain the resulting scope separately from the application security assessment.

If you are new to AI-generated code risks, start with the vibe coding security guide for the shared baseline before applying this checklist.

1. Pin gateway config and treat ~/.openclaw/openclaw.json as security policy

OpenClaw reads optional JSON5 from ~/.openclaw/openclaw.json. Strict validation rejects unknown keys, only $schema is allowed at root and the gateway watches and hot-applies changes by disposing cached session MCP runtimes. Saved definitions live under mcp.servers and are consumed by embedded OpenClaw and runtime adapters. CLI does not connect to target servers during list/show/set/unset; doctor checks static issues, doctor --probe and probe perform live connection proof.

Baseline:

• Commit a template, not the live file. Live file contains tokens and TLS paths. Track a openclaw.json.example with enabled: false and toolFilter defaults.
• Avoid symlinked layouts, OpenClaw-owned writes replace atomically via rename and will replace the symlink target.
• Use OPENCLAW_CONFIG_PATH only pointing at a real file. Atomic replace semantics matter for audit trails.

2. Filter MCP tool surface with toolFilter, timeouts and parallel hints

The reference you verified live shows canonical shape:

{
  mcp: {
    servers: {
      docs: {
        command: "npx",
        args: ["-y", "@modelcontextprotocol/server-fetch"],
      },
      remote: {
        url: "https://app.lyrashieldai.com/api/mcp",
        transport: "streamable-http", // streamable-http | sse
        requestTimeoutMs: 20000,
        connectionTimeoutMs: 5000,
        supportsParallelToolCalls: true,
        headers: {
          Authorization: "Bearer ${MCP_REMOTE_TOKEN}",
        },
        auth: "oauth",
        toolFilter: {
          include: ["search_*"],
          exclude: ["admin_*"],
        },
      },
    },
  },
}

Follow the current openclaw integration guide and manually merge the server entry, preserving existing settings. Authenticate local stdio separately with npx -y lyrashield@0.2.14 login --oauth and use @lyrashield/mcp@0.2.12. Use pinned CLI commands for documented config or skill installs; marketplace plugins remain separately gated. Restart the client, confirm discovery, then call lyrashield_list_workspaces for authenticated read-only access. CLI doctor does not establish client authentication or scan completion.

LyraShield integration using the same primitives, docs at openclaw integration guide:

Local stdio:

openclaw mcp add lyrashield --command npx --arg -y --arg @lyrashield/mcp@0.2.12

Remote Streamable HTTP:

openclaw mcp add lyrashield-remote --url https://app.lyrashieldai.com/api/mcp --transport streamable-http --auth oauth
openclaw mcp login lyrashield-remote

Or JSON5:

{
  mcp: {
    servers: {
      lyrashield: {
        command: "npx",
        args: ["-y", "@lyrashield/mcp@0.2.12"],
        toolFilter: {
          include: ["scan_target", "get_findings"],
          exclude: [],
        },
        requestTimeoutMs: 20000,
      },
      lyrashield_remote: {
        url: "https://app.lyrashieldai.com/api/mcp",
        transport: "streamable-http",
        auth: "oauth",
        requestTimeoutMs: 20000,
        toolFilter: {
          include: ["*"],
          exclude: ["delete_*"],
        },
      },
    },
  },
}

Checklist:

• Always set toolFilter. Include globs like search_* for broad servers, exact names for sensitive verifiers. Exclude admin_* and delete_*. Filter also applies to utility wrappers resources_list, resources_read, prompts_list, prompts_get.
• Set per-server requestTimeoutMs and connectionTimeoutMs. Use supportsParallelToolCalls: false unless concurrency is intentional.
• Use enabled: false to retain definition but exclude from discovery rather than deleting, preserves audit trail.
• Run openclaw mcp status --verbose to view resolved transport/auth/filter without connecting and openclaw mcp doctor to catch literal secrets, missing TLS files and disabled servers.

Comparable pattern in hermes-app-security-checklist tools.include and kilo-code-app-security-checklist permission globs.

3. Harden channels: 29 inputs, one gateway authority

OpenClaw converges 29 chat channels into one gateway. Each channel message is untrusted input that can become a tool call if your agents are trigger-happy. That is direct LLM02 Insecure Output Handling → LLM08 Excessive Agency.

Actions:

• Require explicit intent for any channel message that writes code or pushes to git. Do not allow auto-execution from channel payloads.
• Sanitize channel-provided URLs and filenames. OWASP A03 Injection includes SSRF via URL fetched by an MCP server.
• Log gateway sessions with 10-minute idle TTL in mind, session-scoped bundled MCP runtimes clean up on TTL. Do not rely on idle cleanup for secret rotation; script teardown.
• Use OAuth for the LyraShield remote. openclaw mcp login <name> performs the MCP OAuth flow and stores credentials under OpenClaw state.

4. Lock TLS, mTLS and transport choice

OpenClaw supports transport: streamable-http | sse | stdio, sslVerify, clientCert/clientKey for mTLS and optional codex projection controls that scope a server to listed agent IDs.

Hardening:

• For private MCP endpoints, set sslVerify to a CA bundle path, not false. sslVerify: false is only for explicitly trusted private HTTPS.
• For mTLS, set clientCert and clientKey paths. Paths are validated by doctor.
• Prefer streamable-http for bidirectional streaming with remote verifiers. sse is legacy compat. Use stdio for local-first verifiers like npx -y @lyrashield/mcp@0.2.12 to keep secrets on host.

5. Build release evidence that survives gateway sessions

OpenClaw’s strength is personal automation. For app delivery, that automation needs deterministic gates that outlive the gateway session.

Target PR gate:

• GitHub Action designed to be diff-aware: only routes/files changed by OpenClaw-driven commits are mandatory for retest.
• SARIF emission from all scanners so GitHub Advanced Security has a single pane for CWE/CVSS. Agent-generated fixes often fix one CWE-79 XSS and introduce another, retest closes that loop.
• CODEOWNERS for auth/payment/crypto paths. OpenClaw can generate those files, but ownership must be human-declared.
• Retain openclaw mcp list output and embedded tool lists as build artifacts. If a finding is disputed, you can prove which verifier version and toolFilter were active, comparable to the artifact retention recommended in amp-app-security-checklist and pi-coding-agent-app-security-checklist.

#	Control	Where	Risk
1	Pin openclaw.json template, live file gitignored	~/.openclaw/openclaw.json, OPENCLAW_CONFIG_PATH	Secrets in git, symlink overwrite
2	toolFilter include/exclude + disable wrappers	mcp.servers.*.toolFilter, enabled: false	Overbroad MCP tool can delete or exfil
3	Timeouts + parallel hint	requestTimeoutMs, connectionTimeoutMs, supportsParallelToolCalls	Hung server holds creds, race in parallel calls
4	TLS/mTLS pinning	sslVerify, clientCert, clientKey, doctor	MITM on private MCP, missing cert not caught
5	Channel input validation	Gateway, 29 channels	Chat message triggers repo write/push
6	Diff-aware SARIF gate + CODEOWNERS	.github/workflows/*, CODEOWNERS	AI auth bypass ships, no owner on auth file

Why pair OpenClaw with LyraShield

OpenClaw gateway configuration should be reviewed as executable access policy. The OWASP Top 10 supplies a baseline for authorization and injection review, CWE-798 covers hardcoded credential exposure and the Model Context Protocol specification defines MCP transport and tool contracts. These references are not a security guarantee. They help reviewers inspect which channels and tools can act, where credentials resolve and whether a release record binds the configuration revision to its stated limits. Repeat this review after changing a gateway, channel, skill, MCP server or approval boundary.

Keep that record scoped to the gateway revision reviewed.

OpenClaw gives you local-first gateway power: one control plane for 29 channels, client-and-server MCP and a verified registry with doctor/probe. LyraShield is the narrow verifier on that gateway: release assurance for AI-built apps with target, review, evidence, fix, retest, report and SCA and secrets feeding SARIF, not another general-purpose agent. LyraShield keeps detected candidates, retest outcomes and inconclusive results distinct in an assurance record and fix proposals are approval-gated, with PR execution blocked until a server-generated patch is bound to the exact approval.

The integration surface matches OpenClaw primitives: local npx -y @lyrashield/mcp@0.2.12 for developer machines and remote https://app.lyrashieldai.com/api/mcp with revocable authentication, both behind toolFilter and requestTimeoutMs. The combination is about channel-to-release integrity: least-privilege MCP inspection, an advisory diff-aware CI gate and a separate recorded retest. The platform is live in open beta; scans, findings and evidence, approval-gated fix proposals, retests, reports and billing are implemented. Production availability remains bounded by release gates and automatic server-generated Fix PR execution is not enabled.

Before you merge, run the AI app security checklist to verify auth, secrets and dependencies one more time.

CTA

Create an account at lyrashieldai.com for OpenClaw config templates, toolFilter presets and access to the verification loop.