OpenClaw. Hardened.
One click.

ClawFactory is a Windows installer that packages OpenClaw — a local AI agent runtime — inside a hardened security sandbox. When you run the installer, it sets up a WSL2 Linux environment, installs the OpenClaw runtime inside it, configures a firewall that restricts what the agent can reach on the internet, and wires everything so the agent runs locally on your machine. You interact with it through ClawChat, the desktop chat app included with your install; the installer also sets up ClawFactory Studio, a visual workbench for managing setup and granting the agent access to specific project folders. Your conversations stay on your machine. Nothing is sent to a central server.

Your conversations are stored locally in %APPDATA%\ClawChat\conversations\ on your Windows machine. The egress firewall blocks the open internet and permits outbound traffic only to an allowlist: your chosen AI provider's API (the call that generates each response) plus the update sources the runtime needs (for example GitHub, npm, and Ubuntu package mirrors). No telemetry, no analytics, no conversation logging to any server we control. The firewall enforces this at the network level, not just by policy. Two honest caveats: it matches on resolved network address rather than on site name, so anything co-hosted with an allowed address is reachable, and a DNS lookup still leaves the machine. Both are written up in full in SECURITY_FINDINGS.md in the repository.

Almost nothing outside its own sandbox. By default the agent runs inside WSL2 with automount disabled, so your Windows filesystem (C: drive, Documents, Downloads, everything) is invisible to it. The egress firewall restricts outbound network calls to an allowlist (your AI provider's API and the update sources the runtime needs) rather than the open internet. It reads a Windows folder only when you grant that folder to it in Studio, and nothing else on your drives. It cannot access other applications, and it cannot make arbitrary internet requests.

The following are blocked by default at install:
— Windows filesystem: invisible to the agent (automount=false)
— Inbound network connections to port 8787 from other devices on your network (Windows Firewall rule)
— Outbound network traffic except to an allowlist — your configured AI provider's API plus the update sources the runtime needs (nftables egress firewall scoped to the agent's Linux user)
— The gateway only binds to 127.0.0.1 — not accessible from other machines on your network

A note on how these controls work: every restriction listed above is enforced at the OS or network level — not by instructing the agent to behave a certain way. The egress firewall is an nftables rule in the Linux kernel scoped to the agent's user ID. The gateway binding is a network socket configuration. automount=false is a WSL2 kernel parameter. None of these can be overridden by the agent itself, regardless of what instructions it receives. This is the difference between a security control and a security suggestion.

Settings management via the ClawChat interface is on the roadmap for an upcoming release. In the current version, security controls are configured at install time and designed to stay locked by default. If you need to modify access — for example, allowing the agent to read specific files or reach additional network endpoints — contact support@clawfactory.app and describe your use case. Manual configuration options will be documented here when the settings interface ships.

After install, ClawChat opens automatically. Type your message in the input bar and hit Enter — the agent responds in real time, streaming tokens as they arrive. Conversations are saved automatically and appear in the sidebar. Use the New Chat button to start a fresh conversation. The gateway status dot in the top-left of ClawChat shows green when your agent is running and ready. If it shows red, use the Kill Switch from the Start Menu, then reopen ClawFactory from the desktop icon.

It is an action you take, not a boundary that holds, so it is not listed above as a security control. When you run it from the Start Menu it unmounts your granted folders, attempts to stop the gateway and any running turn, and then counts what is still alive and tells you plainly if it could not stop something. On every release up to v1.4.3 it stopped nothing at all: both of the commands it sent into the sandbox failed on a quoting fault and it reported success anyway. That is fixed in v1.4.4, and both halves have now been measured from a clean install: it stopped a running gateway and turn, and with every one of its sandbox calls deliberately made to fail it refused to claim success. It stays off the list above because it is an action rather than a boundary, not because of the evidence behind it.

During install you choose your AI provider — Grok (xAI), OpenAI, Anthropic Claude, Google Gemini, or a local Ollama model — with Grok pre-selected as the default. You supply that provider's API key, which is stored in Windows Credential Manager (DPAPI). You can change providers at any time from the Switch AI Provider tool in the Start Menu — it updates the stored key, adjusts the firewall allowlist, and restarts the local gateway.

ClawFactory is the current product and the one that is maintained. ClawAgent is an earlier single-agent build from May 2026. It shares the original substrate (WSL2 sandbox, egress firewall, DPAPI key storage, loopback-only gateway) but it does not have anything added since: the approval-gated email send, the 30-day recoverable delete, the web access panel, the chat gating proxy, or ClawFactory Studio. If you want the security story described on this page, install ClawFactory.

Conversations are stored in your Windows user profile under %APPDATA%\ClawChat\conversations\ — accessible only to your Windows user account under normal circumstances. ClawFactory is not currently designed for shared or multi-user machines. If multiple people use the same Windows account, they would share the same conversation history.

The ClawFactory installer is code-signed (Azure Trusted Signing) and RFC 3161 timestamped, so it shows a verified publisher instead of an "unknown publisher" warning. Because the signing certificate is new, Windows SmartScreen may still show a first-run reputation prompt until the installer builds reputation — if you see it, click "More info" then "Run anyway." You can confirm the signature under the file's Properties → Digital Signatures tab, or verify its SHA-256 hash against the value published with the release.

Not yet. ClawFactory and ClawAgent are Windows 10/11 only. The WSL2 sandboxing approach is Windows-specific. Mac and Linux support is on the long-term roadmap but has no committed timeline.

Use Windows Settings → Apps → ClawFactory (or ClawAgent) → Uninstall. ClawFactory is removed either way: the agent, its configuration, the OpenClaw runtime, the firewall rules, the scheduled task, and the sandbox account and its home directory. You are then asked one question, and it is a real choice. Yes also unregisters the Ubuntu distro and deletes its disk image, about 6 GB. No leaves the now-empty distro registered, so anything else sharing it keeps working and a later reinstall reuses it; its disk image stays on your drive, because the registration points at that file. If the Linux side cannot be cleaned up, the uninstaller says so and names what it left rather than reporting success. Your conversation history in %APPDATA%\ClawChat\ survives either choice and is never deleted automatically — remove that folder manually if you want nothing left.

Nothing. ClawFactory is free and open source under the Apache License 2.0. There is no subscription, no licence key, and no account. You still pay your AI provider for the model calls your agent makes, that bill is between you and them, and ClawFactory installs a spend cap to help you bound it.