A CLI tool that audits your OpenClaw instance against every known CVE, flags exposed endpoints, and generates a hardening playbook specific to your config
OpenClaw has 138+ CVEs as of May 2026 with 500K instances on the public internet and 63% running without authentication. The jgamblin/OpenClawCVEs tracker holds 413 published vulnerability records. Developers who initially promoted OpenClaw are publicly abandoning it because the security posture is unknowable without manually cross-referencing dozens of advisories against your specific version and config. This CLI scans your running instance, matches your exact version and enabled plugins against the full CVE database, checks for exposed endpoints and missing auth, and outputs an actionable hardening plan.
Demand Breakdown
Social Proof 4 sources
Gap Assessment
3 tools exist (SecureClaw, ClawShield (SleuthCo), ClawSec (Prompt Security)) but gaps remain: Runs inside the agent it is trying to secure. No external validation, no CVE database matching, no network exposure scanning.; Runtime defense only. No pre-deployment CVE audit, no config hardening, no upgrade-path guidance..
Features3 agent-ready prompts
Competitive LandscapeFREE
| Product | Does | Missing |
|---|---|---|
| SecureClaw | OpenClaw plugin that provides automated security auditing and hardening functions from inside the agent | Runs inside the agent it is trying to secure. No external validation, no CVE database matching, no network exposure scanning. |
| ClawShield (SleuthCo) | Security proxy with Go proxy + iptables + eBPF for runtime message scanning | Runtime defense only. No pre-deployment CVE audit, no config hardening, no upgrade-path guidance. |
| ClawSec (Prompt Security) | Security skill suite for OpenClaw agents with drift detection and skill integrity verification | Agent-side only. No instance-level CVE scanning, no network exposure detection, no config-level hardening. |
Sign in to unlock full access.