Security Hardener

Audit your OpenClaw configuration and apply security best practices automatically.

Quick Start

# Full security audit (read-only, no changes)
python scripts/hardener.py audit

# Audit a specific config file
python scripts/hardener.py audit --config /path/to/openclaw.json

# Audit with JSON output
python scripts/hardener.py audit -f json

# Auto-fix issues (creates backup first)
python scripts/hardener.py fix

# Fix specific issues only
python scripts/hardener.py fix --only gateway,permissions

# Scan for exposed credentials in config
python scripts/hardener.py scan-secrets

# Generate a security report
python scripts/hardener.py report -o security-report.md

# Check file permissions
python scripts/hardener.py check-perms

Commands

| Command | Args | Description | |---------|------|-------------| | audit | [--config PATH] [-f FORMAT] | Full security audit (read-only) | | fix | [--config PATH] [--only CHECKS] | Auto-fix issues (with backup) | | scan-secrets | [--config PATH] | Scan for exposed API keys/tokens | | report | [-o FILE] | Generate detailed security report | | check-perms | [--config-dir PATH] | Check file permissions |

Security Checks

| Check | Severity | Description | |-------|----------|-------------| | gateway-bind | CRITICAL | Gateway not bound to loopback | | exposed-keys | CRITICAL | API keys in config instead of .env | | insecure-auth | HIGH | allowInsecureAuth or dangerouslyDisableDeviceAuth enabled | | exec-sandbox | HIGH | exec sandbox mode not set to restricted | | file-perms | HIGH | Config files readable by others (not 600) | | agent-allow-all | MEDIUM | agentToAgent.allow: ["*"] is overly permissive | | no-heartbeat | MEDIUM | No heartbeat configured (can't detect outages) | | no-session-reset | MEDIUM | No session reset policy (memory leak risk) | | no-pruning | LOW | No context pruning (cost and performance impact) | | no-memory-flush | LOW | Memory flush disabled (context loss on pruning) |

Scoring

The audit produces a security score from 0-100:

• 90-100: Excellent — production-ready
• 70-89: Good — minor improvements recommended
• 50-69: Fair — several issues to address
• 0-49: Poor — critical issues require immediate attention

Example Output

╔══════════════════════════════════════════════════╗
║  OPENCLAW SECURITY AUDIT                         ║
╠══════════════════════════════════════════════════╣
║  Score: 75/100 (Good)                            ║
║                                                  ║
║  ✅ Gateway bound to loopback                    ║
║  ✅ No exposed API keys in config                ║
║  ⚠️  exec sandbox mode: unrestricted             ║
║  ⚠️  agentToAgent allow: * (too permissive)      ║
║  ❌ File permissions too open (644 → should be 600) ║
║  ✅ Heartbeat configured                         ║
║  ✅ Session reset policy active                   ║
║  ⚠️  No context pruning configured               ║
╚══════════════════════════════════════════════════╝