# Openclaw Config

> Automated configuration and deployment system for OpenClaw VMs with AI tools, deployment platforms, and file sharing

- **Type:** MCP server
- **Install:** `agentstack add mcp-nyldn-openclaw-config`
- **Verified:** Pending review
- **Seller:** [nyldn](https://agentstack.voostack.com/s/nyldn)
- **Installs:** 0
- **Category:** [Databases](https://agentstack.voostack.com/c/databases)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [nyldn](https://github.com/nyldn)
- **Source:** https://github.com/nyldn/openclaw-config

## Install

```sh
agentstack add mcp-nyldn-openclaw-config
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# OpenClaw VM Configuration v3.0

Automated configuration and deployment system for OpenClaw VMs with comprehensive tooling for AI development, cloud deployment, file sharing, and personal productivity.

**What's New in v3.0:**
- 📋 Veritas Kanban — local-first Kanban board with AI agent orchestration and MCP server
- 🏗️ OCI Terraform + cloud-init infrastructure for Debian 12 and Ubuntu 24.04 ARM
- 🔒 14 critical/high security findings fixed (v2.0.1 audit)
- 🎯 Interactive installation with preset selection
- 📅 Personal productivity integrations (Calendar, Email, Tasks, Slack)
- ⚡ Smart dependency resolution

## 🚀 Quick Start

### Installation

**Recommended Method (Secure):**

```bash
# One-line install (clone + run)
git clone https://github.com/nyldn/openclaw-config.git && cd openclaw-config/bootstrap && ./bootstrap.sh
```

**Alternative One-Line (Download + Run):**

```bash
curl -fsSL https://raw.githubusercontent.com/nyldn/openclaw-config/main/bootstrap/install.sh -o /tmp/openclaw-install.sh && bash /tmp/openclaw-install.sh
```

The installer will:
- ✅ Verify prerequisites (git, curl, bash)
- ✅ Show an interactive module selection menu
- ✅ Install only the components you choose
- ✅ Complete in ~5-15 minutes depending on selections
- ✅ Automatically run post-install setup and auth wizards

**Non-Interactive Mode:**

For automated installations (CI/CD, scripts):

```bash
# Install all modules without prompts
./bootstrap.sh --non-interactive

# Install specific modules only
./bootstrap.sh --only system-deps,nodejs,python

# Skip the post-install wizard
./bootstrap.sh --skip-setup
```

See [docs/INSTALLATION.md](docs/INSTALLATION.md) for detailed installation options and customization.

**Security Note:** We no longer support `curl | bash` installation methods as they pose security risks. Always clone the repository first to review the code before execution.

## 📦 What's Included

### Core AI Tools
- **Claude Code CLI** - Anthropic's Claude assistant
- **OpenAI CLI** - GPT-4 and GPT-3.5 access
- **Gemini CLI** - Run via `npx @google/gemini-cli` (see https://github.com/google-gemini/gemini-cli)
- **Claude Octopus** - Multi-AI orchestration system

**Claude Code CLI install notes:**
- macOS: `brew install --cask claude-code`
- Linux: `curl -fsSL https://claude.ai/install.sh -o /tmp/claude-install.sh && bash /tmp/claude-install.sh`
- Node.js 18+ only required for deprecated npm install flows
- `ripgrep` is usually included; if `claude` search fails, see Claude search troubleshooting
Claude Octopus requires the Claude CLI; if it isn't installed yet, rerun later with:
`./bootstrap.sh --only claude-cli,claude-octopus`

### Deployment Platforms
- **Vercel CLI** - Serverless and edge deployments
- **Netlify CLI** - Static sites and functions
- **Supabase CLI** - Backend-as-a-Service

### File Sharing & Storage
- **Google Drive MCP** - Drive integration via MCP
- **Dropbox MCP** - Dropbox API access
- **rclone** - 50+ cloud storage backends
- **GitHub MCP** - Repository operations

### Development Environment
- **Python 3.9+** with virtual environment
- **Node.js 20+** with npm
- **System utilities** - git, curl, jq, etc.
- **Memory system** - SQLite-based persistence
- **Auto-updates** - Daily automated updates for all components
- **Veritas Kanban** - Local-first Kanban board with AI agent orchestration, `vk` CLI, and MCP server

### MCP Servers (11+ Total)
**Core Servers:**
- Google Drive - File operations and sharing
- Dropbox - Cloud storage access
- GitHub - Repository management
- Filesystem - Local file operations
- PostgreSQL - Database access (Supabase)
- Brave Search - Web search capabilities

**Productivity Servers:**
- Google Calendar - Event management and scheduling
- Email - IMAP/SMTP for reading and sending emails
- Todoist - Task and project management
- Slack - Team messaging and collaboration

**Development Servers (NEW in v3.0):**
- Veritas Kanban - Task management, board operations, and AI agent orchestration via MCP

### Security Features (Enhanced in v2.0.1)
- **Download Verification** - All external downloads use `secure-download.sh` with SHA256 hash audit logging
- **Secret Sanitization** - Automatic redaction of API keys, tokens, passwords in logs
- **Credential Encryption** - AES-256-CBC encryption with 600,000 PBKDF2 iterations
- **Pre-commit Hook** - Prevents accidental commits of secrets
- **Input Validation** - Strict validation of module names, URLs, file paths; sed injection prevention
- **Secure Temp Files** - Uses `mktemp` instead of predictable paths across all modules
- **Restrictive Permissions** - 0600/0700 for sensitive directories and files
- **.env Validation** - Rejects command substitution, backticks, and shell constructs before sourcing
- **Atomic Locking** - `mkdir`-based locks prevent TOCTOU race conditions
- **Localhost-Only Ports** - Dev ports (3000, 5432, 8000) restricted to loopback in UFW
- **Safe Auto-Updates** - Security-only upgrades via `unattended-upgrade`; `--ff-only` git pulls

### Shell Aliases (42+ Total)
- Deployment shortcuts (deploy-vercel, deploy-netlify, etc.)
- File sharing (share-dropbox, share-gdrive)
- Cloud sync (sync-dropbox, sync-gdrive, sync-s3)
- MCP management (mcp-list, mcp-reload, mcp-logs)
- Productivity helpers (productivity-setup, calendar-auth)

## 📁 Repository Structure

```
openclaw-config/
├── README.md                    # This file
├── docs/INSTALLATION.md        # Detailed installation guide
├── docs/guides/MIGRATION.md    # Migration guide for v1.x → v2.0
├── docs/guides/SECURITY.md     # Security policy and practices
├── bootstrap/                   # Bootstrap system
│   ├── bootstrap.sh            # Main installer (with interactive mode)
│   ├── install.sh              # Secure installation script
│   ├── manifest.yaml           # Module metadata (v2.0)
│   ├── checksums.yaml          # Download verification checksums
│   ├── modules/                # Installation modules (19 total)
│   │   ├── 01-system-deps.sh
│   │   ├── 02-python.sh
│   │   ├── 03-nodejs.sh
│   │   ├── 04-claude-cli.sh
│   │   ├── ...
│   │   ├── 18-ollama.sh
│   │   └── 19-veritas-kanban.sh  # NEW in v3.0
│   └── lib/                    # Shared utilities
│       ├── logger.sh           # With secret sanitization
│       ├── validation.sh       # Enhanced input validation
│       ├── network.sh
│       ├── interactive.sh      # NEW: Interactive menus
│       ├── dependency-resolver.sh  # NEW: Dependency resolution
│       ├── secure-download.sh  # NEW: Download verification
│       └── crypto.sh           # NEW: Credential encryption
├── deployment-tools/           # Deployment configuration
│   ├── mcp/
│   │   ├── mcp-servers-extended.json
│   │   ├── mcp-servers-full-stack.json
│   │   └── implementations/    # NEW: Custom MCP servers
│   │       ├── google-calendar-mcp.js
│   │       ├── email-mcp.js
│   │       ├── todoist-mcp.js
│   │       └── slack-mcp.js
│   ├── config/
│   │   └── productivity-credentials.template.env
│   └── docs/
│       └── PRODUCTIVITY_INTEGRATIONS.md  # NEW: 40-page guide
│       ├── QUICK-START.md
│       ├── openclaw-setup-plan.md
│       └── EMBRACE-WORKFLOW-RESULTS.md
└── reports/                    # Project documentation
    └── FEASIBILITY_REPORT.md
```

## 🎯 Features

### Modular Architecture
- Individual modules for each component
- Incremental updates (only install what's changed)
- Dependency management between modules
- Rollback support for failed installations

### Automated Maintenance
- **Daily auto-updates** for all components
- System packages, Python packages, Node.js packages
- CLI tools (Vercel, Netlify, Supabase)
- MCP servers and repository updates
- Automatic cleanup of unused packages
- Daily update reports and logs

### Comprehensive Validation
- Post-installation health checks
- Module-specific validation
- System diagnostics (--doctor flag)
- Automated testing

### Enterprise-Ready
- State tracking and version management
- Remote manifest for updates
- Non-interactive installation mode
- Logging and error reporting

### Security First
- No credentials in repository
- Docker secrets support
- Token-based authentication
- Minimal privilege requirements

## 🔧 Usage

### Installation Options

```bash
# Full installation (all modules)
./bootstrap.sh

# Verbose output
./bootstrap.sh --verbose

# Install specific modules
./bootstrap.sh --only deployment-tools

# Skip optional modules
./bootstrap.sh --skip gemini-cli

# Preview changes (dry run)
./bootstrap.sh --dry-run

# Non-interactive mode
./bootstrap.sh --non-interactive
```

### Post-Installation

The installer launches a post-install wizard by default. If you skip it, run:

```bash
bash ~/openclaw-config/bootstrap/scripts/openclaw-setup.sh
bash ~/openclaw-config/bootstrap/scripts/openclaw-auth.sh --all
```

1. **Configure API Keys**
   ```bash
   nano ~/openclaw-workspace/.env
   ```

   Add your keys:
   ```env
   ANTHROPIC_API_KEY=sk-ant-xxx
   OPENAI_API_KEY=sk-proj-xxx
   GOOGLE_API_KEY=xxx
   GITHUB_PAT=ghp_xxx
   SUPABASE_DB_URL=postgresql://xxx
   ```

2. **Authenticate Services**
   ```bash
   claude login
   vercel login
   netlify login
   supabase login
   ```

3. **Reload Shell**
   ```bash
   source ~/.zshrc
   ```

4. **Test Installation**
   ```bash
   ./bootstrap.sh --validate
   ```

5. **Auto-Updates** (Configured Automatically)

   Daily updates are configured to run at 3:00 AM:
   ```bash
   # Check update timer status
   systemctl --user status openclaw-auto-update.timer

   # View last update
   journalctl --user -u openclaw-auto-update.service

   # View today's update report
   cat /var/log/openclaw/update-report-$(date +%Y%m%d).txt

   # Run update manually now
   systemctl --user start openclaw-auto-update.service
   ```

   See [AUTO_UPDATE_GUIDE.md](bootstrap/AUTO_UPDATE_GUIDE.md) for full documentation.

## 📚 Documentation

- **Bootstrap System**: [bootstrap/README.md](bootstrap/README.md)
- **Auto-Update Guide**: [bootstrap/AUTO_UPDATE_GUIDE.md](bootstrap/AUTO_UPDATE_GUIDE.md)
- **Quick Start Guide**: [deployment-tools/docs/QUICK-START.md](deployment-tools/docs/QUICK-START.md)
- **Setup Plan**: [deployment-tools/docs/openclaw-setup-plan.md](deployment-tools/docs/openclaw-setup-plan.md)
- **Workflow Results**: [deployment-tools/docs/EMBRACE-WORKFLOW-RESULTS.md](deployment-tools/docs/EMBRACE-WORKFLOW-RESULTS.md)

## 🚢 Deployment

### Single VM
```bash
ssh user@vm-host 'curl -fsSL https://raw.githubusercontent.com/nyldn/openclaw-config/main/bootstrap/install.sh | bash'
```

### Multiple VMs
```bash
for host in vm1 vm2 vm3; do
    ssh user@$host 'curl -fsSL https://raw.githubusercontent.com/nyldn/openclaw-config/main/bootstrap/install.sh | bash'
done
```

### Custom Configuration
```bash
./bootstrap.sh --config config/custom.yaml
./bootstrap.sh --manifest-url https://internal.company.com/manifest.yaml
```

## 🛠️ Available Commands

After installation, you'll have access to 42+ shell aliases:

### Deployment
```bash
deploy-vercel              # Deploy to Vercel
deploy-netlify             # Deploy to Netlify
deploy-supabase            # Deploy to Supabase
deploy                     # Auto-detect platform
```

### File Sharing
```bash
share                      # Create shareable link
share-dropbox              # Upload to Dropbox
share-gdrive               # Upload to Google Drive
```

### Cloud Sync
```bash
sync-dropbox               # Sync to Dropbox
sync-gdrive                # Sync to Google Drive
sync-s3                    # Sync to S3
```

### MCP Management
```bash
mcp-list                   # List MCP servers
mcp-reload                 # Reload configuration
mcp-logs                   # View MCP logs
mcp-test                   # Test connections
```

### Project Workflows
```bash
project-init               # Initialize new project
project-deploy             # Deploy current project
project-share              # Share project files
```

## 🔍 Requirements

- **OS**: Debian 10+ or Ubuntu 20.04+
- **User**: Non-root with sudo privileges
- **Disk**: 2GB+ free space
- **Network**: Internet connection
- **Memory**: 1GB+ RAM recommended

## 🤝 Contributing

1. Fork the repository
2. Create a feature branch
3. Add/modify modules in `bootstrap/modules/`
4. Test with `./bootstrap.sh --module your-module`
5. Submit a pull request

## 🎉 Success Metrics

- **Setup Time**: ~5 minutes
- **Components**: 19 modules
- **MCP Servers**: 11+ configured
- **Shell Aliases**: 42 available
- **Validation**: 100% coverage

## 🔒 Security

**Enhanced in v2.0.1 (14 findings fixed — 5 CRITICAL, 9 HIGH):**
- ✅ No `curl | bash` installation (security vulnerability eliminated)
- ✅ SHA256 checksum verification for all downloads via centralized `secure-download.sh`
- ✅ Automatic secret sanitization in logs (15+ patterns)
- ✅ AES-256-CBC credential encryption with 600,000 PBKDF2 iterations
- ✅ Pre-commit hook prevents accidental secret commits
- ✅ Sed injection prevention — safe line-by-line file rewrites instead of interpolation
- ✅ `.env` validation rejects command substitution, backticks, and shell constructs before sourcing
- ✅ API keys passed via environment variables, never exposed in process lists
- ✅ Atomic `mkdir`-based locking prevents TOCTOU race conditions
- ✅ Dev ports (3000, 5432, 8000) restricted to localhost in UFW
- ✅ Safe auto-updates — security-only via `unattended-upgrade`; `--ff-only` git pulls
- ✅ Module sourcing validation — shebang and permission checks before execution
- ✅ Secure temporary file handling with `mktemp` (no predictable paths)
- ✅ Restrictive file permissions (0600/0700 for sensitive files)

**Best Practices:**
- API tokens via environment variables
- App-specific passwords for email
- 90-day token rotation recommended
- Minimum privilege scopes enforced
- See [docs/guides/SECURITY.md](docs/guides/SECURITY.md) for full security policy

## 📝 License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.

## 🆘 Support

- **Issues**: https://github.com/nyldn/openclaw-config/issues
- **Documentation**: https://github.com/nyldn/openclaw-config/wiki
- **Bootstrap Docs**: [bootstrap/README.md](bootstrap/README.md)

## 📅 Changelog

### v3.0.0 (2026-02-22)

**📋 Veritas Kanban Integration:**
- New bootstrap module `19-veritas-kanban.sh` — installs [Veritas Kanban](https://github.com/BradGroux/veritas-kanban) local-first Kanban board with AI agent orchestration
- Automated setup: git clone, `pnpm build`, `vk` CLI linking, `.env` generation with random admin key, and Claude MCP config merging
- MCP server entries added to `mcp-servers-extended.json` and `mcp-servers-full-stack.json`
- Module includes full lifecycle: `check`, `install`, `validate`, `rollback`

**🏗️ Infrastructure:**
- OCI Terraform + cloud-init infrastructure for Debian 12 ARM deployment
- Ubuntu 24.04 Minimal ARM support from OCI catalog
- Aligned bootstrap with upstream `openclaw/openclaw` requirements

**🔧 Improvements:**
- 18 codebase improvements across security, UX, infrastructure, and tooling
- Interactive install wizard and CLI setup hardening
- Post-install onboarding system
- Manifest updated to v3.0.0 with `veritas-kanban` entry

### v2.0.1 (2026-02-21)

**🔒 Zero-Trust Security Audit — 14 Findings Fixed (5 CRITICAL, 9 HIGH):**

*CRITICAL Fixes:*
- **Sed injection prevention** — Replaced unsafe `sed` interpolation with line-by-line file rewrites in `openclaw-setup.sh` and `openclaw-auth.sh`
- **API key process list exposure** — API keys now passed via environment variables, not CLI arguments (`openclaw-auth.sh`)
- **Download verification** — All external downloads routed through `secure-download.sh` with SHA256 audit logging (5 modules: nodejs, claude-cli, dev-tools, tailscale, ollama)
- **`.env` sourcing validation** — `.env` files validated for format and rejected if containing `$()`, backticks, `;`, `&&`, `||` before `source`

*HIGH Fixes:*
- **Hardcoded `/tmp` paths** — Re

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [nyldn](https://github.com/nyldn)
- **Source:** [nyldn/openclaw-config](https://github.com/nyldn/openclaw-config)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-nyldn-openclaw-config
- Seller: https://agentstack.voostack.com/s/nyldn
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.