OpenClaw. Hardened.
One click.

ClawFactory is a Windows installer that packages OpenClaw — a local AI agent runtime — inside a hardened security sandbox. When you run the installer, it sets up a WSL2 Linux environment, installs the OpenClaw runtime inside it, configures a firewall that restricts what the agent can reach on the internet, and wires everything so the agent runs locally on your machine. You interact with it through ClawChat, the desktop chat app included with your install; the installer also sets up ClawFactory Studio, a visual workbench for managing setup and granting the agent access to specific project folders. Your conversations stay on your machine. Nothing is sent to a central server.

Your conversations are stored locally in %APPDATA%\ClawChat\conversations\ on your Windows machine. The egress firewall blocks the open internet and permits outbound traffic only to an allowlist — your chosen AI provider's API (the call that generates each response) plus the update sources the runtime needs (for example GitHub, npm, and Ubuntu package mirrors). No telemetry, no analytics, no conversation logging to any server we control. The firewall enforces this at the network level, not just by policy.

Almost nothing outside its own sandbox. By default the agent runs inside WSL2 with automount disabled — your Windows filesystem (C: drive, Documents, Downloads, everything) is invisible to it. The egress firewall restricts outbound network calls to an allowlist — your AI provider's API and the update sources the runtime needs — not the open internet. It cannot read your files, access other applications, or make arbitrary internet requests.

The following are blocked by default at install:
— Windows filesystem: invisible to the agent (automount=false)
— Inbound network connections to port 8787 from other devices on your network (Windows Firewall rule)
— Outbound network traffic except to an allowlist — your configured AI provider's API plus the update sources the runtime needs (nftables egress firewall scoped to the agent's Linux user)
— The gateway only binds to 127.0.0.1 — not accessible from other machines on your network

A note on how these controls work: every restriction listed above is enforced at the OS or network level — not by instructing the agent to behave a certain way. The egress firewall is an nftables rule in the Linux kernel scoped to the agent's user ID. The gateway binding is a network socket configuration. automount=false is a WSL2 kernel parameter. None of these can be overridden by the agent itself, regardless of what instructions it receives. This is the difference between a security control and a security suggestion.

Settings management via the ClawChat interface is on the roadmap for an upcoming release. In the current version, security controls are configured at install time and designed to stay locked by default. If you need to modify access — for example, allowing the agent to read specific files or reach additional network endpoints — contact support@clawfactory.app and describe your use case. Manual configuration options will be documented here when the settings interface ships.

After install, ClawChat opens automatically. Type your message in the input bar and hit Enter — the agent responds in real time, streaming tokens as they arrive. Conversations are saved automatically and appear in the sidebar. Use the New Chat button to start a fresh conversation. The gateway status dot in the top-left of ClawChat shows green when your agent is running and ready. If it shows red, use the Kill Switch from the Start Menu to restart the gateway.

During install you choose your AI provider — Grok (xAI), OpenAI, Anthropic Claude, Google Gemini, or a local Ollama model — with Grok pre-selected as the default. You supply that provider's API key, which is stored in Windows Credential Manager (DPAPI). You can change providers at any time from the Switch AI Provider tool in the Start Menu — it updates the stored key, adjusts the firewall allowlist, and restarts the local gateway.

Same security substrate — both include the WSL2 sandbox, egress firewall, DPAPI key storage, loopback-only gateway, and Kill Switch. The difference is scope: ClawFactory adds ClawFactory Studio — a visual workbench for managing setup and granting the agent access to specific project folders. ClawAgent is a single-agent install — faster setup, same security, designed for straightforward use cases.

Conversations are stored in your Windows user profile under %APPDATA%\ClawChat\conversations\ — accessible only to your Windows user account under normal circumstances. ClawFactory is not currently designed for shared or multi-user machines. If multiple people use the same Windows account, they would share the same conversation history.

The ClawFactory installer is code-signed (Azure Trusted Signing) and RFC 3161 timestamped, so it shows a verified publisher instead of an "unknown publisher" warning. Because the signing certificate is new, Windows SmartScreen may still show a first-run reputation prompt until the installer builds reputation — if you see it, click "More info" then "Run anyway." You can confirm the signature under the file's Properties → Digital Signatures tab, or verify its SHA-256 hash against the value published with the release.

Not yet. ClawFactory and ClawAgent are Windows 10/11 only. The WSL2 sandboxing approach is Windows-specific. Mac and Linux support is on the long-term roadmap but has no committed timeline.

Use Windows Settings → Apps → ClawFactory (or ClawAgent) → Uninstall. The uninstaller removes the WSL2 environment, the OpenClaw runtime, the firewall rules, and the scheduled task. Your conversation history in %APPDATA%\ClawChat\ is not deleted automatically — remove that folder manually if you want a complete clean uninstall.

No. ClawFactory is a one-time purchase. You pay once and own the installer permanently. Future major versions may be separate purchases. Updates within the current version (v1.x) are free.