OpenClaw Managed Agents is a self-hostable service that exposes OpenClaw agents through the four-primitive API shape (Agent, Environment, Session, Event) that Claude Managed Agents established, so your application can call autonomous agents over HTTP on any model and any cloud where Docker runs.
You create an Agent (model, instructions, tools, MCP servers, permission policy, quotas), open a Session against it, post Events, and stream Events back over SSE. Each active session runs in its own Docker container with OpenClaw inside; an orchestrator keeps metadata in SQLite and provides a WebSocket control plane for cancel, model override, and tool confirmation. Session state survives container eviction and orchestrator restarts through a durable event queue and container re-adoption.
Models can be any OpenClaw-supported provider, including Anthropic, OpenAI, Gemini, Moonshot, DeepSeek, Mistral, xAI, Bedrock, OpenRouter, and Groq. Alongside the REST API there are Python and TypeScript SDKs, an OpenAPI spec, and an OpenAI-compatible /v1/chat/completions endpoint with per-token streaming, so an OpenAI SDK client only needs a base_url change. The project positions itself as a layer for building products on OpenClaw, distinct from running a personal OpenClaw instance on a VPS.
Features
- Agent versioning: every update creates an immutable version with optimistic concurrency on PATCH; agents can be archived without losing history
- Permission policy: alwaysallow, deny (block named tools), or alwaysask (pause named tools for client confirmation via SSE)
- Per-session quotas: maxCostUsdPerSession, maxTokensPerSession, and maxWallDurationMs, rejected as HTTP 429 quota_exceeded
- Environments: container config with pip, apt, npm, cargo, gem, and go packages and a networking mode
- Limited networking: a per-session internal Docker network plus an egress-proxy sidecar that allowlists hosts at the HTTP and DNS layers, enforced at the Docker bridge
- Vaults: per-end-user credentials (static bearer or MCP OAuth) injected into matching MCP server configs; secrets are write-only in the API
- MCP servers: stdio or HTTP server configs forwarded into the container's openclaw.json at spawn time
- Subagents: child sessions are first-class and inspectable through the same API
- Event stream: message, tool-use, tool-result, thinking, compaction, and status events over SSE with Last-Event-ID resume
- Container pooling: a pre-warmed pool and a bounded active pool with oldest-idle eviction
- Audit log: queryable GET /v1/audit of mutating API calls with configurable retention
- Published artifacts: orchestrator, agent runtime, egress proxy, and Telegram adapter images on GHCR
