A self-hostable service layer that turns the OpenClaw agent framework into a programmatic agent platform an application can call over HTTP. It reproduces the four-primitive API shape popularized by Claude Managed Agents — Agent (model, instructions, tools, MCP servers, policies), Environment (container packages and networking), Session (a durable multi-turn conversation), and Event (messages, tool calls, streaming) — but runs on any OpenClaw-supported model provider and any host with Docker. Under the hood, each active session gets its own isolated Docker container running OpenClaw, with SQLite for orchestrator metadata, SSE for event streaming, and a WebSocket control plane for cancel, model override, and tool confirmation; session state survives container eviction and orchestrator restarts.
Notable capabilities beyond the core API:
- Versioned agents with optimistic concurrency and archive, plus permission policies (alwaysallow, deny, alwaysask with client-side tool confirmation)
- Per-session quotas on cost, tokens, and wall-clock duration, enforced before each turn
- A "limited" networking mode that confines a session to an internal Docker network with an egress-proxy sidecar filtering by hostname allowlist at both HTTP and DNS layers
- Delegated subagents whose child sessions are first-class and inspectable through the same API, gated by allowlists, depth caps, and HMAC-signed tokens
- An OpenAI-compatible /v1/chat/completions endpoint with real per-token SSE streaming, so existing OpenAI SDK code can point at it unchanged
- Per-end-user credential vaults that inject bearer tokens into matching MCP server configs at spawn time without ever returning secrets from the API
- A pre-warmed container pool that cuts session start from cold-boot to a few seconds
Operational concerns are treated as first-class: a durable event queue and running-container adoption make orchestrator restarts safe, mutating API calls land in a queryable audit log, Prometheus metrics and OpenTelemetry passthrough cover observability, and rate limiting plus a bearer admin token guard the API (the README notes the resource model is not yet a full multi-tenant boundary). TypeScript and Python SDKs, an OpenAPI spec, a first-party Telegram adapter, and one-command deploy scripts for Hetzner, AWS Lightsail, and Google Compute Engine round out the project.
