how to build OpenClaw AI agent for server

Wetin OpenClaw actually be

OpenClaw na self-hosted personal AI agent. You go run am for your own server, connect am to the chat apps wey you dey use already, and e fit run shell commands, control browser, read and write your files, and act on the messages wey you send am. E get MIT-license, e dey local-first, and e get over 380,000 GitHub stars as of mid-2026, wey make e dey among the most-starred projects for the platform. If you look am well, e be like small set of parts wey dem wire together for sensible way. This post go show you dem parts so you go understand how dem dey build tool like this, and where the danger dey.

One warning before we start, because e dey affect every design choice wey dey below. For March 2026, OpenClaw get nine security issues wey dem disclose within four days, including one critical privilege-escalation flaw wey get 9.9 out of 10 (CVE-2026-32922). The project design make you, the operator, harden am. Agent wey fit run any command dey safe only as much as the box wey e dey run for and the limits wey you put around am. Keep that one for mind as you dey read.

The gateway daemon: one process, wey dey private

For center, one single long-running process dey, wey dem dey call gateway. Na him be the control plane. E dey receive messages, decide wetin to do, run tools, and send replies back. Everything else dey plug into am.

The most important thing about the gateway na where e dey listen. By default, OpenClaw bind am to the loopback address, 127.0.0.1, so internet no fit reach am unless you go out your way to expose am. Leave am there. Na this single process dey run commands for a living, so if you expose gateway, anyone wey find am go get remote foothold into your server. When you need reach am from your laptop, use VPN or SSH tunnel instead of opening port. Nobody fit attack port wey dem no fit reach.

Channel connectors: to get message in and reply out

Personal agent only useful if you fit talk to am from the apps wey you dey use already. Na wetin channel connectors dey do. Each one dey talk to one platform, like Telegram, WhatsApp, Slack, or Discord, by using that platform bot API or webhooks.

The way dem work na the same for all of dem. The connector register bot with the platform, receive your incoming message (either by polling the platform or by receiving webhook wey the platform dey push to am), hand that message to the gateway, and post the gateway reply back through the same API. The connector na just thin translation layer. E dey convert "a Telegram message arrived" into "here is text for the agent" and back again. To build your own na mostly to read one platform bot documentation and map its message format to the gateway one.

The brain and the tool loop

Inside the gateway, one part dey wey make e be agent instead of chatbot. E be loop.

Message arrive. The gateway send am to language model along with one list of tools wey the model dey allowed to use. The model read the message and decide: answer directly, or call tool. If e call tool, the gateway run that tool, capture the result, and send the result back to the model. The model look the result and decide again. This thing dey repeat until the model no get anything left to do and e produce final reply.

That loop na the whole idea of agent, and na the same loop whether the agent dey inside chat app or terminal. For how tools dey connect to that loop for standard way, connecting tools through the Model Context Protocol na good next read, and for the model side, running the model itself on your own hardware go complete the other half.

The tool set na the point, and the danger

The tools na wetin make OpenClaw powerful. One tool wey run shell command, one tool wey drive browser, one tool wey read and write files. If you give the loop above access to dem, e fit do almost anything wey you fit do for keyboard. That reach na the whole product, and na him be the whole risk too.

Agent wey fit run any command, acting on instructions wey dey come from chat app, na big attack surface. One bad instruction, one prompt-injection attack wey hide inside web page wey the browser tool dey visit, or one bug like the March 2026 flaws, fit turn "read my calendar" into "delete my files." So the limits no be optional extras. Run the agent as a dedicated, unprivileged user wey no get sudo, so say if something go wrong, e no fit escalate. Put gate for the dangerous tools so agent go ask before e do something wey go destroy things. Sandbox tool execution so say if command run wild, e go stay inside one place. Isolate the model API key so say if e leak, attacker no go get your account.

Before you expose anything wey dey run shell commands, follow the basics carefully. Generate one checklist for your own box here, then follow am from top to bottom:

The unprivileged-user part dey covered well-well for running services as an unprivileged user, and the full safe-setup walkthrough for the real project dey for running OpenClaw safely on a VPS.

Memory as plain files

Most people expect agent memory to dey inside database. OpenClaw memory no dey so. E dey store memory as plain Markdown files for disk, and that choice na something wey worth to copy.

Files simple. No schema to migrate, no service to keep running, and no query language to learn. You fit inspect dem: you fit open the folder and read exactly wetin the agent believe about you, correct wrong note by editing file, or delete memory by removing one. And dem dey portable, because to move the agent to new server na just to copy directory. For single-user personal agent, one folder of text files dey enough, and e dey make the whole system easy to understand.

Skills: one portable way to add abilities

Beyond the built-in tools, OpenClaw dey use one portable skill format so community fit extend wetin e fit do without to change the core. One skill na one self-contained bundle of instructions and, sometimes, code wey dey teach the agent new task. The agent dey load skill when the task call for am.

The value of format like this na say abilities become something wey people fit share. Someone write skill for one specific job, publish am, and others dey drop am inside. If you build your own agent, to define small, clear extension format early go save you from hard-coding every capability into the core later.

Bring your own model

OpenClaw no dey care which model you use. E no dey come with its own language model. Instead, e dey connect to the one wey you choose, wey fit be hosted API or one model wey you run yourself.

That split matter for cost, privacy, and control. Hosted API dey give you strong models without hardware to manage, for per-token price and with your prompts dey leave your server. Self-hosted model, wey dey run with something like Ollama, dey keep every message for your own box and e dey cost only hardware and power, at the price of running smaller or slower model. Many people dey mix the two. If you want keep agent fully private, self-hosting the model on your VPS na the part wey go close that last gap, and Hermes Agent na another self-hosted agent wey worth to compare.

You wan build one?

You fit build all of this. The parts no be strange: one daemon, few chat connectors, one model-and-tools loop, one folder of Markdown, and one plugin format. To understand dem dey really useful, because e go clear the doubt about every agent wey you go use and e go tell you exactly where the danger dey.

But for most people, the honest answer na to run the real thing and harden am instead of to reinvent am. OpenClaw don already solve the connectors, the loop, and the skill format, and e don pass real security scrutiny. Your effort better to spend for the part wey na truly yours to get right, wey be the setup and the hardening for your own server. Build one small one to learn. Run and lock down the real one to use.

The general foundations dey for building your own AI agent on a VPS, and building an agent with Claude show the same ideas with one specific model as the brain.

FAQ

E hard to build agent like OpenClaw?

The individual parts no hard. One gateway process, one chat connector, one model-and-tools loop, and one folder of files dey easy to do on their own. The hard part na to do am safely. Agent wey dey run shell commands from chat messages na serious security surface, and to get the sandboxing, permissions, and unprivileged-user setup right na more work than to wire the features together.

Why OpenClaw dey store memory as Markdown files instead of database?

Because for single-user personal agent, files dey enough and dem much simpler. No database service to run, the memory easy to read and correct by hand, and to move the agent to another server na just to copy directory. Database dey for larger scale, no be for here.

Wetin be the most dangerous part of personal AI agent?

The tools wey dey let am act: running shell commands, controlling browser, and writing files. Na dem be the reason to build am and na dem be the reason e fit hurt you. OpenClaw March 2026 security event, nine issues within four days including one 9.9-rated critical, na the clearest argument to treat the tool layer with care: run as unprivileged user, put gate for destructive actions, and sandbox execution.

I need my own language model to build one?

No. Agents like OpenClaw no dey care about the model, so you fit connect the one wey you choose. That fit be hosted API for the strongest models, or one model wey you run yourself for full privacy. Self-hosting with Ollama dey keep every message for your own server at the cost of running smaller model.