Is my agent safe? We can't promise that. We can show you what's exposed.
Your agent holds your API keys, inbox and files. Paste your OpenClaw audit and get a plain-English answer in minutes: what we checked, what we found, and the exact commands to fix it.
Look-only. We read what you paste. We never log in, try passwords or change anything.
What we checked and found as of 2026-10-18 14:00 UTC
Sample result
Anyone who can reach it can use your keys on your bill.
Slow it to 1h:
openclaw config set agents.defaults.heartbeat.every 1hMove them to env references, then rotate.
Node 24.16+ required from 2026.9.3.
How the free check works
Two minutes, no terminal skills beyond copy and paste.
Step 1
Run two commands
openclaw security audit --deep, plus openclaw --version (optional, for the known-vulnerability check). Paste both outputs.
Step 2
Paste it
Your browser hides anything that looks like a key or token before it's sent. You can see the hidden version first.
Step 3
We explain it
We turn OpenClaw's findings into plain English and add our own checks for key theft, surprise bills and risky versions.
Step 4
Get your result
Red, amber or green with the most important fix. If the check can't finish, we say so. It's never green.
What we check that others don't explain
Built for people who run an agent, not a security team.
Key-theft check
API keys saved in plain text, keys handed to skills, files other users can read, and versions with known token-stealing bugs.
Surprise-bill check
No hard spend limits, heartbeats waking a premium model all day, open gateways and DMs others could use on your dime.
Upgrade watch
Missing security fixes for your exact version, plus the breaking changes to read before you upgrade. Monitoring alerts you on new releases.
Plain-English fix list
Every finding with what it means, why it matters and copy-paste commands, plus a ready-made prompt for your coding agent.
Outside checks only for agents you control
Coming soon: a look-only check of your agent's public address. Before we contact anything, you prove it's yours in one of three ways.
A small file
Serve your one-time code at /.well-known/ismyagentsafe-verify.txt.
A DNS record
Add a TXT record at _ismyagentsafe.yourdomain containing your code.
A header
Have your proxy send X-IsMyAgentSafe-Verify: your-code.
Not live yet. Codes will be single-use and expire after 24 hours. We never check private or internal addresses. About our scanner.
Start free, pay for the full picture
Prices in US dollars.
Free check
- Red, amber or green result
- Count of findings
- Your most important fix
Full report
- Every finding in plain English
- Copy-paste fix list
- Key-theft, surprise-bill and upgrade sections
- Prompt for your coding agent
- Key-rotation checklist
- Automatic refund if the check can't finish
Monitoring
- Alerts when a new release or advisory affects your version
- Breaking-change notes before you upgrade
- Scheduled re-checks
- Cancel any time
Agency
- Monitoring for up to 10 client agents
- Reports with your logo
- One client list
What a result can't tell you
The name asks a question we can't answer with a yes. Every result says what we checked and found, and when (in UTC). A green result means no issues found in the checks we ran. It's not a guarantee.
- Point-in-time: things change after we look.
- Look-only: we don't log in, exploit or break anything.
- Not a penetration test, code review or certification.
- We don't check the computer your agent runs on, prompt injection, or what your agent does with your data.
Learn the basics, in plain English
Agents and AI security, explained
Agents & AI Security, explained: one short email a week. Free. Unsubscribe any time.
We'll only use your email to send the newsletter. Privacy policy.
Questions, answered
Which agents do you support?
OpenClaw (including older Clawdbot/Moltbot installs). Others may come later.
So, is my agent safe?
We can't promise that, and nobody honest can. We can tell you what we checked and found, when, and how to fix it.
What happens to what I paste?
Your browser hides secret-looking values before sending. We keep results for 90 days so you can view your report, then delete them. Privacy policy.
What if the check can't finish?
The result is never green, and checkout stays closed until it's complete. If a paid check can't finish, we refund you automatically. Refund policy.
Do you change anything on my machine?
No. You run the commands. We only read what you paste.