SafeClaw: OpenClaw with Protopia SGT Protection 🦞

SafeClaw is an OpenClaw agent with access to Protopia SGT to expand the usability of sensitive data for AI with state-of-the-art data protection and privacy.

SafeClaw does not replace your existing OpenClaw agents, it provides an alternative for using your AI assistant with sensitive information. With SafeClaw, information never leaves your workspace as plaintext and cannot be recovered from the protected embeddings.

💡 Request access to Protopia SGT from https://protopia.ai/safeclaw/

Requirements

Protopia Stained Glass Proxy (SGP) docker image (v1.49.2 or above).
SGT model (e.g Protopia/SGT-for-Qwen3-32B-swept-water-bfloat16).

💡 Request access to a Protopia SGT from https://protopia.ai/safeclaw/

Modal deployment script and Modal API keys (or any other way to host the upstream Qwen3-32B for inference.)
docker-compose file.
openclaw.json starter configuration.
Demo Resources and Data
Example Cron Tasks Scripts

Setup

🐳 Build custom OpenClaw docker image:

# Build demo image from custom Dockerfile
docker build -t ghcr.io/openclaw/openclaw:protopia-demo .

Copy openclaw.json to your local OpenClaw config directory:
```
cp openclaw.json ~/.openclaw/openclaw.json
```
The file uses ${VAR} placeholders for all secrets. The container expands them at startup using env vars passed by docker-compose (see step 4).

⚠️ Important: This will replace your existing ~/.openclaw/openclaw.json. Back it up first if needed.
Deploy upstream LLM to Modal with the Modal Deployment Script (or any other inference service of your choice).
```
# for a Modal deployment:
uv pip install modal
MODAL_LOG_LEVEL=DEBUG modal deploy scripts/modal_deploy_output_protection.py
```
⚠️ Important: The modal deploy script loads the OUTPUT_PROTECTION_IMAGE from AWS ECR. Update this as needed. Other options here.

⚠️ Important: The Modal deployment script loads the Qwen/Qwen3-32B model from Hugging Face. Ensure your Modal huggingface-secret is configured with a valid HF token. This token may differ from the HF token used for SGT model access.
- Update the docker-compose stainedglass service with your modal API keys to ensure SGT proxy can communicate with upstream Modal.
💡 Hint: Set env variable: SGP_REQUEST_HEADERS_TO_ADD: "Modal-Key=[your-key],Modal-Secret=[your-secret]" in the docker-compose stainedglass service.

Set your credentials and run with docker compose. The easiest way is a .env file in the project root:

# .env
HF_TOKEN=...            # HF token with access to the Qwen32B SGT model (provided by Protopia)
MODAL_KEY=...           # Modal API key (for upstream inference)
MODAL_SECRET=...        # Modal API secret
SGT_API_KEY=...         # SGT proxy API key (provided by Protopia)
SLACK_BOT_TOKEN=...     # xoxb-... (required for examples 2, 3, 4)
SLACK_APP_TOKEN=...     # xapp-... (required for examples 2, 3, 4)
BRAVE_API_KEY=...       # Required for example 2 (portfolio monitor web search)
GOG_KEYRING_PASSWORD=safeclaw   # Use 'safeclaw' for the demo Gmail account

Then start:

docker compose -f deploy/compose/docker-compose.yaml up -d

🏁 Verify running containers:

docker ps

# > you should have at least these containers running:
ghcr.io/openclaw/openclaw:protopia-demo
stainedglass-proxy

Register the SafeClaw OpenClaw agent
```
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw agents add safeclaw
```
- This will update your ~/.openclaw/openclaw.json with your new SafeClaw agent.
Access OpenClaw Chat UI at localhost:18790/chat?token=[your token] (setup port-forward if needed).

💡 Hint: You can find the token at ~/.openclaw/openclaw.json under auth.

⚠️ If you get a pairing required error, then you need to allow your device in Openclaw, follow these steps:

# List pending requests
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw devices list

Find devices listed under Pending and copy its request id.

# Approve by request ID
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw devices approve [request-id]

Test accessing the OpenClaw Web UI again, or connect to the OpenClaw TUI:

docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw tui

Setup OpenClaw Browsing Tool

You will need a Brave API key. Get one from https://api-dashboard.search.brave.com
Run: docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw configure --section web and follow the instructions.
Ask OpenClaw to perform a search for you!

Example 1: (Financial Data 📈 Using the Chat Interface).

User uses the OpenClaw chat interface to work on financial data analysis.

The demo data is automatically seeded to ~/.openclaw/workspace-safeclaw/financial-data/ when the container first starts.

Example 2 (Portfolio Monitoring Agent ⏱️ Using cron job).

OpenClaw agent scheduled task to generate a report based on local portfolio data and web search. The resulting report is posted on Slack.

1. Demo data:

The demo data and task instructions are automatically seeded to ~/.openclaw/workspace-safeclaw/investment-portfolio/ when the container first starts.

2. Setup Slack Integration

Follow the steps here: (https://docs.openclaw.ai/channels/slack)

Example Slack bot manifest for the `SafeClaw` bot.

{
    "display_information": {
        "name": "SafeClaw",
        "description": "OpenClaw with SGT Protection",
        "background_color": "#737373"
    },
    "features": {
        "app_home": {
            "home_tab_enabled": false,
            "messages_tab_enabled": true,
            "messages_tab_read_only_enabled": false
        },
        "bot_user": {
            "display_name": "SafeClaw",
            "always_online": false
        },
        "slash_commands": [
            {
                "command": "/safeclaw",
                "description": "Send a message to OpenClaw",
                "should_escape": false
            }
        ]
    },
    "oauth_config": {
        "scopes": {
            "bot": [
                "chat:write",
                "channels:history",
                "channels:read",
                "groups:history",
                "im:history",
                "im:read",
                "im:write",
                "mpim:history",
                "mpim:read",
                "mpim:write",
                "users:read",
                "app_mentions:read",
                "assistant:write",
                "reactions:read",
                "reactions:write",
                "pins:read",
                "pins:write",
                "emoji:read",
                "commands",
                "files:read",
                "files:write"
            ]
        }
    },
    "settings": {
        "event_subscriptions": {
            "bot_events": [
                "app_mention",
                "message.channels",
                "message.groups",
                "message.im",
                "message.mpim",
                "reaction_added",
                "reaction_removed",
                "member_joined_channel",
                "member_left_channel",
                "channel_rename",
                "pin_added",
                "pin_removed"
            ]
        },
        "interactivity": {
            "is_enabled": true
        },
        "org_deploy_enabled": false,
        "socket_mode_enabled": true,
        "token_rotation_enabled": false
    }
}

# Test Slack integration
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw channels status --probe

3. Monitoring Job Setup

Register the portfolio_monitor OpenClaw cron task:

# Register job.
docker compose -f deploy/compose/docker-compose.yaml exec -T openclaw-gateway sh < cron/portfolio_monitor.sh
# Verify job.
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw cron list
# Test run job.
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw cron run [job-id]

Example Slack Message

Example 3 (Email scanning/report).

Sends a report to Slack each day with a list of action items based on new emails.

Follow the steps to setup OpenClaw Gmail Integration.
Follow the steps to setup Slack Integration.
The demo data and task instructions are automatically seeded to ~/.openclaw/workspace-safeclaw/email-monitor/ when the container first starts.

Register the email_monitor OpenClaw cron task:

💡 Update ./cron/email_monitor.sh with your SLACK-CHANNEL-ID.

# Register job.
docker compose -f deploy/compose/docker-compose.yaml exec -T openclaw-gateway sh < cron/email_monitor.sh

# Verify job.
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw cron list

# Test run job.
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw cron run [job-id]

Example 4 (PII Scanner)

Sorts and sends a report to slack when files are uploaded to a local directory, stating whether the files contained PII.

Follow the steps to setup Slack Integration.
The demo data, task instructions, and sort directories (pending/, no-pii/, yes-pii/) are automatically seeded to ~/.openclaw/workspace-safeclaw/pii-scanner/ when the container first starts.

Register the pii_scanner OpenClaw cron task:

💡 Update ./cron/pii_scanner.sh with your SLACK-CHANNEL-ID.

# Register job.
docker compose -f deploy/compose/docker-compose.yaml exec -T openclaw-gateway sh < cron/pii_scanner.sh

# Verify job.
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw cron list

# Test run job.
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway openclaw cron run [job-id]

Example Slack PII Scan Report

Data Sources Integration 📀

1. Google Gmail Integration

💡 OpenClaw gateway can expose a small HTTP webhook endpoint for external triggers.

⚠️ We strongly recommend the use a dedicated demo Gmail account, not a personal or work account. ⚠️

The OpenClaw Dockerfile provided includes all the dependencies needed to run with the Gmail integration:
- gogcli
- google-cloud-sdk

Setup (once)

Setup and login to gcloud. Follow instructions to create a new project and setup Billing. You need a Google Cloud account to create the OAuth client credentials.
You need an OAuth client secret JSON. Here's how to get it:
- Go to Google Cloud Console → APIs & Services → Credentials
- Click Create Credentials → OAuth Client ID
- Set application type to Desktop app (required for gcloud auth flows)
- Click Create, then Download JSON

# copy client credentials to OpenClaw workspace
mkdir -p ~/.openclaw/workspace-safeclaw/google && cp [your-secret.json] ~/.openclaw/workspace-safeclaw/google/client_secret.json

⚠️ If the Google Cloud app is in Testing publishing status, you will need to add your demo Gmail account as a Test user: Google Auth Platform > Audience > Test Users.

# 1. Auth client
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway gog auth credentials /home/node/.openclaw/workspace/google/client_secret.json

# 2. Add account 💡 Use 'safeclaw' when prompted for a keyring password since this is the valude set in the docker-compose for GOG_KEYRING_PASSWORD.
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway gog auth add --manual [demo-email@gmai.com] --services gmail # other services include calendar,drive,contacts,docs,sheets

# 3. Verify
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway gog auth list

# 4. Test
docker compose -f deploy/compose/docker-compose.yaml exec openclaw-gateway gog gmail messages search "in:inbox" --max 10

🔙 back to email demo setup

Name		Name	Last commit message	Last commit date
Latest commit History 36 Commits
cron		cron
deploy		deploy
examples		examples
screenshots		screenshots
Dockerfile		Dockerfile
README.md		README.md
modal_deploy_script.py		modal_deploy_script.py
openclaw.json		openclaw.json
safeclaw.jpg		safeclaw.jpg
verify_sgt_protection.py		verify_sgt_protection.py

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

SafeClaw: OpenClaw with Protopia SGT Protection 🦞

Table of Contents

Requirements

Setup

Setup OpenClaw Browsing Tool

Example 1: (Financial Data 📈 Using the Chat Interface).

Example 2 (Portfolio Monitoring Agent ⏱️ Using cron job).

1. Demo data:

2. Setup Slack Integration

Example Slack bot manifest for the `SafeClaw` bot.

3. Monitoring Job Setup

Example Slack Message

Example 3 (Email scanning/report).

Example 4 (PII Scanner)

Example Slack PII Scan Report

Data Sources Integration 📀

1. Google Gmail Integration

Setup (once)

About

Uh oh!

Uh oh!

Contributors

Uh oh!

Languages

Folders and files

Latest commit

History

Repository files navigation

SafeClaw: OpenClaw with Protopia SGT Protection 🦞

Table of Contents

Requirements

Setup

Setup OpenClaw Browsing Tool

Example 1: (Financial Data 📈 Using the Chat Interface).

Example 2 (Portfolio Monitoring Agent ⏱️ Using cron job).

1. Demo data:

2. Setup Slack Integration

Example Slack bot manifest for the SafeClaw bot.

3. Monitoring Job Setup

Example Slack Message

Example 3 (Email scanning/report).

Example 4 (PII Scanner)

Example Slack PII Scan Report

Data Sources Integration 📀

1. Google Gmail Integration

Setup (once)

About

Resources

Uh oh!

Stars

Watchers

Forks

Uh oh!

Contributors

Uh oh!

Languages

Example Slack bot manifest for the `SafeClaw` bot.