macduty

Guide

OpenClaw on a dedicated Mac mini: a secure setup

Run OpenClaw on its own Mac mini, away from your personal data. Install from the right source, lock down the Gateway, reach it remotely without exposing it, and vet every skill.

45 minutes, updated 2026-09-15

OpenClaw can read your messages, run commands, open a browser and act on your behalf. That is what makes it useful, and why it should not live on the laptop that holds your photos, your passwords and your work.

This guide sets up OpenClaw on a Mac mini that does nothing else, with the Gateway locked down from the first minute.

Why a separate Mac

2026 made the case on its own:

  • A one-click takeover. In January, researchers disclosed CVE-2026-25253, a flaw that let a crafted web page take over a local OpenClaw install and run commands. It was fixed in version 2026.1.29.
  • Malicious skills. An audit of ClawHub, the skills marketplace, found hundreds of malicious entries, most of them spreading malware that steals macOS passwords and crypto wallets.
  • Fake installers. A look-alike npm package posed as the OpenClaw installer.

Each of these hits hardest on a machine full of personal data. On a dedicated Mac, the worst case is a machine you wipe and reinstall.

Which Mac mini

  • Cloud models only (Claude, GPT, Gemini through an API): any Apple silicon Mac mini with 16 GB is plenty. The agent itself uses very little.
  • Local models as well: memory decides what you can run. The guide below covers what fits in what, and is worth reading before you choose.

1. Prepare the Mac

Update macOS fully before you install anything.

Keep the Mac awake and set it to restart after a power loss:

ssh
sudo pmset -a sleep 0 disksleep 0 displaysleep 0
sudo pmset -a autorestart 1

Create a standard (not admin) user for the agent, and run OpenClaw only as that user:

ssh
sudo sysadminctl -addUser agent -fullName "OpenClaw Agent" -password -

If you want Apple integrations such as Reminders, Notes or iMessage, sign that user in with a new Apple ID made for the agent, never your personal one.

2. Install from the official source

Use only the installer from openclaw.ai, or the official openclaw npm package. Check the spelling of every command you copy.

ssh
curl -fsSL https://openclaw.ai/install.sh | bash

If you manage Node yourself:

ssh
npm install -g openclaw@latest --allow-scripts=openclaw
openclaw onboard --install-daemon

The daemon keeps the Gateway running in the background and brings it back after a restart.

3. Connect a model

During onboarding, OpenClaw asks which model to use.

  • An API key is the most predictable choice, and the right one for anything a business depends on.
  • A subscription can work for personal use, but the rules differ by provider and have changed several times this year. Read the guide below first.

4. Lock down the Gateway

The Gateway is the part that receives messages and runs tools. Start from OpenClaw's own safe baseline:

openclaw config
{
  gateway: {
    mode: "local",
    bind: "loopback",
    auth: { mode: "token", token: "replace-with-a-long-random-token" },
  },
  session: {
    dmScope: "per-channel-peer",
  },
  channels: {
    whatsapp: {
      dmPolicy: "pairing",
      groups: { "*": { requireMention: true } },
    },
  },
}

What this does:

  • bind: "loopback": the Gateway listens only on the Mac itself. Nothing on the internet can reach it.
  • Token auth: even local connections need the token. Generate a long random one with openssl rand -hex 32.
  • dmPolicy: "pairing": a stranger who messages your bot gets a pairing code, not an agent.
  • requireMention: in groups, the agent only replies when someone mentions it.

Then limit the tools. Give the agent only what its job needs, and keep shell access behind an approval:

openclaw config
{
  tools: {
    exec: { security: "deny", ask: "always" },
    fs: { workspaceOnly: true },
    elevated: { enabled: false },
  },
}

Loosen these one at a time, when a task really needs it.

5. Reach it remotely without exposing it

Never open the Gateway port to the internet. Use an SSH tunnel from your own computer:

your own computer
ssh -N -L 18789:127.0.0.1:18789 agent@your-mac-address

How you reach it

Your computer

A browser open on 127.0.0.1:18789, and one SSH tunnel: ssh -N -L 18789:127.0.0.1:18789

One SSH connection, port 22

Mac mini, our rack

The Gateway is bound to loopback and wants a token. Its port is never published.

Nothing else on the machine

A standard user, a separate Apple ID, no personal accounts signed in.

The Gateway only ever sees a local client.

One connection out, nothing published in.

Then open http://127.0.0.1:18789 in your browser. The connection travels inside SSH, and the Gateway still sees only a local client.

For access from a phone or several devices, a private network such as Tailscale is the next step up. Read OpenClaw's network exposure guide before you change the bind setting.

6. Treat skills like software you install

Skills are code that runs with your agent's permissions.

  • Install only what you need, not everything that looks interesting.
  • Read what a skill does before you install it. Be wary of anything that asks for credentials or downloads extra files.
  • Prefer well-known authors and skills with a visible history.
  • Remove skills you stopped using.

7. Use separate accounts

  • A separate email address for the agent.
  • A separate phone number for WhatsApp, Signal or Telegram bots, so your personal chats stay private.
  • No banking, no password manager, no personal cloud storage signed in on this Mac.

8. Run the audit, and keep running it

OpenClaw checks its own configuration:

ssh
openclaw security audit
openclaw security audit --deep
openclaw security audit --fix

--deep probes the running Gateway. --fix applies safe remediations, such as tightening file permissions and switching open group policies to allowlists. Run the audit after every configuration change, every new skill and every update.

Checklist

  • macOS fully updated
  • Mac never sleeps, restarts after power loss
  • Agent runs as a standard user with its own Apple ID
  • Installed from openclaw.ai or the official npm package
  • Gateway on loopback with a long token
  • DM pairing on, groups require a mention
  • Shell access denied or behind approval
  • Remote access only through SSH or a private network
  • Every skill reviewed before install
  • Separate email and phone number
  • openclaw security audit clean

Why run it on MacDuty

  • A Mac that does one job. A dedicated Mac mini, yours alone, away from your personal devices.
  • Always on. Powered, cooled and connected around the clock, with no laptop lid to close.
  • Easy to start over. If something goes wrong, reinstall macOS from the dashboard and begin again from a clean machine.
  • A way in when things break. The browser console reaches the real screen, even when the network setup doesn't work.
  • Hosted in the EU.

Next