How-Tos & Practical Guides

OpenClaw v2026.4.15-beta.1 ships two features that, combined, dramatically improve the experience for self-hosted and resource-constrained deployments: cloud LanceDB memory (durable remote memory indexes instead of local disk only) and lean mode (a smaller prompt footprint for weaker local models). This guide walks you through configuring both. Prerequisites OpenClaw beta installed: npm install -g openclaw@beta A running local model via Ollama, LM Studio, or equivalent (for lean mode to be relevant) An S3-compatible object store if using cloud LanceDB (AWS S3, Cloudflare R2, MinIO, etc.) Step 1: Install the Beta npm install -g [email protected] Verify the install: ...

CVE-2026-33032 is a CVSS 9.8 authentication bypass in nginx-ui’s Model Context Protocol (MCP) endpoint, actively exploited in the wild right now. This guide walks you through checking your exposure, assessing impact, and patching — in that order. Time to complete: 10–20 minutes Risk if you skip: Full nginx server takeover without authentication Patched version: nginx-ui 2.3.4+ Step 1: Check Your nginx-ui Version nginx-ui --version Or check the installed package version: ...

Anthropic just shipped a ground-up redesign of the Claude Code desktop app — and it’s not a cosmetic refresh. The new app is built around a fundamentally different mental model of how developers work with AI agents: not one task at a time, but many tasks in parallel, with you in the orchestrator seat. If you’ve been bouncing between terminal windows, your editor, and the Claude web UI, this redesign was built specifically for you. ...

If you’re running AI agents with a large number of MCP tools registered, you’ve likely run into the context overhead problem: every request arrives carrying descriptions of dozens or hundreds of tools, most of which the agent won’t use for that particular task. Those tokens add up fast. Bifrost MCP Gateway is an open-source Go proxy that sits between your AI agent and your MCP tool servers, compressing context, caching repeated calls, and routing tool calls more efficiently. Community benchmarks report 92% token cost reduction at 500+ tools scale. ...

OpenClaw v2026.4.14 shipped a meaningful security fix for Slack integrations: the allowFrom owner allowlist is now consistently enforced for block actions and modal interactive events. If you were relying on the allowlist for security before this release, it wasn’t fully protecting you. Now it is — but only if it’s correctly configured. This guide walks you through verifying and tightening your Slack allowlist configuration after upgrading. What Changed in v2026.4.14 Before the fix, OpenClaw’s Slack integration enforced the allowFrom allowlist for some interaction types but not all. Specifically: ...

After a developer recently used Claude itself to discover that a Vercel plugin bundled with Claude Code was collecting bash commands and session data beyond its stated scope, the question of plugin supply-chain safety has moved from theoretical to immediate. This checklist gives you a practical process for auditing what your Claude Code plugins are actually doing. Related news: Claude Code’s Vercel Plugin Quietly Collected Bash Commands — A Developer Used Claude to Expose It ...

Cloudflare’s Agents Week brought two tools that, combined, solve one of the most persistent infrastructure problems in production agentic AI: how do you run agents that actually do work across multiple sessions without losing state? This guide walks through building a persistent long-running agent using Cloudflare’s GA Linux Sandboxes and the Think SDK. Both are now generally available — meaning this is production-ready infrastructure, not a preview. What You’re Building A persistent agent that can: ...

The Model Context Protocol (MCP) has published its new authorization specification, and it’s a meaningful upgrade for anyone building or securing AI agent systems. The spec mandates OAuth 2.1 as the foundational auth framework, with RFC 8707 Resource Indicators providing the mechanism for strict, per-resource access controls. If you’re running MCP servers in production — or building agents that communicate with them — this guide walks through what changed, why it matters, and what you need to implement. ...

On April 4, 2026, Anthropic quietly rolled out an OAuth authentication change that broke a significant number of OpenClaw deployments overnight. No breaking change notice in the standard channels. No deprecation warning. Agents just stopped working. OpenClaw GitHub issue #19938 lit up within hours, and the community has been piecing together fixes ever since. This guide walks you through diagnosing the auth gap and getting your OpenClaw agent back online in under 20 minutes. ...

OpenClaw v2026.4.10 ships with a new Active Memory plugin that fundamentally changes how your agent handles context and recall. Instead of relying on you to manually tell it what to remember, the plugin runs a background memory sub-agent that automatically pulls in relevant history before each reply. This guide walks you through installation, configuration, and the key things to know before you turn it on. Prerequisites OpenClaw v2026.4.10 or later (check with openclaw --version) An existing OpenClaw workspace configured Basic familiarity with OpenClaw plugins Step 1: Install the Active Memory Plugin The plugin ships as an optional module in v2026.4.10+. To enable it: ...