Alphaclaw AI Agent

by chrysb• 1.5k•• Scanned•Claim this listing•Request removal
Developer Toolsai agentgatewaynodejsopenclawsetup ui

The ultimate setup harness for OpenClaw. Deploy in minutes. Stay running for months. No CLI required.

Alphaclaw is an open-source ai agent by chrysb, written mainly in JavaScript, with 1,478 GitHub stars and the MIT license. Its code was last updated Oct 23, 2026.

Scan summary: scanned Nov 5, 2026 at commit e6e1ed7. Seen able to run shell commands, connect to the internet. Scan policy

Scanned
Full scan at e6e1ed7 · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanpass
Dependency audit310 known vulnerabilitiesfail
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egresswarn
Reproducible (×3)n/a

Findings (100)

  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:226
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:342
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:357
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:654
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:669
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:755
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:757
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:759
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:779
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:789
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:798
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bin/alphaclaw.js:988
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/alphaclaw-version.js:488
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/alphaclaw-version.js:516
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/commands.js:21
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/commands.js:44
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/commands.js:74
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/gateway.js:142
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/gateway.js:260
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/gateway.js:732
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/gateway.js:745
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/gateway.js:771
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/onboarding/workspace.js:229
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/openclaw-version.js:38
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/openclaw-version.js:64
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/openclaw-version.js:162
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/openclaw-version.js:184
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    lib/server/system-resources.js:141
  • medium
    body-parser@2.3.0: 1 known vulnerability
    GHSA-27r3-jxmh-p828
    package-lock.json
  • medium
    brace-expansion@5.0.9: 3 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7
    package-lock.json
  • medium
    follow-redirects@1.16.1: 1 known vulnerability
    GHSA-mrwp-f3q8-3g9p
    package-lock.json
  • medium
    source-map-js@1.2.1: 2 known vulnerabilities
    GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q
    package-lock.json
  • medium
    undici@6.28.0: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm +3 more
    package-lock.json
  • medium
    undici@8.11.2: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more
    package-lock.json
  • medium
    vite@8.2.2: 6 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more
    package-lock.json
  • medium
    zod@4.6.5: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    package-lock.json
  • medium
    @mariozechner/pi-coding-agent@0.70.0: 3 known vulnerabilities
    GHSA-7v5m-pr3q-6453, GHSA-jfgx-wxx8-mp94, GHSA-r95r-rj6r-c39x
    pnpm-lock.yaml
  • medium
    @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    pnpm-lock.yaml
  • medium
    basic-ftp@5.3.0: 2 known vulnerabilities
    GHSA-c475-qrg2-pj4r, GHSA-rpmf-866q-6p89
    pnpm-lock.yaml
  • medium
    body-parser@1.20.4: 2 known vulnerabilities
    GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
    pnpm-lock.yaml
  • medium
    body-parser@2.2.2: 2 known vulnerabilities
    GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
    pnpm-lock.yaml
  • medium
    brace-expansion@5.0.5: 7 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
    pnpm-lock.yaml
  • medium
    extract-zip@2.0.1: 2 known vulnerabilities
    GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv
    pnpm-lock.yaml
  • medium
    fast-uri@3.1.0: 12 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
    pnpm-lock.yaml
  • medium
    fast-xml-builder@1.1.5: 2 known vulnerabilities
    GHSA-45c6-75p6-83cc, GHSA-5wm8-gmm8-39j9
    pnpm-lock.yaml
  • medium
    follow-redirects@1.16.0: 3 known vulnerabilities
    GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8
    pnpm-lock.yaml
  • medium
    form-data@4.0.5: 1 known vulnerability
    GHSA-hmw2-7cc7-3qxx
    pnpm-lock.yaml
  • medium
    hono@4.12.14: 26 known vulnerabilities
    GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-69xw-7hcm-h432 +21 more
    pnpm-lock.yaml
  • medium
    ip-address@10.1.0: 6 known vulnerabilities
    GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more
    pnpm-lock.yaml
  • medium
    linkify-it@5.0.0: 2 known vulnerabilities
    GHSA-22p9-wv53-3rq4, GHSA-v245-v573-v5vm
    pnpm-lock.yaml
  • medium
    markdown-it@14.1.1: 5 known vulnerabilities
    GHSA-253c-mchw-3w2r, GHSA-6v5v-wf23-fmfq, GHSA-gfr2-rv44-r23c, GHSA-r7fv-28h4-cvq7, GHSA-vfgh-jcmw-g37q
    pnpm-lock.yaml
  • medium
    nanoid@3.3.11: 3 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
    pnpm-lock.yaml
  • medium
    pdfjs-dist@5.6.205: 1 known vulnerability
    GHSA-hq66-cqwq-w95j
    pnpm-lock.yaml
  • medium
    postcss@8.5.10: 3 known vulnerabilities
    GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
    pnpm-lock.yaml
  • medium
    protobufjs@7.5.5: 11 known vulnerabilities
    GHSA-2pr8-phx7-x9h3, GHSA-66ff-xgx4-vchm, GHSA-685m-2w69-288q, GHSA-75px-5xx7-5xc7, GHSA-f38q-mgvj-vph7 +6 more
    pnpm-lock.yaml
  • medium
    sharp@0.34.5: 3 known vulnerabilities
    GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w
    pnpm-lock.yaml
  • medium
    tmp@0.2.5: 1 known vulnerability
    GHSA-ph9p-34f9-6g65
    pnpm-lock.yaml
  • medium
    undici@7.25.0: 29 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-35p6-xmwp-9g52, GHSA-3xpg-4rpp-hhhm +24 more
    pnpm-lock.yaml
  • medium
    undici@8.1.0: 31 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-35p6-xmwp-9g52, GHSA-38rv-x7px-6hhq +26 more
    pnpm-lock.yaml
  • medium
    uuid@9.0.1: 1 known vulnerability
    GHSA-w5hq-g745-h8pq
    pnpm-lock.yaml
  • medium
    vite@8.0.9: 7 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff, GHSA-r825-w8mm-5pxw +2 more
    pnpm-lock.yaml
  • medium
    ws@8.20.0: 2 known vulnerabilities
    GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p
    pnpm-lock.yaml
  • medium
    zod@4.3.6: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    pnpm-lock.yaml
  • medium
    Install or build failed in a clean environment
    24.22.1 <25 or >=26.12.1. . preinstall: [alphaclaw] Upgrade Node before installing this AlphaClaw release. . preinstall: Failed Error: ERR_PNPM_EXECUTOR_LIFECYCLE_SCRIPT_FAILED × installing dependencies ╰─▶ /w preinstall: `node lib/scripts/check-node-runtime.js` exited with exit status: 1
  • medium
    Install contacted hosts other than package registries
    34.3.16.104.in-addr.arpa
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/server/secret-detector.test.js:200
  • low
    Possible example credential in docs/tests: generic-api-key
    5 matches in this file
    tests/server/routes-onboarding.test.js:306
  • low
    @vitest/mocker@4.1.11: 2 known vulnerabilities
    GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
    package-lock.json
  • low
    glob@13.0.6: 2 known vulnerabilities
    GHSA-3g3m-2fjr-6pw4, GHSA-3g3m-2fjr-6pw4
    package-lock.json
  • low
    ip-address@10.5.0: 5 known vulnerabilities
    GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5
    package-lock.json
  • low
    minimatch@10.2.5: 2 known vulnerabilities
    GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    minimatch@10.2.6: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    postcss-selector-parser@6.1.4: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    package-lock.json
  • low
    postcss-selector-parser@7.1.4: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    package-lock.json
  • low
    qs@6.16.0: 1 known vulnerability
    GHSA-6pq8-jhm2-2vcw
    package-lock.json
  • low
    @anthropic-ai/sdk@0.90.0: 1 known vulnerability
    GHSA-p7fg-763f-g4gf
    pnpm-lock.yaml
  • low
    @hono/node-server@1.19.14: 2 known vulnerabilities
    GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
    pnpm-lock.yaml
  • low
    @protobufjs/utf8@1.1.0: 1 known vulnerability
    GHSA-q6x5-8v7m-xcrf
    pnpm-lock.yaml
  • low
    @vitest/mocker@4.1.5: 2 known vulnerabilities
    GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8
    pnpm-lock.yaml
  • low
    fast-xml-parser@5.5.8: 1 known vulnerability
    GHSA-gh4j-gqv2-49f6
    pnpm-lock.yaml
  • low
    postcss-selector-parser@6.1.2: 2 known vulnerabilities
    GHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92
    pnpm-lock.yaml
  • low
    qs@6.14.2: 4 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx
    pnpm-lock.yaml
  • low
    qs@6.15.1: 4 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx
    pnpm-lock.yaml
  • low
    vitest@4.1.5: 1 known vulnerability
    GHSA-82fw-gwwq-j7x9
    pnpm-lock.yaml
  • low
    package.json has a preinstall script
    node lib/scripts/check-node-runtime.js
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
34.3.16.104.in-addr.arparegistry.npmjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Alphaclaw alternatives

View more →

Similar ai agents in Developer Tools, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Alphaclaw (this page)
chrysb
1.5kMITOct 23, 2026Scanned, no flagged issues
Deepseek Harness
deepseek-ai
268kMITOct 30, 2026Scanned, no flagged issues
Ponytail
DietrichGebert
182kMITOct 29, 2026Scanned, no flagged issues
Orca
stablyai
112kMITNov 1, 2026Scanned, no flagged issues
Deer Flow
bytedance
85kMITNov 1, 2026Scanned, no flagged issues
Ruflo
ruvnet
80kMITNov 1, 2026Scanned, no flagged issues