OpenClaw Open Source: Licensing, Self-Hosting, and Contributing

OpenClaw crossed 250,000 GitHub stars three months after Peter Steinberger published the first commit in November 2025, surpassing React's lifetime count to become the most-starred software project on GitHub. By May 2026, the repository had passed 374,000 stars. That kind of growth draws developers, startups, and enterprises who all need answers to the same questions: can I use this commercially? What does self-hosting cost in practice? How do I contribute back?

Most OpenClaw tutorials walk through installation and stop there. They skip licensing implications, skip the real costs of running your own instance, and skip the contribution workflow. Those gaps matter because the answers determine whether you fork the project, pay for managed hosting, or invest engineering time in upstream contributions.

OpenClaw ships under the MIT license, one of the most permissive open-source licenses available. The full text fits in a single paragraph. You can use, copy, modify, merge, publish, distribute, sublicense, and sell copies of the software. The only requirement is that you include the original copyright notice and license text in any copies or substantial portions of the code.

For commercial use, this means you can embed OpenClaw in a product you sell without paying royalties. You can modify the source code without releasing your changes. You can run OpenClaw as a hosted service for paying customers. You can combine it with proprietary code in the same deployment. There is no contributor license agreement (CLA) to sign. No "open core" arrangement where critical features sit behind a proprietary license. The entire codebase, including the Gateway, companion apps, and skills framework, ships under identical MIT terms.

Compare this to projects using AGPL, which requires you to release modifications if you serve users over a network, or BSL, which restricts commercial use for a set period. OpenClaw imposes neither of these restrictions. If you include the LICENSE file in your distribution, you are compliant.

The project's governance shifted in February 2026 when Steinberger announced he was joining OpenAI. A non-profit foundation now stewards the project, which adds institutional continuity but does not change the license. MIT is MIT regardless of who maintains the repository.

OpenClaw runs on your own hardware. The Gateway, a single Node.js process, bridges messaging platforms to AI models without routing your data through a third-party service. No cloud dependency for the core runtime.

Hardware requirements are modest. You need Node 24 (recommended) or Node 22.19+ and a machine with enough RAM to handle your message volume. The project ships Docker and docker-compose files for containerized deployment, plus configuration for Fly.io and Render if you prefer managed infrastructure without managing a server directly.

Installation follows a single global npm install, then an onboarding wizard that configures a background daemon (systemd on Linux, launchd on macOS) to start the Gateway automatically and survive reboots. The project's official docs walk through each step, including the web dashboard for monitoring and configuration. Check the docs for the current recommended install path, since exact flags and toolchain versions change between releases.

The real cost of self-hosting is not the software. It is the infrastructure and LLM API fees. A basic personal setup runs $6 to $13 per month: a $5 VPS from DigitalOcean or Hetzner plus $1 to $8 in API tokens from a budget model provider like DeepSeek. Small business deployments with mixed model routing land between $25 and $50 per month. Heavy automation with premium models can exceed $200 monthly.

These numbers assume you already handle Linux administration, TLS certificates, firewall rules, and backups. Factor in the engineering time to maintain a production instance and managed hosting starts looking reasonable for teams without dedicated infrastructure staff.

Security is the other hidden cost. OpenClaw has nine disclosed CVEs as of May 2026, including a CVSS 8.8 one-click remote code execution vulnerability. Docker's default networking bypasses host firewall rules through the DOCKER-USER iptables chain, which many self-hosters forget to configure. Tool permission allowlists and non-root container users are not set up by default. You configure them yourself, or you leave your instance exposed.

Self-hosting gives you full control over your data, your LLM provider choices, and your deployment topology. But "control" also means "responsibility." If you are running OpenClaw for a business, budget for security patching, uptime monitoring, and log review alongside the base infrastructure costs.

OpenClaw accepts community contributions through standard GitHub pull requests. The project maintains a CONTRIBUTING.md with expectations that differ from many open-source projects, so read it before writing code.

First, decide whether your change needs a discussion. Bug fixes and small improvements can go straight to a pull request. New features and architectural changes should start as a GitHub issue or a thread in the #clawtributors channel on Discord.

The development workflow looks like this:

1. Fork the repository and clone your fork locally
2. Install dependencies with pnpm (the project uses pnpm, not npm or yarn, for development builds)
3. Create a focused branch for your change
4. Run the full check suite before opening a PR: pnpm build && pnpm check && pnpm test
5. Open a pull request with a clear description of what changed and why

Every external pull request must include a "Real behavior proof" section. This means screenshots, screen recordings, or log output showing your change works in a running OpenClaw instance. The project does not accept changes validated only by automated tests. This requirement filters out speculative refactors and ensures contributors have actually run the software.

Several rules catch new contributors off guard:

• Do not edit CHANGELOG.md. Maintainers or the ClawSweeper bot add changelog entries when landing user-facing changes.
• Do not submit refactor-only pull requests unless a maintainer explicitly requested that specific refactor.
• Do not fix CI failures already red on the main branch. Those PRs get closed automatically.
• Use American English in code, comments, docs, and UI strings.
• Maximum 20 open pull requests per author. The bot enforces this with an r: too-many-prs label.

Review happens in two stages. An automated bot reviews first, checking formatting, test coverage, and common issues. Address all bot conversations before requesting a human maintainer review. When a reviewer leaves feedback, resolve the conversation yourself if your code addresses it. Only leave a conversation open when you genuinely need a judgment call.

There is no contributor license agreement. Your contributions stay under the MIT license, and you retain copyright over your code. Good starting points are issues labeled "good first issue" on GitHub. The Discord community, especially #help and #users-helping-users, is responsive when you get stuck on something project-specific.

Persistent storage for your OpenClaw agents

generous storage workspace with built-in AI indexing and semantic search. Your agent writes files, your team reviews them in the browser. No credit card, no trial expiration.

Start 14-Day Trial

OpenClaw agents generate files constantly: reports, scraped data, processed images, conversation exports, skill outputs. By default, these live on whatever machine runs the Gateway. If that machine goes down, gets redeployed, or runs out of disk space, the files disappear with it.

The standard workaround is mounting a network volume or syncing to cloud storage. S3 works if you are comfortable managing buckets, IAM policies, and lifecycle rules. Google Drive and Dropbox handle personal use but lack the granular permissions and audit trails that teams need when multiple agents and humans access the same files.

Fastio approaches the problem differently. Instead of bolting storage onto your agent after the fact, you give the agent a workspace where files, permissions, and AI indexing are built in from the start. The Business Trial includes 50 GB of storage, included credits, five workspaces, and 50 shares. No credit card, no trial period, no expiration.

Here is what that looks like in practice: your OpenClaw agent writes a research report to a Fastio workspace. If Intelligence Mode is enabled on that workspace, the file is automatically indexed for semantic search and citation-backed chat. A human teammate opens the same workspace in their browser and finds the report alongside their own files. They can ask questions about it, share it with a client through a branded portal, or route it through an approval workflow. No syncing steps, no shared drive configuration, no permission inheritance headaches.

Fastio exposes a MCP server with Streamable HTTP at /mcp and legacy SSE at /sse. Agents interact with workspaces, storage, uploads, and AI queries through the same protocol used by Claude, GPT-4, and other LLM providers. The ownership transfer feature lets an agent build an entire org, populate it with files and shares, then hand control to a human when the project is complete. The agent keeps admin access for ongoing maintenance.

For teams running OpenClaw agents that produce deliverables, whether client reports, data extracts, or creative assets, the workspace model solves two problems at once: the agent gets persistent, structured storage that survives redeployments, and the humans get a clean interface to review, comment on, and distribute the output without ever touching the command line.

The choice between self-hosting OpenClaw and using a managed provider comes down to three factors: data control, total cost, and maintenance capacity.

Self-hosting makes sense when you need full control over where your data lives, want to run local LLMs through Ollama or a similar runtime, or operate under policies that prevent sending conversation data to third-party servers. It also fits teams that already maintain Linux infrastructure and have someone available to handle security patches, certificate renewals, and container updates.

Managed hosting fits teams that lack infrastructure expertise, need guaranteed uptime without building it themselves, or find that the total cost of self-hosting (infrastructure plus the engineering hours for maintenance) exceeds what a hosting provider charges. Several providers now offer one-click OpenClaw deployment, including DigitalOcean's marketplace, Fly.io, Render, and specialized platforms like ClawHost.

A rough monthly cost comparison for a small team with moderate usage:

Self-hosted:

• VPS: $10 to $20/month
• LLM API tokens: $30 to $100/month
• Engineering maintenance: 2 to 4 hours/month
• Total: $40 to $120/month plus labor

Managed provider:

• Hosting fee: $15 to $50/month
• LLM API tokens: $30 to $100/month (same regardless of hosting model)
• Infrastructure maintenance: handled by provider
• Total: $45 to $150/month, no additional labor

The raw numbers are close enough that the deciding factor is usually team capacity. A solo developer comfortable with Docker and systemd will save money self-hosting. A product team where every hour on infrastructure displaces an hour on the core product will recoup a managed hosting fee quickly.

One factor that stays constant across both approaches: your OpenClaw agents still need somewhere to store and share their output with humans. A workspace platform like Fastio works identically with self-hosted and managed deployments because the storage layer is independent of where the Gateway process runs. Upload from a $5 VPS or a managed Fly.io instance, and the workspace, permissions, and AI indexing work the same way.

The MIT license means you are never locked in. Start with managed hosting to ship faster, migrate to self-hosted when your infrastructure team is ready, or run both in parallel for different use cases. The code is the same either way.