SafeClaw: OpenClaw with Protopia SGT Protection 🦞

SafeClaw is an OpenClaw agent with access to Protopia SGT to expand the usability of sensitive data for AI with state-of-the-art data protection and privacy.

SafeClaw does not replace your existing OpenClaw agents, it provides an alternative for using your AI assistant with sensitive information. With SafeClaw, information never leaves your workspace as plaintext and cannot be recovered from the protected embeddings.

💡 Request access to Protopia SGT from https://protopia.ai/safeclaw/

Requirements

Protopia Stained Glass Proxy (SGP) docker image (v1.49.2 or above).
SGT model (e.g Protopia/SGT-for-Qwen3-32B-swept-water-bfloat16).

💡 Request access to a Protopia SGT from https://protopia.ai/safeclaw/

Modal deployment script and Modal API keys (or any other way to host the upstream Qwen3-32B for inference.)
docker-compose file.
openclaw.json starter configuration.
Demo Resources and Data
Example Cron Tasks Scripts

Setup

🐳 Build custom OpenClaw docker image:

# Build demo image from custom Dockerfile
docker build -t ghcr.io/openclaw/openclaw:protopia-demo .

Use the provided openclaw.json as a reference, then update/merge the relevant sections in your local ~/.openclaw/openclaw.json.

⚠️ Important: Do not replace your existing ~/.openclaw/openclaw.json by copying this repo file directly.

Key config sections to review:
- models.providers.vllm: Points to the stainedglass container/port from this setup.
- tools.web: Configure this if you want web search enabled with Brave for example 1 and example 2.
- channels.slack: Configure this to enable Slack integration for example 2, example 3, or example 4.
- agents.list: To allow the main agent to spawn safeclaw as a subagent via subagents.allowAgents.
Your local config is what gets mounted to the OpenClaw container by docker compose.
Deploy upstream LLM to Modal with the Modal Deployment Script (or any other inference service of your choice).
```
# for a Modal deployment:
uv pip install modal
MODAL_LOG_LEVEL=DEBUG modal deploy scripts/modal_deploy_output_protection.py
```
⚠️ Important: The modal deploy script loads the OUTPUT_PROTECTION_IMAGE from AWS ECR. Update this as needed. Other options here.

⚠️ Important: The Modal deployment script loads the Qwen/Qwen3-32B model from Hugging Face. Ensure your Modal huggingface-secret is configured with a valid HF token. This token may differ from the HF token used for SGT model access.
- Update the docker-compose stainedglass service with your modal API keys to ensure SGT proxy can communicate with upstream Modal.
💡 Hint: Set env variable: SGP_REQUEST_HEADERS_TO_ADD: "Modal-Key=[your-key],Modal-Secret=[your-secret]" in the docker-compose stainedglass service.

Run with docker-compose.

export HF_TOKEN=[your-hf-token] # Use the HF token provided by Protopia with access to the Qwen32B SGT.
HF_TOKEN=[token] MODAL_KEY=[key] MODAL_SECRET=[secret] docker compose up -d

🏁 Verify running containers:

docker ps

# > you should have at least these containers running:
ghcr.io/openclaw/openclaw:protopia-demo
stainedglass-proxy

Register the SafeClaw OpenClaw agent
```
docker compose exec openclaw-gateway openclaw agents add safeclaw
```
- This will update your ~/.openclaw/openclaw.json with your new SafeClaw agent.
Access OpenClaw Chat UI at localhost:18790/chat?token=[your token] (setup port-forward if needed).

💡 Hint: You can find the token at ~/.openclaw/openclaw.json under auth.

⚠️ If you get a pairing required error, then you need to allow your device in Openclaw, follow these steps:

# List pending requests
docker compose exec openclaw-gateway openclaw devices list

Find devices listed under Pending and copy its request id.

# Approve by request ID
docker compose exec openclaw-gateway openclaw devices approve [request-id]

Test accessing the OpenClaw Web UI again, or connect to the OpenClaw TUI:

docker compose exec openclaw-gateway openclaw tui

Setup OpenClaw Browsing Tool

You will need a Brave API key. Get one from https://api-dashboard.search.brave.com
Run: docker compose exec openclaw-gateway openclaw configure --section web and follow the instructions.
Ask OpenClaw to perform a search for you!

Example 1: (Financial Data 📈 Using the Chat Interface).

User uses the OpenClaw chat interface to work on financial data analysis.

Copy the demo data to the OpenClaw workspace: ~/.openclaw/workspace-safeclaw/.

cp -r examples/1-financial-data/documents/ ~/.openclaw/workspace-safeclaw/financial-data
chmod -R a+r ~/.openclaw/workspace-safeclaw/financial-data

Example 2 (Portfolio Monitoring Agent ⏱️ Using cron job).

OpenClaw agent scheduled task to generate a report based on local portfolio data and web search. The resulting report is posted on Slack.

1. Demo data:

Copy the demo data and instructions to the OpenClaw workspace: ~/.openclaw/workspace-safeclaw/.

cp -r examples/2-investment-portfolio ~/.openclaw/workspace-safeclaw/investment-portfolio
chmod -R a+r ~/.openclaw/workspace-safeclaw/investment-portfolio

2. Setup Slack Integration

Follow the steps here: (https://docs.openclaw.ai/channels/slack)

Example Slack bot manifest for the `SafeClaw` bot.

{
    "display_information": {
        "name": "SafeClaw",
        "description": "OpenClaw with SGT Protection",
        "background_color": "#737373"
    },
    "features": {
        "app_home": {
            "home_tab_enabled": false,
            "messages_tab_enabled": true,
            "messages_tab_read_only_enabled": false
        },
        "bot_user": {
            "display_name": "SafeClaw",
            "always_online": false
        },
        "slash_commands": [
            {
                "command": "/safeclaw",
                "description": "Send a message to OpenClaw",
                "should_escape": false
            }
        ]
    },
    "oauth_config": {
        "scopes": {
            "bot": [
                "chat:write",
                "channels:history",
                "channels:read",
                "groups:history",
                "im:history",
                "im:read",
                "im:write",
                "mpim:history",
                "mpim:read",
                "mpim:write",
                "users:read",
                "app_mentions:read",
                "assistant:write",
                "reactions:read",
                "reactions:write",
                "pins:read",
                "pins:write",
                "emoji:read",
                "commands",
                "files:read",
                "files:write"
            ]
        }
    },
    "settings": {
        "event_subscriptions": {
            "bot_events": [
                "app_mention",
                "message.channels",
                "message.groups",
                "message.im",
                "message.mpim",
                "reaction_added",
                "reaction_removed",
                "member_joined_channel",
                "member_left_channel",
                "channel_rename",
                "pin_added",
                "pin_removed"
            ]
        },
        "interactivity": {
            "is_enabled": true
        },
        "org_deploy_enabled": false,
        "socket_mode_enabled": true,
        "token_rotation_enabled": false
    }
}

# Test Slack integration
docker compose exec openclaw-gateway openclaw channels status --probe

3. Monitoring Job Setup

Register the portfolio_monitor OpenClaw cron task:

# Register job.
docker compose exec -T openclaw-gateway sh < cron/portfolio_monitor.sh
# Verify job.
docker compose exec openclaw-gateway openclaw cron list
# Test run job.
docker compose exec openclaw-gateway openclaw cron run [job-id]

Example Slack Message

Example 3 (Email scanning/report).

Sends a report to Slack each day with a list of action items based on new emails.

Follow the steps to setup OpenClaw Gmail Integration.
Follow the steps to setup Slack Integration.
Copy the demo data and task instructions to the OpenClaw workspace: ~/.openclaw/workspace-safeclaw/.

cp -r examples/3-email-monitor ~/.openclaw/workspace-safeclaw/email-monitor
chmod -R a+r ~/.openclaw/workspace-safeclaw/email-monitor

Register the email_monitor OpenClaw cron task:

💡 Update ./cron/email_monitor.sh with your SLACK-CHANNEL-ID.

# Register job.
docker compose exec -T openclaw-gateway sh < cron/email_monitor.sh

# Verify job.
docker compose exec openclaw-gateway openclaw cron list

# Test run job.
docker compose exec openclaw-gateway openclaw cron run [job-id]

Example 4 (PII Scanner)

Sorts and sends a report to slack when files are uploaded to a local directory, stating whether the files contained PII.

Follow the steps to setup Slack Integration.

Copy the demo data and task instructions to the OpenClaw workspace: ~/.openclaw/workspace-safeclaw/.

cp -r examples/4-pii-scanner ~/.openclaw/workspace-safeclaw/pii-scanner
mkdir ~/.openclaw/workspace-safeclaw/pii-scanner/data-guardian-pii-scanner/no-pii
mkdir ~/.openclaw/workspace-safeclaw/pii-scanner/data-guardian-pii-scanner/yes-pii
chmod -R a+r ~/.openclaw/workspace-safeclaw/pii-scanner

Register the pii_scanner OpenClaw cron task:

💡 Update ./cron/pii_scanner.sh with your SLACK-CHANNEL-ID.

# Register job.
docker compose exec -T openclaw-gateway sh < cron/pii_scanner.sh

# Verify job.
docker compose exec openclaw-gateway openclaw cron list

# Test run job.
docker compose exec openclaw-gateway openclaw cron run [job-id]

Example Slack PII Scan Report

Data Sources Integration 📀

1. Google Gmail Integration

💡 OpenClaw gateway can expose a small HTTP webhook endpoint for external triggers.

⚠️ We strongly recommend the use a dedicated demo Gmail account, not a personal or work account. ⚠️

The OpenClaw Dockerfile provided includes all the dependencies needed to run with the Gmail integration:
- gogcli
- google-cloud-sdk

Setup (once)

Setup and login to gcloud. Follow instructions to create a new project and setup Billing. You need a Google Cloud account to create the OAuth client credentials.
You need an OAuth client secret JSON. Here's how to get it:
- Go to Google Cloud Console → APIs & Services → Credentials
- Click Create Credentials → OAuth Client ID
- Set application type to Desktop app (required for gcloud auth flows)
- Click Create, then Download JSON

# copy client credentials to OpenClaw workspace
mkdir -p ~/.openclaw/workspace-safeclaw/google && cp [your-secret.json] ~/.openclaw/workspace-safeclaw/google/client_secret.json

⚠️ If the Google Cloud app is in Testing publishing status, you will need to add your demo Gmail account as a Test user: Google Auth Platform > Audience > Test Users.

# 1. Auth client
docker compose exec openclaw-gateway gog auth credentials /home/node/.openclaw/workspace/google/client_secret.json

# 2. Add account 💡 Use 'safeclaw' when prompted for a keyring password since this is the valude set in the docker-compose for GOG_KEYRING_PASSWORD.
docker compose exec openclaw-gateway gog auth add --manual [demo-email@gmai.com] --services gmail # other services include calendar,drive,contacts,docs,sheets

# 3. Verify
docker compose exec openclaw-gateway gog auth list

# 4. Test
docker compose exec openclaw-gateway gog gmail messages search "in:inbox" --max 10

🔙 back to email demo setup

Name		Name	Last commit message	Last commit date
Latest commit History 33 Commits
cron		cron
examples		examples
screenshots		screenshots
Dockerfile		Dockerfile
README.md		README.md
docker-compose.yaml		docker-compose.yaml
modal_deploy_script.py		modal_deploy_script.py
openclaw.json		openclaw.json
safeclaw.jpg		safeclaw.jpg
verify_sgt_protection.py		verify_sgt_protection.py

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

SafeClaw: OpenClaw with Protopia SGT Protection 🦞

Table of Contents

Requirements

Setup

Setup OpenClaw Browsing Tool

Example 1: (Financial Data 📈 Using the Chat Interface).

Example 2 (Portfolio Monitoring Agent ⏱️ Using cron job).

1. Demo data:

2. Setup Slack Integration

Example Slack bot manifest for the `SafeClaw` bot.

3. Monitoring Job Setup

Example Slack Message

Example 3 (Email scanning/report).

Example 4 (PII Scanner)

Example Slack PII Scan Report

Data Sources Integration 📀

1. Google Gmail Integration

Setup (once)

About

Uh oh!

Uh oh!

Contributors

Uh oh!

Languages

Folders and files

Latest commit

History

Repository files navigation

SafeClaw: OpenClaw with Protopia SGT Protection 🦞

Table of Contents

Requirements

Setup

Setup OpenClaw Browsing Tool

Example 1: (Financial Data 📈 Using the Chat Interface).

Example 2 (Portfolio Monitoring Agent ⏱️ Using cron job).

1. Demo data:

2. Setup Slack Integration

Example Slack bot manifest for the SafeClaw bot.

3. Monitoring Job Setup

Example Slack Message

Example 3 (Email scanning/report).

Example 4 (PII Scanner)

Example Slack PII Scan Report

Data Sources Integration 📀

1. Google Gmail Integration

Setup (once)

About

Resources

Uh oh!

Stars

Watchers

Forks

Uh oh!

Contributors

Uh oh!

Languages

Example Slack bot manifest for the `SafeClaw` bot.