# OpenClaw

> OpenClaw is an agent/gateway product: the website explains the product, routes users to the hosted cloud app, and exposes static discovery documents; authenticated backends and gateway runtimes own execution truth, private status, secrets, and tool calls.

## Primary Entry Points

- [Home](https://openclawai.io/): product overview and consumer entry.
- [OpenClaw Cloud](https://openclawai.io/cloud): hosted SaaS path for users who want a managed gateway.
- [App](https://openclawai.io/app): authenticated control-plane shell for onboarding, billing, gateway deployment, integrations, and chat.
- [Getting Started](https://openclawai.io/getting-started): setup and product onboarding guidance.
- [How OpenClaw Works](https://openclawai.io/how-openclaw-works): gateway, channel, integration, and agent concepts.
- [Cloud vs Self-Host](https://openclawai.io/cloud/vs-self-host): hosted vs self-hosted boundary.
- [Skills Directory](https://openclawai.io/skills): public skill discovery and search pages.
- [Integrations](https://openclawai.io/integrations): public integration pages.
- [Security](https://openclawai.io/security): safety and self-hosting guidance.

## Machine-Readable Discovery

- [Full LLM Context](https://openclawai.io/llms-full.txt): expanded product map and boundary notes.
- [API Catalog](https://openclawai.io/.well-known/api-catalog): public and authenticated same-origin API surface map.
- [MCP Server Card](https://openclawai.io/.well-known/mcp/server-card.json): current MCP posture; public MCP runtime is not exposed yet.
- [MCP Discovery](https://openclawai.io/.well-known/mcp.json): pointer to MCP status and server-card metadata.
- [Agent Skills Index](https://openclawai.io/.well-known/agent-skills/index.json): skill-catalog discovery and execution boundary.
- [Sitemap Index](https://openclawai.io/sitemap-index.xml): crawlable page sitemap.
- [Robots](https://openclawai.io/robots.txt): crawler and content-signal policy.

## Supported Today

- Public educational pages for OpenClaw, hosted cloud, self-hosting, use cases, integrations, comparisons, FAQ, blog, and skill discovery.
- Hosted SaaS product entry at `/cloud`, with authenticated app control-plane under `/app`.
- Hub-backed login through same-origin auth routes. OpenClaw Web is a client/control-plane, not the identity authority.
- Backend-owned trial chat transport. Trial chat can answer normal questions, understand uploaded images, and use public web search when available; it cannot read private accounts or claim live third-party execution before connection.
- Hosted gateway state and deployment UI backed by the OpenClaw app backend.
- Gateway WebSocket connection from the authenticated app when the backend returns a running hosted-gateway hostname and token.
- Channel setup flows in the app for Telegram, Discord, Slack, and WhatsApp.
- Service connection UI for supported Composio toolkits: Gmail, Google Calendar, Google Docs, Google Sheets, and Notion.
- Static skill directory and search index sourced from the app's committed public skill data.

## Not Exposed From This Website

- Anonymous execution API.
- Public MCP tool server.
- User secrets, gateway tokens, OAuth tokens, or private tool credentials.
- Public runtime status for a user's gateway.
- Direct browser execution of third-party tools outside the authenticated app and gateway/backend boundary.

## Ownership Boundaries

- `openclaw-web`: discovery, docs, marketing pages, authenticated thin control-plane, same-origin API routes, static files, and client-side gateway connection UI.
- Hub / Better Auth: identity session and stable business identity.
- `openclaw-backend`: billing, entitlement projection, hosted gateway records, trial chat, checkout, and app-owned backend truth.
- Gateway runtime: WebSocket session, live execution, tool calls, runtime health, and secret-consuming operations.
- Self-hosted users: own their runtime, secrets, logs, and local gateway operations outside the hosted SaaS boundary.

## Guidance For Agents

- Use public discovery files and static pages for product understanding.
- Do not infer live user state from public pages.
- Treat `/app`, `/api/*`, and `/auth/*` as authenticated or operational surfaces, not crawl targets.
- Ask the user to authenticate through the product UI when private state, integrations, billing, gateway status, or tool execution is needed.
- Do not claim tool execution unless the authenticated backend/gateway has performed it.