Skip to main content
This section is for the person who runs the Clawboo server, on a laptop, a shared box, or behind a reverse proxy, rather than the person clicking around the dashboard. Clawboo is a single Node process: a bundled Express server that serves the SPA, exposes the REST API, hosts the four MCP servers in-process, and owns one SQLite file plus an encrypted secrets vault under ~/.clawboo. By default it binds loopback (127.0.0.1) with no authentication, which is the right posture for a single-user machine; exposing it on a network is an explicit opt-in that requires the access gate. The pages below cover the four operator concerns in order: where it runs, how to expose it safely, what attaches to it, and where the state lives, and the reference pages give the exact knobs.

​
In this section

​
Operator concerns at a glance

  • Where it runs: one bundled server process. It picks a free API port at boot (default 18790, scanning up to 18809) and binds loopback unless you set HOST (HOSTNAME is ignored). Start with Deployment.
  • How to expose it safely: a non-loopback bind without STUDIO_ACCESS_TOKEN would be reachable unauthenticated by anyone on your network, so the server refuses to start in that case. The access gate is the only auth for a non-loopback bind. See Security.
  • What attaches to it: runtimes (and external agents) reach the shared plane by attaching Clawboo’s MCP servers. The loopback exemption lets a server-spawned runtime attach /api/mcp/* without a token; everything else still needs the gate cookie. See MCP servers.
  • Where data lives: everything Clawboo owns sits under ~/.clawboo (CLAWBOO_HOME overrides it): the SQLite DB, settings.json, the secrets vault, worktrees, and the proxy device identity. OpenClaw’s ~/.openclaw is only ever read for interop. See Data & state.
  • What the defaults are: production-leaning out of the box: budgets track-and-warn instead of hard-capping, circuit breakers are conservative, and the boot probe surfaces a degraded environment without blocking. See Production defaults.
When you need the exact value rather than the framing, go to the reference cluster:
  • Configuration, settings.json shape and the file/directory locations Clawboo resolves.
  • Environment variables, every CLAWBOO_*, OPENCLAW_*, and provider variable Clawboo reads (CLAWBOO_HOME, CLAWBOO_API_PORT, STUDIO_ACCESS_TOKEN, CLAWBOO_SECRETS_MASTER_KEY, and the rest).
  • CLI, clawboo and the bundled MCP stdio bins.
  • REST API overview, base URL, the access-gate behavior on every route, and the error envelope.
  • Database schema, the 28 tables and their relationships.

​
See also

  • How it works, the end-to-end architecture this section operates.
  • Installation, clawboo and what it launches.
  • Glossary, canonical terms (the board, runtime, AgentSource, MCP quartet).
Last modified on August 21, 2026