Run as many isolated OpenClaw agents as you need, on hardware you own.

OpenClaw Machines is an open-source platform for running OpenClaw in secure AI sandboxes on your own infrastructure. A control plane orchestrates your hosts, and each agent runs in its own Firecracker microVM on them — hardware-isolated, safe for untrusted and agent-generated code. A Cloudflare data plane is the front door: every machine gets its own subdomain behind edge auth, reached through a tunnel that terminates inside the VM — no host port is exposed for user-to-VM traffic. The current control plane still needs private or firewall-restricted access to each agent's authenticated control API on 9090. See it running at openclawmachines.com.

The Apache-2.0 public core ships every piece of that stack:

• a minimal control plane — Go API, Postgres-backed accounts, machines, and hosts; placement, machine lifecycle, host enrollment, backups, and durable workflows;
• the host agent (ocm-agent) — boots, supervises, and reaps Firecracker microVMs on your enrolled Linux boxes, managing bridge/TAP networking and rootfs staging;
• a per-host LLM proxy (LiteLLM) — one place for model keys and BYO-key support, with per-machine usage tracking across providers (or your own locally served models);
• the OpenClaw runtime — the in-VM pieces: auth proxy, web-chat gateway, live terminal, and the artifact-driven runtime staging/upgrade flow;
• the browser runtime — paired Chromium browser VMs with CDP routing and a watchable live view;
• workspace integrations / native MCP — GitHub, Google Workspace, OpenAPI, GraphQL, and remote-MCP tools connected once per workspace and exposed to machines through the OCM MCP facade;
• and the build pipelines that assemble it all — every component's build command, the GCS artifact bucket layout, host provisioning scripts, and the release lanes.

The ocm CLI lives in the separate mathaix/ocm-cli Apache-2.0 repository.

Click the screenshot to watch the 43-second demo on YouTube. This is a linked image, not an embedded player.

The demo covers host onboarding, agent spin-up, the running Firecracker VM terminal, workspace MCP integrations, and an agent tool call end to end.

• Security. Real isolation, not containers: one Firecracker microVM per agent, with its own guest kernel behind a KVM hardware boundary — and auth enforced at the edge and again inside every VM.
• Cost. One flat server cost: rent a single bare-metal box and run as many hardware-isolated agents as it fits — see how the options compare. The same architecture cuts token spend too: route agents to open-source models running on your own GPU hardware instead of paying per-token APIs.
• Sovereignty. Your hardware, your data, your keys. Run the control plane and workers on machines you own, and route model traffic through the per-host LLM proxy to any provider — or to models served on your own GPUs.
• Open source. Apache-2.0 public core and companion ocm CLI, permissively licensed for adoption, embedding, and contribution.
• Enterprise. Multi-user accounts and teams, admin-gated host management, encrypted per-machine secrets, and capacity/placement policies across your fleet.
• Ecosystem. Browser VMs for web automation, live terminal and web chat, per-VM routing, workspace-scoped native MCP integrations, backups/snapshots, agent memory, and observability with OpenTelemetry/Opik tracing and per-machine usage tracking.

If you run OpenClaw today, you have a few options:

1. Local hardware — run it on your own laptop or desktop.
2. A VPS (e.g. Hostinger, DigitalOcean) — rent a virtual server and run it there.
3. A managed service (e.g. KiloClaw) — spin up a hosted OpenClaw instance and pay per instance.

OpenClaw Machines is the fourth option: rent one bare-metal server (OVHcloud, Hetzner, …), point OpenClaw Machines at it, and spin up as many hardware-isolated OpenClaw instances as the box will hold. One agent or fifty — the cost stays one flat server.

flowchart TB
    U["you — browser / ocm CLI"] --> EDGE["Cloudflare edge<br/>Access auth · Worker route lookup (KV)"]
    EDGE -->|dashboard / API| CP["Control plane (Go)<br/>accounts · machines · hosts<br/>placement · lifecycle · backups"]
    CP --- DB[("Postgres")]
    CP -->|enroll · heartbeat · boot/stop :9090| H1["Host 1 — your Linux box<br/>ocm-agent · LLM proxy · CDP proxy"]
    CP -->|…| HN["Host N"]
    EDGE -->|per-VM tunnel, terminates inside the VM| VM1
    subgraph H1X["Host 1's microVMs"]
        VM1["Machine — Firecracker microVM<br/>OpenClaw agent · web chat · terminal<br/>authproxy + cloudflared inside"]
        BVM["Browser VM<br/>headful Chromium · live view"]
        VM1 -->|CDP| BVM
    end
    H1 --- H1X