Managed OpenClaw Hosting

OpenClaw is the most popular open-source AI agent framework — 313K+ GitHub stars, 700+ contributors, and growing. But running it safely in production is hard:

6+ CVEs disclosed in 3 weeks (including CVSS 8.8 RCE)
2,419 malicious skills removed from ClawHub in the ClawHavoc cleanup
42,665 publicly exposed instances found, 93.4% vulnerable (January 2026 security report)
$3,600/mo average API overspend from runaway agent loops

Curate-Me is a managed governance layer for OpenClaw. You keep your config. We add security, cost control, and a full ops console.

How It Works

One environment variable change. Zero code changes.


# Before (direct to provider — no governance):
OPENAI_BASE_URL=https://api.openai.com/v1
 
# After (through Curate-Me — full governance):
OPENAI_BASE_URL=https://api.curate-me.ai/v1/openai
X-CM-API-Key=cm_sk_xxx

Every LLM request passes through the Curate-Me gateway, which applies a 5-step governance chain before forwarding to the upstream provider:

Rate Limiting — Per-org, per-key request throttling
Cost Estimation — Token-level cost estimate vs daily budget
PII Scanning — 14 regex patterns + Presidio NER for secrets and PII
Model Allowlists — Enforce which models each org can use
HITL Approvals — Human approval for high-cost or sensitive operations

If any check fails, the request is denied before it reaches the provider.

What You Get

Feature	Self-Hosted	With Curate-Me
Cost tracking	None	Real-time per-model, per-runner
Budget caps	None	Per-org daily/monthly limits
PII scanning	None	Automatic, blocks before provider
Security audit	None	Compliance scoring + auto-patching
Skill scanning	None	ClawHavoc-hardened scanner
HITL approvals	None	Approval queues in dashboard
Kill switch	None	Emergency stop across all runners
Dashboard	None	64-page ops console

Key Features

Security

4-tier sandbox isolation — READ_ONLY to FULL_ACCESS with deny patterns
Network phase separation — No outbound during execution phase
CVE auto-patching — Patches applied within hours of disclosure
ClawHavoc-hardened skill scanner — VirusTotal + YARA-style rules + dependency blocklist

Cost Governance

Per-request cost estimation — Token-level cost before every call
Daily budget caps — Auto-deny when budget exceeded
Cost velocity alerts — Detect runaway agent loops
Emergency kill switch — Halt all activity instantly

Multi-Channel

WhatsApp, Telegram, Slack, Discord — Unified monitoring
Channel health tracking — Auto-reconnect on disconnect
Message routing — Route channels to specific skills