OpenClaw With a Local Model: Ollama Setup, Context and What It Can Touch

OpenClaw is an open-source AI assistant that runs on your own computer and answers you through the chat apps you already use: WhatsApp, Telegram, Slack, Discord, iMessage and about 20 more. It can also run commands, edit files, browse the web and schedule tasks. With almost 393,000 GitHub stars it is one of the largest open-source projects of the year, and it can run entirely on a local model.

Running it locally takes more care than the one-line setup suggests. Ollama and OpenClaw disagree on how much context a local model needs, and OpenClaw’s defaults give the agent a great deal of access. This guide covers the setup, the context setting, which models are realistic, and how to rein in what the agent can touch. BFWR has not run OpenClaw; everything here is from the OpenClaw and Ollama documentation and source code.

Quick answer

• Fastest setup: ollama launch openclaw installs OpenClaw, picks a model and starts it. Or run openclaw onboard and choose Ollama → Local only.
• Use the native Ollama address, http://127.0.0.1:11434, not the /v1 one, which OpenClaw says “breaks tool calling”.
• Context: Ollama recommends at least 64K tokens for OpenClaw; OpenClaw’s own Ollama setup uses 32,768. Set both of OpenClaw’s context settings if you want 64K.
• Model: OpenClaw’s own local recommendations start at Qwen3.5 4B but put Qwen3.8 27B first where memory allows. Its FAQ is blunt about small local models.
• Defaults to change: commands run on your computer without asking, and sandboxing is off.

What OpenClaw is

In its README’s words, “OpenClaw is an open-source AI assistant that runs on your own computer and meets you in the channels you already use”. One background process, the Gateway, connects your chat apps to the agent. Its tools include running shell commands, reading and writing files, operating a browser, web search, sending messages, scheduled automations, and generating images, music and speech. Paired phones and computers can add camera, screen and location access.

The project started in late 2025 as Clawdbot, was renamed Moltbot on 27 January 2026 after a trademark request from Anthropic, and became OpenClaw on 30 January. It is MIT-licensed and run by the OpenClaw Foundation, which the README says “has no paid tier, hosted service, or token.” npm’s latest version on 24 October was 2026.10.7; releases ship several times a week.

Requirements

• Node.js 24.22.1 or newer, or 26.12.1 or newer. That is what the published package and OpenClaw’s Node page require; the README’s lower figures are out of date. Node 22, 23 and 25 are not supported.
• macOS, Linux or Windows. On Windows, OpenClaw recommends its native Windows Hub app, with WSL2 as the most Linux-compatible option.
• The Gateway itself is light: the FAQ gives “1 vCPU, 1 GB RAM, ~500 MB disk” as the absolute minimum. The model is what needs the memory.

Setting it up with Ollama

Option 1: let Ollama do it

ollama launch openclaw

Ollama’s documentation says this installs OpenClaw through npm if needed, shows a security notice, lets you pick a model, configures the provider, installs the Gateway as a background service and opens OpenClaw’s terminal interface. The notice it shows has two lines in Ollama’s source code: “OpenClaw can read files and run actions when tools are enabled.” and “A bad prompt can trick it into doing unsafe things.” Behind the scenes it runs OpenClaw’s own setup in non-interactive mode, accepting the risk notice on your behalf once you have confirmed it.

Ollama’s page uses cloud models in its examples. For a local model, pass a local tag: ollama launch openclaw --model qwen3.8:27b. One caution we could not test: OpenClaw’s docs say npm 12 needs --allow-scripts=openclaw to run its install steps, and Ollama’s installer does not pass that flag. If the automatic install fails, install OpenClaw yourself (below) and run the launch command again.

Option 2: OpenClaw’s own setup

curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard

Choose Ollama, then Local only. OpenClaw’s docs explain that automatic discovery looks only at models already loaded in memory, “with tool support and at least 16K of context”, so run your model once with Ollama before onboarding. To set the model by hand afterwards:

export OLLAMA_API_KEY="ollama-local"
openclaw models list --provider ollama
openclaw models set ollama/qwen3.8:27b

The key is a placeholder: for a local or LAN host, the docs say “any value works”. Configuration lives in ~/.openclaw/openclaw.json.

Two settings that keep it local

• Do not use the /v1 address. OpenClaw talks to Ollama’s native API, and its docs warn: “Do not use the `/v1` OpenAI-compatible URL (`http://host:11434/v1`). It breaks tool calling and models can emit raw tool-call JSON as plain text.”
• Pick “Local only”, and do not add cloud fallbacks. The “Cloud + Local” mode routes both local models and Ollama’s hosted :cloud models through one Ollama install. If a cloud model is configured as a fallback, a turn can leave your machine whenever the local model fails. Ollama’s web search is not local either: Ollama’s docs say “Ollama web search for local models requires `ollama signin`.”

The context window: 32K or 64K?

This is where the two projects disagree. Ollama’s OpenClaw page says: “OpenClaw requires a larger context window. It is recommended to use a context window of at least 64k tokens if using local models.” OpenClaw’s own Ollama recipes say setup uses “a 32,768-token runtime context, or the model’s native window if smaller”, while its managed llama.cpp setup uses 64K.

The detail that matters: OpenClaw sends the context size to Ollama with every request. So Ollama’s usual settings, such as OLLAMA_CONTEXT_LENGTH or its 4K default on cards under 24GB, do not decide it. OpenClaw’s own value does. On our reading of its advanced docs, to run at 64K you set both values on the model:

contextTokens: 65536,
params: {
  num_ctx: 65536,
},

OpenClaw’s docs explain the pair: “`contextTokens` caps OpenClaw’s active-input budget; `params.num_ctx` sets Ollama’s request context.” Keep them equal. Doubling the context roughly doubles the memory the cache takes, so check your model fits first.

Which local model

OpenClaw’s managed llama.cpp setup recommends models by available memory, and says “Qwen3.8 is the first recommendation when its memory budget fits”:

For the models our VRAM calculator covers, here is what the context choice costs in GPU memory (4-bit weights, 16-bit cache, plus runtime overhead):

Models with sliding-window attention, such as Gemma 4, barely grow from 32K to 64K; Qwen3.8 27B grows by 2 GB. For a 24GB card, Qwen3.8 27B at 64K just fits, and Gemma 4 26B-A4B leaves more room.

OpenClaw’s FAQ is honest about the limits. Asked whether a local model is fine for casual chats, it answers “Usually no”, because the agent “needs large context + strong safety; small cards truncate context and skip provider-side safety filters.” Its prompt-injection guidance adds that “For tool-enabled agents or agents that read untrusted content, prompt-injection risk with older/smaller models is often too high.”

What it can touch, and how to limit it

OpenClaw’s own trust model sums up the stakes: “Your AI assistant can execute arbitrary shell commands, read/write files, access network services, and send messages to anyone (if given channel access).” Its defaults assume you are the only, trusted operator:

• Commands run without asking. “Trusted single-operator default: host exec on `gateway`/`node` is allowed without approval prompts”. OpenClaw calls this “intentional UX, not a vulnerability by itself.”
• Sandboxing is off. “Sandboxing is off by default”, so tools run directly on your computer.
• Setup enables the full tool set when you have not chosen a profile.
• Agents can read each other’s sessions unless you change the session visibility setting.

The parts that are safe by default: the Gateway listens only on your own machine, on port 18789, and requires a token; and in chat apps, unknown senders get a pairing code and their message is not processed until you approve them.

With a local model, which has no provider-side safety filter, tighten this. OpenClaw publishes a hardened baseline; the key lines are:

tools: {
  profile: "messaging",
  fs: { workspaceOnly: true },
  exec: { security: "deny", ask: "always" },
  elevated: { enabled: false },
  sessions: { visibility: "agent" },
  agentToAgent: { enabled: false },
},

That blocks shell commands, keeps file access inside the workspace and stops agents reading each other’s sessions. If you need commands, turn on sandboxing rather than allowing host execution, and run openclaw security audit --deep after any change. If you also run Ollama for OpenClaw in Docker, note that its Docker guide binds Ollama to 0.0.0.0, which exposes it to your network; our Ollama server guide explains how to keep it on loopback.

Keep OpenClaw updated. Its GitHub repository has published 722 security advisories since January 2026, 14 of them rated critical, most recently a batch on 11 September. That reflects a very large codebase with an active disclosure process rather than proof the current release is unsafe, but it is a reason not to leave an old version running.

What leaves your machine

The README says OpenClaw “phones home for nothing but a daily version check, anonymous feature statistics are opt-in”, and update.checkOnStart: false turns off both. With a local model, Local only mode and no cloud fallbacks, conversations stay on your hardware, apart from whatever the agent sends out through its own tools and your chat apps.

FAQ

Can OpenClaw run completely offline?

The model and Gateway can, with Ollama in Local only mode. Your chat apps still need the internet, and Ollama’s web search needs an Ollama account.

Why does my model print tool calls as text?

You are probably using the /v1 address. OpenClaw’s docs say that URL breaks tool calling; use http://127.0.0.1:11434.

How much VRAM do I need for OpenClaw?

For Qwen3.8 27B, OpenClaw’s first recommendation, about 20.5 GB at a 32K context and 22.5 GB at 64K, so a 24GB card. Gemma 4 12B runs in about 10 GB.

Is OpenClaw the same as Clawdbot?

Yes. It was renamed Moltbot and then OpenClaw in January 2026, and ollama launch clawdbot still works as an alias.

Related guides and tools

• OpenClaw vs Hermes Agent on a local model
• Securing a local LLM: prompt injection
• Claude Code with a local model and OpenCode with a local LLM
• Hermes Agent with Ollama
• Gemma 4 12B vs Qwen3.5 9B for smaller cards
• Ollama models and VRAM

Sources

• openclaw/openclaw on GitHub (README, SECURITY.md, security advisories)
• OpenClaw docs: Ollama setup, advanced, recipes, llama.cpp plugin, trust model, hardened baseline and Node.js requirements
• Ollama: OpenClaw integration and launcher source

Updated 24 October 2026. Versions, defaults and advisory counts were read on that date. OpenClaw ships several releases a week, so check the docs for changes.