Health Checks: doctor and security audit
Setups drift. A channel login expires, a config edit leaves something open, an old install from last month's experiment is still running quietly. OpenClaw ships check-up commands for exactly this, and knowing which one to reach for saves an evening of guessing.
The rule
Something broken? Run doctor. Something changed? Run security audit --deep.
openclaw onboard # the guided setup; come back to it to revisit your choices
openclaw doctor # look for common configuration problems
openclaw doctor --deep # a more thorough check, including system services
openclaw security audit # look for exposed ports, weak tokens and unsafe settings
openclaw security audit --deep # the same, plus a live probe of the running Gateway
openclaw security audit --fix # tighten safe defaults automaticallydoctoranswers "does it work?". It is the first thing to run when something misbehaves, and running it regularly catches configuration drift before it bites.doctor --deepdigs further. Among other things it scans the system's services for extra Gateway installs, a classic cause of confusing behaviour when an old copy keeps running beside a new one. Add--yesto accept its prompts automatically, which helps on a server with no one at the keyboard.security auditanswers "is it safe?".--deepadds a live probe of the running Gateway, and--fixtightens the safe defaults it can.
The two questions really are different. A Gateway listening on 0.0.0.0 with a weak token works perfectly and answers every message, so doctor may find nothing wrong with it. Only the security audit asks who else can get in.
These sit inside a small set of everyday habits:
- run
doctorregularly, andsecurity audit --deepafter every config change; - keep SOUL.md, USER.md and MEMORY.md up to date;
- start each new topic with
/newinstead of one endless session; - keep the tool allowlist minimal and widen it only with a reason;
- for remote access, prefer Tailscale over opening ports.
The shortcut
Match the symptom to the question. "Does it work?" leads to doctor. "Is it safe?" leads to security audit. "Still stuck?" means add --deep.
The agent stopped replying
"Does it work?" is the question, so run
openclaw doctor.
Drills
Answer fast — trust the rule.
Your agent stopped answering and you do not know why. Which command comes first?
What does --deep add to openclaw security audit?
You run openclaw doctor --deep on a server with no one at the keyboard. Which flag accepts its prompts automatically?
When should you run openclaw security audit --deep?
Which habit keeps the context window clean?
Remember
- Something broken?
doctor. Something changed?security audit --deep. Still stuck? Add--deep. --fixtightens safe defaults;--yeslets doctor run unattended.- Habits: current workspace files,
/newper topic, minimal tools, Tailscale over open ports.