healthcheck

Host hardening with guardrails separates OS hardening from OpenClaw enforcement to prevent false security claims. It uses read-only context discovery first, then applies user-approved changes matching your risk tolerance to reduce operational exposure.

Risk-tolerance driven remediation creates a target security posture and identifies gaps to provide step-by-step remediation. It uses exact commands with rollback and lockout prevention, ensuring changes match your acceptable risk level.

You can schedule periodic OpenClaw security audits automatically using deterministic cron scheduling. After completing audits and hardening, configure ongoing monitoring via OpenClaw commands like `healthcheck:security-audit` and `healthcheck:update-status`.

To check OpenClaw version and update status for security compliance, run the `openclaw update status` command. This surfaces available updates and reports version vulnerabilities as part of the deep security audit process.

A limitation of automated host hardening for OpenClaw is that it requires explicit numbered user approvals for any state-changing actions. It also strictly separates OS hardening from OpenClaw enforcement to avoid false security claims.