--- title: "openclaw-ops" description: "Operations plugin for a fleet of self-hosted OpenClaw gateway instances running as Docker Compose projects on one host. Discovers every instance from the live Docker state (never from hard-coded paths), classifies it ok/" canonical: https://agentpluginsdirectory.com/plugins/openclaw-ops last-updated: 2026-09-27 --- # openclaw-ops Operations plugin for a fleet of self-hosted OpenClaw gateway instances running as Docker Compose projects on one host. Discovers every instance from the live Docker state (never from hard-coded paths), classifies it ok/degraded/down/alien, and runs day-two maintenance: health and liveness reporting, provider-auth triage (expired, emptied and shadowed OAuth profiles, shared-credential token sink), config surgery with snapshot and executable rollback, memory/embedding repair and reindexing, shared skills and plugins consolidation, Infisical secret-delivery audit by key name only, security audit, version-drift and channel-aware upgrades, and reference-instance cloning. Mutations are dry-run by default behind an eight-block plan, need --yes, and need a typed confirmation when irreversible. Secrets are reported as fingerprints, presence and expiry, never as values. File-based knowledge: no MCP server, no required environment variables, no stored credentials; the single optional variable OPENCLAW_OPS_CONFIG is an escape hatch for the fleet-config path, and deployment specifics live in that operator-owned config outside the repository. - Slug: openclaw-ops - Publisher: AGENTS.STORE - Repository: https://github.com/Agents-Store/agentplugins - Manifest: openclaw-ops/plugin.json - Version: 1.0.1 - Category (editorial): other - Skills: 12 (config-surgery, docs-research, examples, fleet-diagnostics, fleet-model, instance-clone, instance-upgrade, memory-ops, provider-auth, secrets-infisical, security-audit, shared-assets) - MCP servers: 0 - Stars: 0 - Repository created: 2026-08-18 - Repository last pushed: 2026-09-27 - Publisher type: Organization - Listing: https://agentpluginsdirectory.com/plugins/openclaw-ops - Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json ## What openclaw-ops does, in the publisher's words Operations plugin for a fleet of self-hosted OpenClaw gateway instances running as Docker Compose projects on one host. Discovers every instance from the live Docker state (never from hard-coded paths), classifies it ok/degraded/down/alien, and runs day-two maintenance: health and liveness reporting, provider-auth triage (expired, emptied and shadowed OAuth profiles, shared-credential token sink), config surgery with snapshot and executable rollback, memory/embedding repair and reindexing, shared skills and plugins consolidation, Infisical secret-delivery audit by key name only, security audit, version-drift and channel-aware upgrades, and reference-instance cloning. Mutations are dry-run by default behind an eight-block plan, need --yes, and need a typed confirmation when irreversible. Secrets are reported as fingerprints, presence and expiry, never as values. File-based knowledge: no MCP server, no required environment variables, no stored credentials; the single optional variable OPENCLAW_OPS_CONFIG is an escape hatch for the fleet-config path, and deployment specifics live in that operator-owned config outside the repository. From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/Agents-Store/agentplugins/HEAD/openclaw-ops/README.md ## Skills - config-surgery: Use when an OpenClaw instance config is about to be read, changed, restored, split or explained, a model chain, channel, tool, plugin, skill, session or memory setting, a secret reference, an include, a gateway that refuses to start after an edit, a config the process appears to ignore, a change th… - docs-research: Use when anything about OpenClaw is about to be stated or recommended that could have changed, a config key, a CLI flag or subcommand spelling, an auth method, a release channel, a current version, a model name, whether a feature exists or is deprecated, and whenever a claim needs a citation, two s… - examples: Use when a whole OpenClaw fleet job is in view rather than a single answer, first contact with a host whose instances are unknown, a fleet where every instance lost its provider login, an upgrade whose rollback story is unclear, a new instance that has to be stood up and proven isolated, and whenev… - fleet-diagnostics: Use when an OpenClaw instance is misbehaving or suspected of it, health green but nothing is happening, a container restarting or unhealthy, an empty or ignored config, models returning unauthorized or reporting logged out, tokens that are present but empty, schedules failing or firing twice or sta… - fleet-model: Use when work touches an OpenClaw gateway instance or several of them on one host, inventory, status, health, logs, provider auth, config, secrets, memory, shared skills, upgrades, cloning, or when an instance is named or selected, or when the alternative would be a hand-written docker exec, a gues… - instance-clone: Use when a new OpenClaw instance is to be created from an existing one, cloning the reference, standing up a canary or a throwaway test instance, adding an instance for a new workload or tenant, picking a free gateway port for one, deciding what a new instance may share with its source and what it… - instance-upgrade: Use when an OpenClaw instance or a fleet of them is being upgraded, or when the question is which version to move to, version drift between instances, what the current stable is, a release channel or a registry dist-tag, an image tag or digest pin, a soak or hold-back window, a gateway that will no… - memory-ops: Use when OpenClaw memory or its embeddings are involved, embedding calls failing authorization or reporting an invalid token, vector search paused or returning nothing useful, an index-identity warning, a last-index timestamp far in the past, search still poor after the provider was fixed, choosing… - provider-auth: Use when model-provider credentials are in question, unauthorized responses, an instance reporting itself logged out, tokens present but empty, an expiry approaching or passed, several instances losing the same account at once, a login that has to be performed, a choice between an API key, provider… - secrets-infisical: Use when secrets reach an OpenClaw instance through an injection wrapper and something about that is in question, a feature silently off while the config looks right, an instance receiving far fewer keys than its siblings, a plaintext env file inside the state tree, a token or client id sitting in… - security-audit: Use when the security posture of an OpenClaw instance or of the whole fleet is in question, a gateway port that may be reachable from outside the host, firewall rules that read correctly but may not apply to published ports, an operator bearer token that may be shared between instances or sitting i… - shared-assets: Use when skills or plugins are shared across OpenClaw instances on one host, shared trees mounted but empty, the same skill copied into every instance, a shared copy edited with no change in behaviour, an installed asset that never appears in the registered list, a plugin change that did nothing, a… Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.