Migration Guide
OpenClaw has undergone a rapid triple rebrand and several critical security patches. This guide covers upgrading from any previous version to the latest release.
The Triple Rebrand​
| Name | Period | Reason |
|---|---|---|
| Clawdbot | Nov 2025 – Jan 27, 2026 | Original name |
| Moltbot | Jan 27 – Jan 30, 2026 | Anthropic trademark complaint ("Clawd" too close to "Claude") |
| OpenClaw | Jan 30, 2026 – present | "Moltbot never quite rolled off the tongue" |
This was the fastest triple rebrand in open-source history — all three names within a single week.
What Changed in Each Rename​
Clawdbot → Moltbot (Jan 27):
| Component | Old | New |
|---|---|---|
| CLI command | clawdbot | moltbot |
| Config directory | ~/.clawdbot/ | ~/.moltbot/ |
| npm package | clawdbot | moltbot |
| GitHub repo | Redirected automatically |
Moltbot → OpenClaw (Jan 30):
| Component | Old | New |
|---|---|---|
| CLI command | moltbot | openclaw (old names kept as aliases) |
| Config directory | ~/.moltbot/ | ~/.openclaw/ |
| Config file | moltbot.json | openclaw.json |
| Workspace | ~/clawd | ~/.openclaw/workspace |
| npm package | moltbot | openclaw |
| npm scope | — | Extensions moved to @openclaw/* |
| Docker image | clawdbot/clawdbot | openclaw/openclaw |
The rapid renames created a dangerous supply-chain attack surface. Attackers hijacked abandoned repository names, published malicious packages with near-identical old names (typosquatting), and distributed a fake VS Code extension. Only install from the official openclaw npm package.
Upgrade Steps​
From Clawdbot or Moltbot to OpenClaw​
# 1. Uninstall old package
npm uninstall -g clawdbot # or: npm uninstall -g moltbot
# 2. Install OpenClaw
npm install -g openclaw
# 3. Re-run onboarding for new config format
openclaw onboard
After upgrading:
- Rotate ALL gateway tokens immediately — old tokens may have been exposed
- Configure authentication —
auth: nonehas been permanently removed as of v2026.1.29 - Stop old services if running as a daemon (see Systemd Migration)
- Verify your installation:
openclaw gateway status
Systemd Migration​
If you were running Clawdbot as a systemd service, the old service must be manually stopped:
# Stop and disable old service
sudo systemctl stop clawdbot-gateway
sudo systemctl disable clawdbot-gateway
sudo rm /etc/systemd/system/clawdbot-gateway.service
sudo systemctl daemon-reload
# Verify only openclaw is running
openclaw gateway status
A common migration problem (Issue #5103): both clawdbot-gateway.service and openclaw-gateway.service run simultaneously. The old gateway holds port 18789 while the new service enters a restart loop (53+ restarts observed). Always stop the old service first.
npm Stuck on Old Version​
If npm update doesn't upgrade you past the old version, you're still on the frozen clawdbot or moltbot package:
# These packages are frozen — they will NEVER receive updates
npm uninstall -g clawdbot # or moltbot
# Install the active package
npm install -g openclaw
Critical Version Upgrades​
v2026.1.29 — CVE-2026-25253 Patch (January 30)​
You MUST upgrade to at least this version. It patches a CVSS 8.8 one-click RCE vulnerability.
Breaking changes:
auth: nonepermanently removed — all gateways now requiretoken,password, or Tailscale Serve authentication- Channel auth prefers config over environment variables for Discord/Telegram/Matrix (env vars become fallback only)
What was fixed:
- CVE-2026-25253: Cross-site WebSocket hijacking that allowed remote code execution via a crafted URL, even on localhost-bound instances
- The Control UI no longer accepts a
gatewayUrlquery parameter
v2026.1.30 — CLI Improvements (January 31)​
- Shell completion:
openclaw completion(Zsh/Bash/PowerShell/Fish) - Per-agent model status:
openclaw models status --agent <id> - New LLM providers: Kimi K2.5, MiniMax OAuth
v2026.2.2–2.5 — Feature Updates (February 2-5)​
- Major memory architecture overhaul
- Canvas feature for visual presentations
- Skill marketplace
- Workflow recording and replay
- Voice message transcription
unbrowsebrowser automation with visual element detection- WhatsApp stability fixes
v2026.2.6 — VirusTotal Integration (February 6)​
- All ClawHub skill uploads now scanned by VirusTotal Code Insight
- New model support: Claude Opus 4.6, GPT-5.3-Codex, xAI Grok
- Agent management RPC methods for web UI
This was a direct response to the ClawHavoc campaign and ToxicSkills study.
Configuration Migration​
Automatic Migration​
When you install the openclaw package, it automatically:
- Detects existing
~/.clawdbot/or~/.moltbot/directories - Copies config and data to
~/.openclaw/ - Creates symlinks from old paths to new paths
- Preserves legacy config resolution
Config Path Reference​
| Era | Config Directory | Config File | Workspace |
|---|---|---|---|
| Clawdbot | ~/.clawdbot/ | clawdbot.json | ~/clawd |
| Moltbot | ~/.moltbot/ | moltbot.json | ~/clawd |
| OpenClaw | ~/.openclaw/ | openclaw.json | ~/.openclaw/workspace |
Environment Variables​
| Old (Clawdbot) | New (OpenClaw) | Notes |
|---|---|---|
CLAWDBOT_GATEWAY_TOKEN | OPENCLAW_GATEWAY_TOKEN | Must rotate after upgrade |
CLAWDBOT_PORT | OPENCLAW_PORT | Default: 18789 |
CLAWDBOT_HOME | OPENCLAW_HOME | Config directory override |
TELEGRAM_BOT_TOKEN | TELEGRAM_BOT_TOKEN | Unchanged |
DISCORD_BOT_TOKEN | DISCORD_BOT_TOKEN | Unchanged |
SLACK_BOT_TOKEN | SLACK_BOT_TOKEN | Unchanged |
Channel tokens (Telegram, Discord, Slack, etc.) are unchanged — only CLAWDBOT_* prefixed variables changed to OPENCLAW_*.
Docker Images​
| Era | Image | Status |
|---|---|---|
| Clawdbot | clawdbot/clawdbot | Frozen — never updated |
| OpenClaw | openclaw/openclaw | Official, actively maintained |
| Community | alpine/openclaw | Alpine-based minimal image |
| Coolify | coollabsio/openclaw | Daily CalVer builds, arm64 |
npm Packages​
| Package | Status |
|---|---|
clawdbot | Frozen — will never receive updates |
moltbot | Frozen — will never receive updates |
openclaw | Active — all new releases |
@openclaw/* | Extension scope (channels, plugins) |
Data Preservation​
OpenClaw stores all persistent data as plain Markdown files. The upgrade process only touches application code, not data:
Automatically preserved:
SOUL.md,IDENTITY.md,USER.md,TOOLS.md,AGENTS.mdMEMORY.mdandmemory/*.mdfiles- Installed skills in
~/.openclaw/skills/ - Channel credentials and API keys
Potential issues:
- If the agent "forgets" after restart, confirm the gateway is using the same workspace on every launch
- Remote mode uses the gateway host's workspace, not your local laptop's
Community Migration Tools​
clawd_migrate​
clawd_migrate is a community-built migration tool:
npx clawd_migrate --root /path/to/workspace --setup-openclaw
- Migrates from Clawdbot or Moltbot to OpenClaw
- Preserves all memory/identity files
- Creates timestamped backups under
backups/ --setup-openclawflag runsnpm i -g openclaw && openclaw onboard- Works on Windows, macOS, Linux
OpenClaw Ansible​
openclaw-ansible provides automated, hardened installation with Docker isolation, Tailscale VPN integration, and firewall configuration. Supports both fresh installs and migrations.
CI/CD Pipeline Updates​
When migrating CI/CD pipelines:
| Component | Old | New |
|---|---|---|
| npm install | npm i -g clawdbot | npm i -g openclaw |
| Docker FROM | clawdbot/clawdbot | openclaw/openclaw |
| Environment | CLAWDBOT_GATEWAY_TOKEN | OPENCLAW_GATEWAY_TOKEN |
| Systemd | clawdbot-gateway.service | openclaw-gateway.service |
| Update channel | — | openclaw update --channel stable |
Rollback​
To downgrade to a specific version:
npm install -g openclaw@2026.1.30
Downgrading exposes you to security vulnerabilities fixed in newer versions. Never downgrade below v2026.1.29 (critical RCE patch).
See Also​
- Installation — Fresh install guide
- Known Vulnerabilities — CVEs and incident timeline
- Security Hardening — Post-upgrade hardening steps
- Configuration Reference — Full config file documentation