OpenClaw has become one of the more popular self hosted AI agent gateways for a reason. It connects to Telegram, WhatsApp, Discord, and a long list of other surfaces. It supports MCP tool calls natively. It keeps conversation memory across sessions. And it’s open source, so you can actually see what it’s doing.
It also has well documented security concerns. By default, the gateway listens on all network interfaces. It has shell access. It can read and write files. If you expose it to the open internet, then you’re asking for trouble. I have given it access to the internet via the Brave search API more on that later but have taken deliberate steps to contain the risk.
The security model: contain everything, expose nothing
OpenClaw runs inside an OrbStack container on my Mac Studio. The container talks to Ollama on the host via host.docker.internal for inference, and to Tailscale for remote access. That’s it. No ports open to the wider network. No path from the public internet to the gateway.
Tailscale handles the remote access piece. My phone can reach the agent from anywhere, but the traffic travels through an encrypted mesh network that never touches a public endpoint. The Mac stays behind my home network with no holes punched in the firewall.
Is this bulletproof? No. Is it meaningfully more secure than a cloudhosted agent that processes your documents on someone else’s infrastructure? Yes. And that’s the trade I’m making.
Gemma 4 31B: the model that made this worth building
I’m running Gemma 4 31B Dense, and for a local model, the capability is impressive.
Gemma 4 is natively multimodal. Text, images, video. I can send it a photo of a whiteboard from a meeting and it reads it. I can share a screenshot of an error and it parses the stack trace. This isn’t a bolt on vision module. It’s built into the architecture, and it works.
The model loads the full 31B dense weights into roughly 35GB of RAM on my 64GB RAM M1 Mac Studio. That leaves a comfortable headroom for OrbStack, macOS, and whatever else is running. The thinking time can be a little slow on complex reasoning chains. I’m not pretending this competes with a frontier cloud model on raw speed. But for an agent sitting on my desk, responding to Telegram messages, reading my documents, and understanding images I send it, the tradeoff is just right.
The configurable thinking mode is worth calling out. Gemma 4 can reason step by step before answering, which makes it noticeably better at tool use decisions. When OpenClaw asks the model “should I search the web or check the vault for this?”, a model that thinks before acting gives materially better answers than one that just generates the next likely token.
Brave, the knowledge vault, and the trust boundary
The agent has two sources of external knowledge.
Brave Search API gives it access to the open web. This is the one deliberate hole in the “everything local” principle, and it exists because an agent that can’t look anything up is an agent that makes things up. The Brave API is privacy respecting by design, and the queries go through the API, not through a browser session. No cookies, no tracking, no profile.
My Obsidian vault sits in a Google Drive folder that syncs locally to the Mac, then bind mounts into the OpenClaw container. The agent can read and write to that folder, but the key word is that folder. It’s siloed to a single mounted directory. It can’t see the rest of my drive, can’t touch the host filesystem, and can’t reach anything outside the container boundary. The blast radius is one folder. And because it’s Google Drive, I can roll back any file to a previous version if the agent does something unhelpful. That’s not a theoretical safeguard. It’s the actual recovery path.
The vault is where the agent becomes genuinely personal. It knows what I’m working on, what I’ve written, what I’m tracking. Combined with OpenClaw’s conversation memory across sessions, it builds a continuity that turns a stateless model into something that feels like it actually knows the context.
Here’s my honest caveat, I’ve given the agent clear instructions that vault data must never be transmitted externally, never included in web searches, never referenced in any outbound call. Will that hold under every edge case? Time will tell. The siloed mount limits the blast radius. Google Drive versioning gives me a rollback path. The Tailscale boundary protects against network exposure. The instruction set protects against the model deciding to be helpful in ways I didn’t ask for. Defence in depth, not blind trust.
Where MCP tools fit next
OpenClaw supports MCP natively, which is where this setup gets interesting. Right now, the agent handles conversation context within a session and uses the Brave API for web access. But MCP is designed for something more structured: discrete tool calls that let the agent search, retrieve, check, and act across multiple sources in a single chain, with full context maintained between steps.
I haven’t built custom MCP tools yet, but the architecture is ready for them. The plan is to create tools that let the agent query the Obsidian vault semantically, interact with specific APIs, and orchestrate multi step tasks without losing the thread between calls. Gemma 4’s 256K context window and configurable thinking mode make this viable in a way that smaller context models wouldn’t. When the model can reason about which tool to call next rather than just generating the next token, multi step chains become genuinely useful rather than brittle.
For a local agent with no cloud backend, no vector database (yet), and no retrieval augmented generation pipeline, this is already a surprisingly capable setup. The MCP tools will be what turns it from a good assistant into something that can genuinely coordinate across my data.
Final thoughts
OpenClaw’s reputation for security issues is earned. But security issues are not the same as security flaws. They’re a consequence of what the tool is designed to do: give an AI agent access to your systems. The question isn’t whether that’s risky. It’s whether you’ve contained the risk sensibly.
Container. Tailscale. Siloed mounts with rollback. No public exposure. Clear instruction boundaries. That’s the stack. And paired with a model that can now see images, reason through multi step problems, and maintain context across tool calls, it’s quietly become the most useful thing running on my desk.
The 64GB M1 Mac Studio was bought second hand. The software is open source. The data never leaves my house. And the agent understands what I show it, not just what I type.
That last part is new. And it changes more than you’d expect.
The set up and continual work will be maintained here: Local AI Hub: It’s my data not yours.