How to Set Up OpenClaw with All Essential Requirements of an Agent

Running openclaw onboard gets you a working gateway. The agent responds to messages. But it has no personality, no memory, no tools, and no proactive behavior. It is a blank shell that waits to be prompted.

This post picks up where the deploy guide ends. I will walk through every file and config that turns that shell into an agent that remembers who you are, uses tools without confirmation, monitors your server on a schedule, and searches the web when it needs to.

If you want to deploy fresh Openclaw from scratch, follow our openclaw deployment guide.

Define who the agent is

SOUL.md

The first file you need is ~/.openclaw/workspace/SOUL.md. This is your agent’s identity document. It sets tone, communication style, rules, and boundaries. OpenClaw reads it at the start of every session, before the model gets a chance to generate its first response.

A blank SOUL.md means the agent defaults to generic helpful mode. That is fine for demos. It is not fine for a tool the agent actually uses.

Here is a minimal SOUL.md that actually works:

# SOUL.md
You are a terse, no-nonsense server admin assistant.
You prioritize uptime and security above all else.
You do not apologize. You do not qualify everything with caveats.
You ask one clarifying question before running destructive commands.
You log everything you do to the daily memory file.

You can inspect the file after you create it:

cat ~/.openclaw/workspace/SOUL.md
# Output: the content you wrote above

Keep it short. The full file loads into the context window on every session start. 50 lines is fine. 200 lines is wasteful.

AGENTS.md

Where SOUL.md defines who the agent is, AGENTS.md defines how it operates. It covers session behavior, channel rules, safety guardrails, heartbeat schedules, and tool access philosophy. OpenClaw ships with a comprehensive default at ~/.openclaw/workspace/AGENTS.md.

You can view what is already there:

cat ~/.openclaw/workspace/AGENTS.md | head -60

Here is what a customized version looks like for a server monitoring agent:

# AGENTS.md
## Channels
- Only speak in #alerts when priority is HIGH or CRITICAL
- Log informational findings silently, do not interrupt

## Safety
- Never run destructive commands without confirmation
- Always log the command and output to memory/$(date +%Y-%m-%d).md

## Heartbeats
- Every 15 minutes: docker ps --format "{{.Names}} {{.Status}}"
- Every hour: grep "Failed" /var/log/auth.log | tail -5
- Daily at 09:00: df -h && free -h

The heartbeat entries are the important part here.

Give it a memory that survives reboots

Long-term memory: MEMORY.md

OpenClaw writes session logs to ~/.openclaw/workspace/memory/YYYY-MM-DD.md automatically. The agent reads recent days on startup for short-term continuity. But the file you actually curate is MEMORY.md. Here is what it looks like after a few weeks:

# MEMORY.md
## User
- Admin: Adarsh Sojitra
- Primary server: 49.13.74.134, Ubuntu 24.04, 2 vCPU, 4GB RAM
- Preferred shell: bash

## Stack
- Docker for all container workloads
- Nginx on host for reverse proxy

## Preferences
- Never suggest Docker unless the user asks
- Always show the full command before running it

## Lessons
- 2026-07-10: Claude Code CLI is at /usr/local/bin/code, not the default npm path
- 2026-07-14: Always check disk space before pulling large Docker images

The curation workflow is simple. Once a week, open the daily memory files and pull anything worth keeping into MEMORY.md. Delete the rest. MEMORY.md is a greatest hits collection, not a journal.

Daily log files

Check what OpenClaw has already logged:

ls ~/.openclaw/workspace/memory/
# Shows files like: 2026-07-10.md 2026-07-11.md

Each file is a raw transcript of what the agent did that day. Curate weekly.

Add tools via MCP

This is where the agent stops being a chatbot. OpenClaw connects to MCP servers which expose capabilities the model can call at runtime.

Official memory server

The easiest MCP tool to add first is the Model Context Protocol memory server. It gives the agent persistent semantic memory across sessions, not just file-based context loading.

openclaw mcp add memory 
  --command npx 
  --arg -y 
  --arg @modelcontextprotocol/server-memory
openclaw mcp status --verbose

You should see output like this:

Server: memory
Command: npx -y @modelcontextprotocol/server-memory
Status: enabled
Tools: memory_create, memory_search, memory_list

Scope filesystem access

OpenClaw ships with a filesystem tool. By default it can read and write across the entire filesystem, which is fine on a personal machine and dangerous on a shared VPS. Scope it to the smallest directory tree the agent needs.

Edit ~/.openclaw/config.yaml:

tools:
  filesystem:
    allowedPaths:
      - /home/user/openclaw-workspace
      - /var/log/openclaw

After any config change, restart the gateway:

openclaw gateway restart
openclaw gateway status | grep -E "status|port"

Remote tool server with mcp-remote

For tools running on a different machine, use the mcp-remote bridge over HTTPS:

npm install -g [email protected]

Then register a remote server:

openclaw mcp add remote-tools 
  --command mcp-remote 
  --arg "https://your-tunnel.ngrok-free.app/mcp"
openclaw mcp probe remote-tools --json

A successful probe returns tool names. A timeout means the tunnel is down or the URL is wrong.

Verify everything is connected

openclaw mcp doctor --probe

This command connects to every configured MCP server and reports diagnostics. It is the first thing to run when tools are not behaving as expected.

Connect a search provider

An agent without search is blind to current events. OpenClaw supports multiple search backends so the agent can look up error messages, check package versions, and find documentation on its own.

Configure the backend

The fastest path is the interactive configure command. Or set it directly in ~/.openclaw/config.yaml:

tools:
  search:
    provider: serpapi
    apiKey: "YOUR_SERPAPI_API_KEY"

SerpAPI is simpler for most setups since it handles the scraping layer for you.

Test search is working

openclaw tools test search

If this returns nothing, check your API key.

Cap costs with domain and daily limits

Search API costs add up fast when the agent runs freely. Lock it down:

tools:
  search:
    provider: serpapi
    apiKey: "YOUR_KEY"
    dailyLimit: 50

Without limits, a busy agent can burn through your monthly API quota in hours.

Enable proactive monitoring with heartbeats

Heartbeats are scheduled checks the agent runs without a prompt from you. This is the difference between an agent that waits and one that acts. A properly configured agent will alert you when your server goes down before you notice it yourself.

Configure a heartbeat

Add heartbeat entries directly in AGENTS.md under ## Heartbeats:

## Heartbeats
- Every 15 minutes: docker ps --format "{{.Names}} {{.Status}}"
- Every hour: grep -i "error|critical|failed" /var/log/syslog | tail -3
- Every 6 hours: df -h

The agent logs results silently when things are fine. It pings you when something needs attention. Verify the heartbeat engine is running:

openclaw gateway status
# Shows: heartbeat: active

If you do not see heartbeat in the status, restart the gateway:

openclaw gateway restart && sleep 3 && openclaw gateway status

Lock it down

OpenClaw runs on your own infrastructure. That does not make it secure by default. The main risks are unauthorized users finding your bot, API key misuse, and unconstrained tool execution.

Allowlists

Without an allowlist, anyone who discovers your Telegram bot or webhook endpoint can message the agent and spend your API credits. Add your user ID to the allowlist:

openclaw configure
# Navigate to: Security > Allowlist
# Add your user ID and a friendly name

Or edit the config directly:

security:
  allowlist:
    - user_id: "123456789"
      name: "admin"
    - user_id: "987654321"
      name: "dev"

You can find your Telegram user ID by messaging @userinfobot on Telegram.

Pairing mode

Pairing requires manual approval before a new user can interact with the agent:

openclaw pairing enable
openclaw pairing list
# Shows pending and approved pairings

When someone new messages the agent, you get a pairing request to approve or deny.

Permission mode

OpenClaw has three permission modes: prompt (default, asks for approval), bypass (runs autonomously), and deny (blocks all privileged commands). Check your current mode:

openclaw configure --show | grep permissionMode
# Current: prompt

For a monitoring agent that handles alerts automatically, set permission mode to bypass after you have verified your tool configuration:

openclaw configure
# Navigate to: Security > Permission Mode
# Set to: bypass
# Only do this after you have verified your heartbeat and tool configs

The bypass mode is powerful. The agent can run any configured tool without asking. If the tool list includes shell execution, the agent has the same permissions as the user running the gateway process.

CLI commands you will use every day

openclaw gateway status       # Is it running?
openclaw mcp status --verbose # What tools are connected?
openclaw mcp doctor --probe  # Live health check
openclaw pairing list         # Who has access?
openclaw configure           # Interactive editor
openclaw gateway restart     # After config changes

These are the commands you will run most while setting things up and debugging.

What comes next

With identity, memory, tools, search, heartbeats, and security in place, you have a fully operational agent. Next, connect a messaging channel like Telegram or Discord so the agent is reachable from your phone. Then explore ClawHub for community skills, or pair OpenClaw with a vector database like Qdrant for richer long-term knowledge.

Ready to self-host a real AI agent on your VPS? InterServer VPS plans start at $6/month with full root access, perfect for running OpenClaw alongside your other services.

Related InterServer guide: If you want AI agents to connect directly to InterServer hosting tools, read InterServer MCP Server: Connect AI Agents to Your Hosting Account.