Local-first • Sidecar for OpenClaw

Local-first SecOps,
inside OpenClaw.

SecOpsAI turns OpenClaw audit telemetry into actionable findings (malware, exfil, risky exec/policy abuse) and lets you triage from chat/WhatsApp. All data stays on your machine.

No log shipping by default SQLite SOC store CLI + WhatsApp workflows
secopsai — local pipeline
$secopsai refresh
Exporting OpenClaw telemetry… ingesting… detecting…
[OK] Findings persisted to local SOC store (SQLite)
$secopsai list --severity high
warning HIGH: Suspicious execution / policy abuse detected
OCF-… | status=open | disposition=unreviewed
$secopsai intel refresh
Pulled 10k+ IOCs (URLhaus + ThreatFox) → stored locally
$
Capabilities

Detect, triage, and act — locally

SecOpsAI is a sidecar detection engine for OpenClaw. It reads local audit telemetry, produces findings with severity + evidence, and supports fast chat-driven triage workflows.

chat

WhatsApp workflows

Use OpenClaw to interact with SecOpsAI from WhatsApp: “check malware”, “check exfil”, “show OCF-…”, “mitigate OCF-…”.

hub

Threat Intel (IOCs)

Pull open-source IOCs, normalize + score them, optional local enrichment (DNS), then match against replay events to generate TI findings.

rocket_launch

Coming soon integrations

OpenClaw variants

Native integrations with other OpenClaw variants/telemetry sources are coming soon: Hermes, ManusAI, Zo Computer.

SIEM platforms (optional)

Optional SIEM output integrations are coming soon: Splunk and Elastic (Elasticsearch).

(Still local-first by default — exporting is opt-in.)

Get Started

Zero to findings in minutes

Install locally, run the pipeline, list findings. All data stays on your device unless you explicitly export it.

# Install
curl -fsSL https://secopsai.dev/install.sh | bash
# Activate
cd ~/secopsai && source .venv/bin/activate
# Refresh + list high
secopsai refresh && secopsai list --severity high
# Threat intel (optional)
secopsai intel refresh && secopsai intel match --limit-iocs 500
Links: docs · github · clawhub · x