Clawdbot Setup Guide

ClawdBot + MiniMax Coding Plan Setup

Deploy ClawdBot on Ubuntu VPS with MiniMax M2.1 as the AI backend.

⚠️ Security Warnings

**IMPORTANT:** Read these warnings before deploying ClawdBot in production.

Installation Security

• Curl-pipe-bash risk: The curl | bash installation method executes remote code without inspection. Always review scripts before running: curl -fsSL https://clawd.bot/install.sh -o install.sh && less install.sh && bash install.sh
• Verify checksums: When possible, verify package integrity before installation

API Keys & Credentials

• Never commit credentials: Do not commit clawdbot.json with API keys to version control. Add it to .gitignore
• Use environment variables: Consider using MINIMAX_API_KEY, TELEGRAM_BOT_TOKEN, DISCORD_BOT_TOKEN env vars instead of hardcoding in config
• Restrict file permissions: chmod 600 ~/.clawdbot/clawdbot.json to prevent other users from reading your credentials
• Rotate keys regularly: If you suspect key exposure, regenerate immediately

Access Control ⚠️

• dmPolicy: "open" + allowFrom: ["*"] = ANYONE can use your bot. This includes strangers, spammers, and malicious actors who will consume your API credits
• Prefer allowlist mode in production with explicit phone numbers/user IDs
• pairing mode adds friction but prevents unauthorized access
• Monitor usage: Check clawdbot logs regularly for unexpected activity

Network Security

• gateway.bind: "loopback" (default) only accepts local connections - do not change to 0.0.0.0 unless behind a firewall
• Firewall rules: If exposing the gateway port, restrict access via ufw or iptables
• Use reverse proxy: For remote access, use nginx/caddy with TLS instead of exposing the port directly

Bot Token Security

• Telegram/Discord tokens grant full bot control. Treat them like passwords
• Revoke compromised tokens immediately: Use BotFather `/rev