ProductClank has a teammate that never sleeps. It's an OpenClaw agent on a small Linux server. We talk to it in Telegram. It watches our deploys, runs scheduled jobs, drafts things and reviews code. It doesn't pay a model provider a monthly subscription. Every call goes out through antseed, a peer-to-peer market where independent sellers serve models and you pay per request in USDC.
That setup is cheap and flexible, and it has a lot of moving parts. When the agent stops answering, the fault could be in Telegram, the gateway, the local proxy, the seller you're routed to, or the model. Until last week, finding out which one meant opening SSH on my phone and reading logs through a 6-inch window.
So we built Clawdeck: a small dashboard that shows where along a message's path it breaks and puts the fix on a button. It's MIT-licensed. This post covers the whole thing: what the stack is, how to build your own from an empty server, and what went wrong for us along the way.
Five hops between you and a reply
Every message you send your agent travels the same path. It helps to know it by heart, because every outage is one of these hops failing:
Telegram ──▶ OpenClaw gateway ──▶ antseed proxy (127.0.0.1:8377) ──▶ antseed peer ──▶ modelWhere you talk to the agent. OpenClaw also supports other chat channels. Telegram is the one we use.
The agent runtime: sessions, memory files, tools, cron jobs and several agents with their own workspaces, all behind one long-running service.
A local process that speaks the Anthropic Messages API on localhost. To OpenClaw it looks like any model provider.
An independent seller on the network that actually serves the model. The proxy routes to one and pays it per request from your USDC deposit.
Whatever you picked: an open-weight model for everyday turns, a frontier model as a fallback.
Why antseed instead of one provider's API key? No subscription and no key to leak, a model catalog you can switch per agent, and a bill that stays tiny for an agent that mostly waits. At the time of writing we had spent $0.70 on antseed calls in total.
Build your own, step by step
These are the commands we ran, with versions current as of September 2026. Both tools move fast. When a flag differs, --help on your installed version is the source of truth.
1. Get a box, and close it before you open anything
Any small Linux VPS works. Ours runs Ubuntu 24.04 with 4 vCPUs and 8 GB of RAM, which is more than enough. Install Node 22.22.3 or later (OpenClaw's extended-stable release needs it; the newest release needs Node 24) and Tailscale.
Then turn off public SSH and use Tailscale SSH only. Our server logged 786,000 failed SSH login attempts in 30 days. None got in, but you don't want to be the one who finds out what happens when one does.
curl -fsSL https://tailscale.com/install.sh | sh
tailscale up --ssh # log in from here on via Tailscale SSH
ufw default deny incoming
ufw enable # no public port 22 needed any more
node -v # want v22.22.3+ (or v24)2. Install the antseed buyer and fund it
The buyer is a CLI plus a local proxy. deposit shows the address to send USDC to, and funds land in your deposit balance automatically. A few dollars lasts a long time. The proxy also caps what it will spend per request, so one runaway loop can't drain the deposit.
npm i -g @antseed/cli
antseed buyer deposit # shows your USDC funding address
antseed buyer balance
antseed buyer start # proxy on 127.0.0.1:8377Run it under systemd so it survives reboots. Once it's up, antseed buyer status shows the connection and balance.
[Unit]
Description=AntSeed Buyer Proxy
After=network-online.target
Wants=network-online.target
[Service]
ExecStart=/usr/bin/antseed buyer start
Restart=always
RestartSec=10
[Install]
WantedBy=multi-user.targetYou can pin every request to one seller with --peer or antseed buyer connection set --peer. We did, to get consistent latency. The catch: a pinned seller is a single point of failure. If it goes offline, every call fails even though dozens of other peers could serve you. Pin on purpose, and watch it.
3. Install OpenClaw and connect Telegram
openclaw onboard walks you through the gateway, a workspace, a first model and your chat channels. For Telegram, create a bot with @BotFather and paste the token when asked. Keep DMs on pairing, so a stranger who finds your bot gets a pairing code instead of a conversation with an agent that can run shell commands.
npm i -g openclaw@extended-stable
openclaw onboard # gateway, workspace, model, Telegram
openclaw pairing list # after you DM the bot
openclaw pairing approve <code>4. Point OpenClaw at antseed
Add antseed as a custom provider in ~/.openclaw/openclaw.json. It speaks the Anthropic Messages API on localhost. Declare each model you want to use, then make one the default with fallbacks behind it:
"models": {
"providers": {
"antseed": {
"baseUrl": "http://127.0.0.1:8377",
"api": "anthropic-messages",
"models": [
{ "id": "deepseek-v4-flash", "name": "DeepSeek v4 Flash (antseed)",
"input": ["text"], "contextWindow": 128000, "maxTokens": 8192 },
{ "id": "claude-sonnet-4-6", "name": "Claude Sonnet 4.6 (antseed)",
"input": ["text", "image"], "contextWindow": 1000000, "maxTokens": 8192 }
]
}
}
},
"agents": {
"defaults": {
"model": {
"primary": "antseed/deepseek-v4-flash",
"fallbacks": ["antseed/claude-sonnet-4-6"]
}
}
}The local proxy doesn't check an API key, but each OpenClaw agent needs an auth profile for the provider, so give it a placeholder. Then validate, confirm the models show as available, and send a real message:
openclaw models auth paste-api-key # provider: antseed, key: any placeholder
openclaw config validate
openclaw models list # antseed/* should be available
openclaw agent --message "say hi in five words"5. Run the gateway as a service
openclaw daemon install # systemd service for the gateway
openclaw daemon status
systemctl enable --now antseed-buyer6. Lock it down
An agent with shell access on an internet-facing box needs more care than a normal web app. These are the problems we actually hit, not theoretical ones:
openclaw security audit checks your config and local state for common mistakes. openclaw doctor checks the gateway and channels. Run both after every change.
Docker writes its own iptables rules, so a container published on 0.0.0.0 is reachable from the internet even with ufw set to deny. We found a database and a helper service exposed that way, and the helper had been abused as an open proxy. Bind container ports to 127.0.0.1.
OpenClaw sends the agent's workspace files (AGENTS.md, TOOLS.md and friends) to the model on every turn. With antseed, that model is served by a third-party seller. Keep keys in .env files that tools read, never in anything the agent loads as context.
Not for the gateway's Control UI, not for the antseed proxy, not for a dashboard. Anything that can steer the agent can run commands on the box. Tailscale-only.
We wrote a whole post on the secrets side: Don't Give Your Agent the Keys to the Kingdom.
7. Install Clawdeck
Clawdeck is a zero-dependency Node server that runs on the same box. It listens on 127.0.0.1 only and refuses to start on any other address. You reach it through tailscale serve, which adds HTTPS and tells Clawdeck who is asking. Each request is checked against an allowlist of Tailscale logins.
git clone https://github.com/0xCovariance/clawdeck && cd clawdeck
CLAWDECK_HOST=myserver scripts/deploy.sh # first run creates /etc/clawdeck/config.json
ssh myserver 'nano /etc/clawdeck/config.json' # your Tailscale login + service names
CLAWDECK_HOST=myserver scripts/deploy.sh
ssh myserver 'tailscale serve --bg --https=443 http://127.0.0.1:7070'Then open https://<machine>.<tailnet>.ts.net on any device signed in to your tailnet, including your phone.
A dashboard that starts with the fix
Most dashboards show you numbers and leave the diagnosis to you. Clawdeck starts from the question you actually have when the agent goes quiet: which hop is broken, and what do I do about it?
Checks Telegram, the gateway, the local proxy, the pinned peer and a real 8-token model call, then names the first broken hop.
Findings with one-click fixes: gateway down, Telegram held by the crash-loop breaker, pinned seller missing, low wallet runway, sessions near their context limit, ports exposed to the internet, failed auto-updates.
Deposit balance, spend by day and how many days of runway you have left.
Every text model on the network with price, context size and vision/tool support. Test one, add it to OpenClaw, or make it the default. Config changes are backed up, validated and rolled back automatically if anything breaks.
Context use per session with a transcript view; switch a session's model, compact it or start fresh. Logs with an errors-only filter. Config read-only, secrets masked.
It runs a fixed list of actions and has no shell endpoint. Every action is written to an append-only audit log and can be reported to Telegram. It never touches money: there's no deposit, withdraw or wallet action anywhere in it.
The outages that made us build it
Every Doctor check exists because something broke on our own server first:
openclaw gateway call channels.start --params '{"channel":"telegram"}'openclaw doctor --fix migrated it for us.openclaw gateway call channels.start --params '{"channel":"telegram"}'openclaw doctor --fix migrated it for us.We used to have the agent update itself through an LLM cron job. It failed on the one day the models timed out, which is exactly when you need it to work. Now a plain systemd timer does it: wait until a release has been out for a few days, back up, install, run doctor --fix, health-check, roll back if anything fails, and message us on Telegram only when something changed. Clawdeck shows the last run and can trigger one.
Clawdeck is at github.com/0xCovariance/clawdeck, MIT-licensed. It's v0.2 and runs in production on one server, ours. Next up: config editing with the same validate-and-roll-back safety, and alerts that reach you before you think to open the page.
If you run OpenClaw on antseed, try it and tell us what breaks. Security reports go through GitHub's private vulnerability reporting on the repo.