Get what is deployed for a clawops-managed stack: public IP, gateway URL, SSH user, or that nothing is deployed yet. Reads stack outputs; does not contact the host.

Use when: the user asks what exists for a stack, or where to reach it.

Do NOT use when: the user asks whether the gateway is actually WORKING — that needs the host, so use clawops_doctor. Also not for live logs (use clawops_logs_tail) or config values (use clawops_config_get).

Run clawops's diagnostics and return the report: Node and Pulumi runtime, config, SSH key and known_hosts, cloud credentials per configured provider, and the supported OpenClaw range. With stackName, also contacts the host for container state, the deployed OpenClaw version, a real gateway health probe, whether the port is published to the internet, disk usage on the state directory, log rotation, and hardening drift.

Use when: something is not working and you do not yet know what; before any deploy, upgrade or migration; or to find out which OpenClaw version a gateway is actually running.

Do NOT use when: you already know the problem and want to fix it. This tool only reports — it changes nothing, and never runs openclaw doctor --fix. No tool repairs a gateway: clawops gateway update is CLI-only, so tell the user to run it themselves, after clawops backup create.

Every check carries a status: fail (something is wrong that clawops can name), warn (worth knowing, not broken), info (did not apply). ok is false only when something failed — a fresh machine with no stacks is full of warnings and healthy.

Tail recent gateway logs from a clawops-managed instance.

Use when: the user wants to investigate recent activity or errors, or asks "what's been happening" on the gateway.

Do NOT use when: the user wants real-time streaming logs (those are not well-suited to tool calls; suggest the user run clawops logs -f directly in their terminal). Do NOT use for instance-level system logs: no tool runs arbitrary remote commands, so tell the user to run clawops ssh --command 'journalctl ...' themselves.

Take a live snapshot of a running clawops stack: gateway health, container status, resource usage (CPU, memory, disk), and recent log lines.

Use when: the user wants to know if the gateway is running, how much memory or CPU it is using, what recent log activity looks like, or wants a quick health overview richer than clawops_status.

Do NOT use when: the user wants real-time streaming logs (use clawops_logs_tail or suggest clawops logs -f). Do NOT use for configuration queries (use clawops_config_get).

Read a configuration value from the remote OpenClaw gateway.

Use when: the user wants to inspect current OpenClaw config (e.g., which model provider is active, which channels are enabled).

Do NOT use when: the user wants to change the config — use clawops_config_set instead.

List agents currently registered on the remote OpenClaw gateway.

Use when: the user wants to see which agents are running, debug agent routing, or count active workspaces.

Do NOT use when: the user wants one agent's logs — no tool exposes those; tell the user to run clawops agents logs <name>.

Provision and deploy a clawops stack. Idempotent — re-running with no spec change produces no diff. Long-running (median 3min, p99 8min) so emits progress notifications per R12.

Use when: the user explicitly asks to deploy, provision, create, or "spin up" a stack. Always after the user has reviewed a plan (clawops_plan first when in doubt).

Do NOT use when: the user has not yet generated a plan and is in exploratory/discovery mode — use clawops_plan first. Do NOT use for an existing stack you only need to update; refresh first.

Destroy a clawops stack. Removes ALL provisioned resources. Triggers elicitation confirmation showing the resource diff before execution (R19). Cannot be undone.

Use when: the user explicitly asks to destroy, tear down, delete, or remove a stack. Always confirm the stack name.

Do NOT use when: the user wants to stop the gateway temporarily — that is not a destroy, and no tool stops a gateway; clawops_gateway_restart is the only gateway tool. Do NOT use when in doubt about which stack; list first with clawops_stacks_list.

Apply a previously-generated Maker plan (deploy-plan.schema.json). Deterministic — the plan describes exactly what will be created.

Use when: the user has a plan file path and wants to apply it. This is the agent-friendly path for any deploy/destroy operation.

Do NOT use when: there's no plan file — generate one first with clawops_plan.

Generate a Maker deploy plan (does NOT apply). Plan is JSON conforming to deploy-plan.schema.json — review before applying.

Use when: the user wants to see what would be created before committing, or you (the agent) need a reviewable artifact for the user to approve.

Do NOT use when: the user has explicitly asked to deploy and you already have their approval — go directly to clawops_up.

Set a configuration value on the remote OpenClaw gateway. Optionally restarts the gateway after.

Use when: the user wants to change OpenClaw configuration (model provider, channel auth, gateway port).

Do NOT use when: the user is reading config — use clawops_config_get. Do NOT bulk-edit; one key at a time so changes are auditable (R21).

Remove a configuration key from the remote OpenClaw gateway config, reverting it to the OpenClaw default.

Use when: the user wants to delete a config key entirely (e.g., remove a channel, clear an override).

Do NOT use when: the user wants to set the key to a new value — use clawops_config_set instead.

Validate the remote OpenClaw gateway config against the known schema. Checks for structural errors (wrong types, unknown top-level keys) that would cause OpenClaw to fail on startup.

Use when: the user wants to verify config before restarting the gateway, or after editing openclaw.json manually.

Do NOT use when: the user wants to change config — use clawops_config_set.

Restart the OpenClaw gateway daemon on the remote instance.

Use when: a gateway-wide config change requires reload, or the gateway is reported as unresponsive.

Note: OpenClaw 2.0 removed per-agent restart; gateway restart is the only restart it offers, and it affects every agent on the host. Brief downtime (~10s).

Register a stack and write ~/.clawops/config.json: the provider, the state backend, the region, and an SSH key pair generated if one is not already there. Nothing is provisioned and nothing is charged; this only creates local configuration.

Use when: any other clawops tool reports that there is no config, or the user wants to add a second stack alongside the ones they have. This is the first call on a machine that has never run clawops — a fresh container, a new laptop, a sandbox.

Adding a stack is additive and safe: existing stacks are kept. Overwriting one needs force: true, because changing a state backend orphans the Pulumi state it points at — the infrastructure stays up and clawops can no longer see or destroy it.

For aws, gcp and azure, stateUrl can be omitted and clawops names a bucket from the account it can see; that needs cloud credentials in the environment, so in a sandbox pass stateUrl explicitly. The local provider needs host instead, and no cloud account at all.

Do NOT use when: the user wants to deploy — that is clawops_up, after this. Credentials are never passed here: clawops reads them from the environment (R6).

Apply security hardening to a deployed stack: SSH, UFW, fail2ban, unattended-upgrades, the Docker socket, and per-cloud checks. Optionally join the stack to a Tailscale network and reach it there instead of over the public internet.

Use when: the user asks to harden, secure, or lock down a stack; asks what the hardening report says (with dryRun: true, which changes nothing); or asks to put a stack on their tailnet.

tailscale: true installs Tailscale, joins the tailnet as clawops-, and then moves clawops onto that address — but only after opening an SSH session to it, against host keys pinned over the connection already trusted. If that fails, nothing is recorded and the public address stays in use. The auth key comes from clawops secret set TAILSCALE_AUTH_KEY and is never passed through this tool (R6).

tailscaleRevert: true takes the host back off the tailnet, over its public address. On a private-only stack it refuses and names the plan/apply commands that reopen SSH first — relay them rather than trying to work around it.

To close the public ports afterwards, plan with privateOnly: true and apply that plan; this tool does not change firewall rules.

Do NOT use when: the user wants to know whether a stack is healthy — that is clawops_doctor. Do NOT pass tailscale and tailscaleRevert together.

Poll the status of a long-running clawops task (returned by clawops_up, clawops_destroy, clawops_apply, etc.). Per R12 streaming model.

Use when: the user is waiting on a long-running deploy/destroy and wants progress, OR you need to check whether a previously-started operation finished.

Do NOT use when: there is no active taskId — start the operation first.

Single-tool workflow that takes a user from "I want to deploy OpenClaw to " to a verified, healthy gateway. Internally: plan → user confirms (elicitation) → up → wait for healthy → return URL.

Use when: the user expresses end-to-end deployment intent ("deploy to AWS", "spin up an OpenClaw on GCP for me").

Do NOT use when: the user is mid-deployment and only needs one step (e.g., they already have a plan; use clawops_apply). Do NOT use for destroying or updating — separate workflows.

Diagnostic workflow for an unhealthy stack. Internally: status check → gateway logs → agent logs → systemd service status → produces a structured diagnostic report with suggested remediation.

Use when: the user reports any "not working" symptom and you don't know where to start. Best entry point for troubleshooting.

Do NOT use when: the user has already identified the problem and asks for a specific fix.

List all clawops-managed stacks across all configured providers.

Use when: the user wants an overview of their deployments, asks "what stacks do I have", or wants to compare stacks before an operation.

Do NOT use when: the user named a specific stack — use clawops_status directly with that name.