Universal Agent Control

One dashboard.
Every agent.

botcontrol.ai is a real-time control plane for OpenClaw AI agents. Monitor status, send tasks, open terminals, and manage integrations — all from your browser.

What is botcontrol.ai?

botcontrol.ai is a web-based dashboard that lets you remotely monitor and control AI agents running on OpenClaw — anywhere in the world. Whether your agents run on a VPS, a home server, or a cloud instance, you get a single pane of glass to see what they're doing and tell them what to do next.

Think of it as mission control for your AI workforce. Each agent appears as a card with real-time status, uptime, and current task. Click into any agent to open a full workspace with chat, terminal access, and integration management.

Built for OpenClaw

First-class integration with the OpenClaw agent framework. Install a plugin, restart, done.

Who is it for?

👨‍💻

Solo developers

Running agents on multiple machines? See them all in one place without SSH-ing into each one.

🏢

Teams & agencies

Deploy agents for clients, monitor uptime, and send commands remotely — no VPN required.

🧪

Researchers

Experiment with AI agents across environments. Live terminal + chat makes debugging fast.

🎮

Power users

Automate workflows with broadcast commands, scheduled tasks, and integration nodes.

Features

Real-time status

Live WebSocket connection shows agent status, uptime, and current task instantly.

Chat interface

Send natural language commands to any agent. It executes them and reports back in real time.

Live terminal

Full shell access to the agent's host machine, streamed through WebSocket. No SSH needed.

Broadcast commands

Send a single command to all connected agents at once. Perfect for fleet management.

System info

One click to see OS, CPU, memory, disk, and uptime of the agent's host machine.

Integration nodes

Email, Wallet, Card, Phone, Jobs, Social — plug capabilities into your agents visually.

Dark mode

Full dark theme support. Your eyes will thank you during those late-night debugging sessions.

Secure by default

TLS encryption, Firebase authentication, per-bot API keys. Everything encrypted in transit.

Security & Trust

When you give a platform control over remote machines, security isn't optional — it's the foundation. Here's how botcontrol.ai protects your agents, your data, and your infrastructure.

Encrypted everywhere

All traffic uses TLS 1.3. Dashboard connections are HTTPS. Agent WebSocket connections are WSS. No plaintext ever leaves your machine.

Authenticated access

Firebase Authentication handles sign-in. Every API request and WebSocket upgrade is verified server-side with JWT token validation.

Isolated by design

Each bot runs in its own Cloudflare Durable Object — a dedicated, isolated compute instance. No bot can access another bot's data or connections.

01

Transport layer security

Every byte of data between your browser, our servers, and your agents travels over encrypted channels. The dashboard is served over HTTPS with TLS 1.3 via Cloudflare's global network. Agent-to-server connections use WSS (WebSocket Secure), ensuring that commands, terminal output, and chat messages cannot be intercepted or tampered with in transit.

HTTPS everywhere Dashboard, API, and static assets all served over TLS 1.3
WSS connections Agent WebSocket links are encrypted end-to-end with TLS
HSTS headers Strict Transport Security prevents protocol downgrade attacks
Certificate pinning Cloudflare edge network handles certificate management and rotation
02

Authentication & authorization

User authentication is powered by Firebase Auth, supporting email/password and OAuth providers. On the server side, every request is verified — we decode and validate the Firebase JWT on each API call and WebSocket upgrade. No request reaches your bot data without a valid, unexpired token tied to your user account.

Server-side JWT verification Tokens are validated on every request using Firebase Admin SDK public keys
Per-user data isolation Your bots are tied to your UID. No user can see or control another user's agents
Token expiry Short-lived JWTs with automatic refresh. Stale tokens are rejected immediately
OAuth support Sign in with Google or other providers — no passwords stored on our side
03

Per-bot API keys

When you create a bot, a unique, cryptographically random API key is generated. This key is used by the OpenClaw plugin on the agent's machine to authenticate its WebSocket connection to the server. Each bot has its own key — if one is compromised, revoke it and regenerate without affecting your other agents.

Unique per bot Every agent gets its own randomly generated API key at creation time
Key rotation Regenerate keys at any time from the dashboard without re-registering
Scoped access A bot key only grants access to that specific bot's Durable Object instance
Stored securely Keys live in Cloudflare KV, encrypted at rest by Cloudflare's infrastructure
04

Durable Object isolation

botcontrol.ai uses Cloudflare Durable Objects as the core routing and state layer. Each bot gets its own Durable Object — a single-threaded, globally unique compute instance. This means your bot's WebSocket connections, in-memory state, and message routing are physically isolated from every other bot on the platform. There is no shared memory, no shared process, and no way for one bot's traffic to leak into another's.

Single-threaded isolation Each Durable Object runs in its own V8 isolate with separate memory
No shared state Bot A cannot read, write, or interfere with Bot B's data or connections
Global distribution Objects run close to the agent for low latency, managed by Cloudflare's edge
Automatic scaling Each bot scales independently. One overloaded bot doesn't affect others
05

WebSocket security

WebSocket connections are the backbone of botcontrol.ai. Both the dashboard-to-server and agent-to-server links go through a strict authentication handshake before any data flows. Dashboard connections verify the Firebase JWT. Agent connections verify the bot API key and skill ID. After authentication, connections are maintained with heartbeat pings to detect stale connections and prevent zombie sessions.

Auth on upgrade WebSocket upgrade requests require valid credentials — no anonymous connections
Heartbeat monitoring Ping/pong every 15 seconds detects disconnections and prevents stale sessions
Connection tagging Each connection is tagged as "dashboard" or "bot" — preventing role confusion
Automatic cleanup Disconnected sessions are cleaned up immediately. No orphaned connections
06

Infrastructure & hosting

botcontrol.ai runs entirely on Cloudflare's edge network — the same infrastructure that protects millions of websites from DDoS attacks, handles DNS for a significant portion of the internet, and provides enterprise-grade security to companies worldwide. There are no traditional servers to patch, no open ports to scan, and no SSH access to compromise.

Cloudflare Workers Serverless compute with V8 isolates — no long-running processes to exploit
DDoS protection Built-in protection from Cloudflare's global Anycast network
No server access No SSH, no open ports, no traditional attack surface. It's edge compute
Automatic updates Cloudflare handles runtime patches and security updates at the edge
07

Data handling & privacy

We store the minimum data needed to operate: your user ID, bot names, bot configurations, and API keys. Chat messages and terminal commands are relayed in real time through the Durable Object and are not persisted to disk. We don't log your commands, we don't read your terminal sessions, and we don't train AI models on your data.

Minimal data storage Only bot metadata and config in Cloudflare KV. No chat or terminal logs
Real-time relay Messages pass through in memory and are not written to persistent storage
No telemetry No analytics trackers, no third-party scripts, no behavioral tracking
Your data is yours Delete your account and all associated data is purged from KV immediately

Security best practices for operators

botcontrol.ai secures the platform. Here's how you can secure your setup.

Keep API keys secret

Never share bot API keys in public repos, logs, or screenshots. Treat them like passwords.

Use strong account passwords

Use a unique password or sign in with OAuth (Google). Enable 2FA on your Firebase account when available.

Rotate keys periodically

Regenerate bot API keys on a regular schedule, especially after team changes or suspected leaks.

Limit agent permissions

Run OpenClaw agents with least-privilege OS accounts. Don't run agents as root unless necessary.

Monitor agent activity

Check dashboard uptime and status regularly. Investigate agents that go offline unexpectedly.

Keep OpenClaw updated

Run the latest version of OpenClaw to get security patches and plugin compatibility fixes.

TLS 1.3
Firebase Auth
Cloudflare Edge
Zero Trust

Questions about security? Reach out at [email protected]

How it works

1

Sign in & create a bot

Create an account and click "Add Bot". You get a unique bot ID and install command.

2

Install the plugin

Run the one-liner on any machine with OpenClaw. Works on Linux, macOS, and Windows.

3

Control from anywhere

Your agent appears on the dashboard in real time. Chat, terminal, integrations — all ready.

Ready to take control?

Free to use. No credit card required. Set up in under 2 minutes.

Get Started