M
MoltPulse
openclaw-dashboard (tugcantopaloglu/openclaw-dashboard) | MoltPulse
openclaw-dashboard π Secure, real-time monitoring dashboard for OpenClaw AI agents. Auth, TOTP MFA, cost tracking, live feed, memory browser and more.
Based on repository activity, growth velocity and community engagement.
27
β‘ Live Feed - Real-time stream of agent messages across all sessions
π§ Memory Viewer - Browse and read agent memory files (MEMORY.md, HEARTBEAT.md, daily notes)
π Files Manager - View and edit workspace files, skills, and configs with security hardening
π System Health - CPU, RAM, disk, temperature monitoring with sparklines
π Service Control - Quick actions to restart OpenClaw, dashboard, or other services
π Log Viewer - Real-time system logs with auto-refresh
β° Cron Management - View, enable/disable, and manually trigger cron jobs
π Tailscale Integration - View Tailscale status, IP, and connected peers
π― Activity Heatmap - Visualize peak usage hours over the last 30 days
π₯ Streak Tracking - Monitor daily activity streaks
π Session Search & Filtering - Filter by status, model, date range with live search
π¨ Dark/Light Theme - Toggle between dark and light modes with persistent preference
β¨οΈ Keyboard Shortcuts - Navigate quickly with hotkeys (1-7, Space, /, Esc, ?)
π± Mobile Responsive - Works on phones and tablets
π Browser Notifications - Get alerted when usage limits are approaching
π Timeline View - Visual timeline of session activity
πΎ Git Activity - Track recent commits across your repos
ποΈ Claude Usage Scraper - Fetch real usage data from Claude Code CLI
π· Gemini Usage Tracking - Monitor Google Gemini model usage with per-model breakdowns
π Provider Switching - Toggle between Claude and Gemini usage on the overview card
π Per-Model Selector - Choose which model/window to display (Opus, Sonnet, Pro, Flash, etc.)
π Auto-Refresh - Live data updates every 5 seconds
π Lifetime Stats - Total tokens, messages, cost since first session
π Health History - 24-hour CPU, RAM, temperature, and disk usage sparklines
π― Quick Actions - One-click system maintenance (updates, cleanup, restarts)
π macOS Compatible - Full support for macOS system stats, services, and memory reporting
π‘οΈ System Security Dashboard - UFW rules, open ports, fail2ban, SSH logs, security audit (requires re-authentication)
βοΈ Config Editor - Edit OpenClaw configuration with JSON validation, auto-backup, and gateway restart (requires re-authentication)
π³ Docker Management - View containers, images, system usage; start/stop/restart containers; prune unused resources
π Notification Center - Audit log event feed with unread badge counter (login, config changes, security events)
π Username/Password Auth - Secure registration with PBKDF2 password hashing
π TOTP MFA - Optional two-factor authentication (Google Authenticator compatible)
πΎ Remember Me - Session-only or 3-hour persistent login
π‘οΈ Security Hardened - HSTS, CSP, rate limiting, timing-safe comparisons, audit logging
π¦ Minimal Dependencies - Pure Node.js, no database or npm packages required. Optional: jq (Docker page), tmux + python3 (Claude CLI usage scraper), docker (Docker management)
π Quick Start # Clone the repository
git clone https://github.com/tugcantopaloglu/openclaw-dashboard.git
cd openclaw-dashboard
# Set your OpenClaw workspace path (optional, auto-detects if not set)
export WORKSPACE_DIR=/path/to/your/openclaw/workspace
# Start the dashboard
node server.js
Visit http://localhost:7000 in your browser. On first visit, you'll see a registration screen where you create your username and password. After registration, log in with your credentials.
π¦ Installation
Prerequisites
Node.js v18 or higher (check with node --version)OpenClaw installed and runningSystemd (optional, for service installation on Linux)
Optional dependencies | Tool | Required for | Install |
|------|-------------|---------|
| jq | Docker management page | sudo apt install jq |
| tmux | Claude CLI usage scraper | sudo apt install tmux |
| python3 | Claude CLI usage parser | Usually pre-installed |
| docker | Docker management page | docs.docker.com |
Manual Install
Clone the repository
git clone https://github.com/tugcantopaloglu/openclaw-dashboard.git
cd openclaw-dashboard
Configure environment (optional)
export DASHBOARD_PORT=7000
export WORKSPACE_DIR=/path/to/your/workspace
export OPENCLAW_DIR=$HOME/.openclaw
export OPENCLAW_AGENT=main
Start the server
node server.js
The server will print:
π Dashboard running on http://localhost:7000
π Recovery token: abc123def456...
Save the recovery token β you'll need it if you forget your password.
Access the dashboard
Open http://localhost:7000 and register your account.
Systemd Service (install.sh) To run the dashboard as a system service with auto-start and crash recovery:
Create /etc/systemd/system/agent-dashboard.service
Create override config at /etc/systemd/system/agent-dashboard.service.d/override.conf
Enable and start the service
Set your workspace path and generate a recovery token
journalctl -u agent-dashboard -f
Docker # Build
docker build -t openclaw-dashboard .
# Run
docker run -d \
--name openclaw-dashboard \
-p 3001:3001 \
-e WORKSPACE_DIR=/app/workspace \
-e DASHBOARD_ALLOW_HTTP=true \
-v ~/.openclaw:/home/node/.openclaw:ro \
-v ~/.openclaw/workspace:/app/workspace \
openclaw-dashboard
For Docker management page access, pass the Docker socket:
docker run -d \
--name openclaw-dashboard \
-p 3001:3001 \
-e WORKSPACE_DIR=/app/workspace \
-e DASHBOARD_ALLOW_HTTP=true \
-v ~/.openclaw:/home/node/.openclaw:ro \
-v ~/.openclaw/workspace:/app/workspace \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
--group-add $(stat -c '%g' /var/run/docker.sock) \
openclaw-dashboard
Environment Variables | Variable | Description | Default |
|----------|-------------|---------|
| DASHBOARD_PORT | Server port | 7000 |
| DASHBOARD_TOKEN | Recovery token for password reset | Auto-generated on startup |
| WORKSPACE_DIR | OpenClaw workspace path | $OPENCLAW_WORKSPACE or current directory |
| OPENCLAW_DIR | OpenClaw config directory | ~/.openclaw |
| OPENCLAW_AGENT | Agent ID to monitor | main |
| DASHBOARD_ALLOW_HTTP | Allow HTTP from non-local IPs | false |
# Custom port
DASHBOARD_PORT=8080 node server.js
# Custom recovery token
DASHBOARD_TOKEN=my_secret_token_12345 node server.js
# Different workspace
WORKSPACE_DIR=/mnt/data/openclaw node server.js
π Authentication The dashboard uses username and password authentication with secure server-side sessions.
First-Time Registration
Visit the dashboard URL (e.g., http://localhost:7000)
You'll see a registration screen
Choose a username and password
Click Register
Log in with your new credentials
Login
Enter your username and password
Optionally check "Remember me" to stay logged in for 3 hours (uses localStorage)
Without "Remember me", your session lasts only until you close the browser (uses sessionStorage)
Password Security
PBKDF2 hashing β 100,000 iterations with SHA-512Random salt β Unique per passwordServer-side sessions β Passwords never stored in browser, only session tokensTiming-safe comparisons β Prevents timing attacks on password verification
Rate Limiting To prevent brute-force attacks:
5 failed login attempts β 15-minute soft lockout20 failed login attempts β Hard lockout (requires service restart)Rate limits are in-memory and reset when the service restarts
π Multi-Factor Authentication (MFA) Add an extra layer of security with time-based one-time passwords (TOTP).
Enabling MFA
Log in to the dashboardGo to the Security page (sidebar)
Click "Enable MFA"
A QR code appears β scan it with your authenticator app:
Google Authenticator (iOS, Android)
Authy (iOS, Android, Desktop)
Microsoft Authenticator (iOS, Android)
1Password, Bitwarden, or any TOTP-compatible app
Enter the 6-digit code shown in your app to verify
MFA is now active! π
Using MFA Once enabled, every login requires:
Your username and password (as usual)
A 6-digit TOTP code from your authenticator app
Codes refresh every 30 seconds
The dashboard accepts codes with Β±1 window tolerance for clock drift (30 seconds before/after)
Disabling MFA
Go to the Security page
Click "Disable MFA"
Enter your current 6-digit TOTP code to confirm
MFA is now disabled
Resetting MFA (if locked out) If you lose access to your authenticator app (lost phone, uninstalled app, etc.):
SSH into your server Run this command to clear the MFA secret:
node -e "const fs=require('fs');const c=JSON.parse(fs.readFileSync('/root/clawd/data/credentials.json','utf8'));delete c.mfaSecret;fs.writeFileSync('/root/clawd/data/credentials.json',JSON.stringify(c,null,2));console.log('MFA cleared')"
Restart the dashboard :
systemctl restart agent-dashboard
Log in with just your username and password
Re-enable MFA with a new QR code
Important: Adjust the path /root/clawd/data/credentials.json if your workspace is elsewhere.
π Password Recovery
Forgot Password? If you forget your password:
Click "Forgot password?" on the login screen
Enter your recovery token (see "Finding Your Recovery Token" below)
Set a new password
Log in with your new password
Finding Your Recovery Token The recovery token (DASHBOARD_TOKEN) is printed when the server starts. You can find it in several places:
Check Server Startup Logs journalctl -u agent-dashboard | grep "Recovery token"
π Recovery token: 3e6b91f352418b486a9aa9d82fbbc1b1
Check Systemd Override Config cat /etc/systemd/system/agent-dashboard.service.d/override.conf
Environment=DASHBOARD_TOKEN=3e6b91f352418b486a9aa9d82fbbc1b1
Check Environment Variable
Changing Your Password To change your password while logged in:
Go to the Security page
Enter your current password
Enter your new password
Click "Change Password"
All other sessions are invalidated (you'll need to log in again elsewhere)
Complete Account Reset (Nuclear Option) If everything is locked and you can't log in:
SSH into your server Delete the credentials file :
rm /root/clawd/data/credentials.json
Restart the dashboard :
systemctl restart agent-dashboard
Visit the dashboard β the registration screen appearsCreate a new account from scratch Warning: This deletes your username, password, and MFA settings. Memory files and audit logs are not affected.
π‘οΈ Security Features The dashboard is built with security best practices:
PBKDF2 password hashing β 100,000 iterations, SHA-512, random saltTiming-safe comparisons β Prevents timing attacks on token/password verificationServer-side sessions β Session tokens stored in memory, passwords never sent to browserRate limiting β Unified rate limiter for login attempts (5 soft / 20 hard lockout)HTTPS enforcement β HTTP blocked except from localhost and Tailscale (100.64.0.0/10)Security headers :
HSTS β Force HTTPS on future visitsCSP β Content Security Policy (no inline scripts, same-origin)X-Frame-Options: DENY β Prevent clickjackingX-Content-Type-Options: nosniff β Prevent MIME sniffingX-XSS-Protection: 1; mode=block β Legacy XSS protection
Audit logging β All auth events and destructive actions logged to data/audit.logCORS β Same-origin only, no wildcard (*) allowedInput validation :
Service whitelist for logs and actions
Path traversal protection for file access
Payload size limits (1MB max)
Automatic backups β .bak files created before overwriting workspace files
π Network Security The dashboard is designed for local or Tailscale access :
Recommended Access Methods
Localhost β Access from the same machine: http://localhost:7000Tailscale β Access from your Tailscale network: http://100.x.x.x:7000
Tailscale provides automatic TLS encryption (MagicDNS + HTTPS)
Tailscale IPs (100.64.0.0 to 100.127.255.255) are exempt from HTTPS enforcement
Local network β Access from LAN (use HTTPS or set DASHBOARD_ALLOW_HTTP=true)
HTTPS Enforcement By default, the dashboard blocks HTTP access from non-local IPs. Exemptions:
Localhost (127.0.0.1, ::1)Tailscale IPs (100.64.0.0/10) For other networks, the dashboard requires HTTPS or the X-Forwarded-Proto: https header (from a reverse proxy).
To allow HTTP from all IPs (not recommended):
DASHBOARD_ALLOW_HTTP=true node server.js
Don't Expose to Public Internet This dashboard is NOT hardened for public internet exposure. While it has authentication and rate limiting, it's designed for private networks. If you must expose it:
Use a reverse proxy (nginx, Caddy) with HTTPS
Add IP allowlisting
Consider VPN (Tailscale, WireGuard) instead
π οΈ Troubleshooting
"Too many failed attempts" Problem: You see "Too many failed login attempts. Please try again later."
Can't log in after password change Problem: Your password was changed but you can't log in.
Solution: Use the "Forgot password?" flow with your recovery token to set a new password.
MFA code not working Problem: The 6-digit TOTP code is rejected.
Ensure your phone's clock is synchronized :
iOS: Settings β General β Date & Time β Set Automatically
Android: Settings β System β Date & Time β Automatic date & time
TOTP codes have Β±30 second tolerance for clock drift
Try entering the next code (wait 30 seconds for it to refresh)
If still failing, reset MFA via SSH (see "Resetting MFA" section)
Dashboard not loading Problem: Browser shows a blank page or connection error.
Check service status :
systemctl status agent-dashboard
Check logs :
journalctl -u agent-dashboard -n 50
Verify port :
curl http://localhost:7000/api/auth/status
{"authenticated": false, "requiresRegistration": false}
"HTTPS required" error Problem: Browser shows "HTTPS required. Access via localhost, Tailscale, or enable HTTPS."
Blank page after update Problem: Dashboard shows a blank page after pulling new code.
Hard refresh : Ctrl+Shift+R (Windows/Linux) or Cmd+Shift+R (macOS)Clear browser cache for the dashboard URLCheck browser console (F12 β Console tab) for JavaScript errors
π‘ API Reference The dashboard exposes a REST API for programmatic access. All endpoints require authentication via Authorization: Bearer <sessionToken> header.
Unauthenticated Endpoints
GET /api/auth/status β Check authentication statusPOST /api/auth/login β Log in with username/password (+ TOTP if MFA enabled)POST /api/auth/register β Register a new account (only if no credentials exist)POST /api/auth/reset-password β Reset password with recovery token
Authenticated Endpoints All other endpoints require authentication:
GET /api/config β Dashboard configurationGET /api/sessions β List all agent sessionsGET /api/usage β 5-hour rolling window usage dataGET /api/costs β Spending data by day, model, and sessionGET /api/system β System health metricsGET /api/memory-files β List memory filesGET /api/memory-file?path=<path> β Read a memory fileGET /api/key-files β List workspace files (skills, configs)GET /api/key-file?path=<name> β Read a workspace filePOST /api/key-file β Write to a workspace file (with backup)GET /api/crons β List cron jobsPOST /api/cron/<id>/toggle β Enable/disable a cron jobPOST /api/cron/<id>/run β Manually trigger a cron jobGET /api/logs?service=<service>&lines=<N> β Fetch system logsPOST /api/action/<action> β Run quick actions (restart-openclaw, restart-dashboard, etc.)POST /api/claude-usage-scrape β Trigger Claude usage scrapeGET /api/claude-usage β Get last scraped Claude usagePOST /api/gemini-usage-scrape β Trigger Gemini usage scrapeGET /api/gemini-usage β Get last scraped Gemini usageGET /api/live β Server-Sent Events stream of real-time messagesGET /api/notifications?limit=<N> β Audit log events for notification centerPOST /api/reauth β Re-authenticate for sensitive pages (Security, Config)GET /api/openclaw-config β Read OpenClaw configuration filePUT /api/openclaw-config β Save config with auto-backup and gateway restartGET /api/sys-security β System security info (UFW, ports, fail2ban, SSH logs)GET /api/docker β List Docker containers, images, and system usagePOST /api/docker/action β Docker actions (start/stop/restart container, prune)GET /api/services β List systemd servicesPOST /api/services/action β Service actions (start/stop/restart, whitelisted only) For detailed request/response examples, see the previous version of this README or explore the API in the browser's Network tab.
π Data Files The dashboard stores data in your workspace directory:
| File | Purpose |
|------|---------|
| data/credentials.json | Username + hashed password + MFA secret |
| data/audit.log | Security audit trail (auto-rotates at 10MB) |
| data/health-history.json | CPU/RAM/Temp/Disk history for sparklines |
| data/claude-usage.json | Last scraped Claude usage data |
| data/gemini-usage.json | Last scraped Gemini usage data |
Credentials file structure:
{
"username": "admin",
"passwordHash": "pbkdf2_sha512$100000$...",
"salt": "...",
"mfaSecret": "BASE32SECRET..." // Only if MFA enabled
}
π OpenClaw Integration The dashboard automatically detects:
Sessions from $OPENCLAW_DIR/agents/$AGENT_ID/sessions/Cron jobs from $OPENCLAW_DIR/cron/jobs.jsonMemory files from $WORKSPACE_DIR/MEMORY.md, HEARTBEAT.md, and memory/*.mdGit repos from $WORKSPACE_DIR/projects/*/Health data saved to $WORKSPACE_DIR/data/health-history.json
Required Files The dashboard works best when these files exist:
$WORKSPACE_DIR/MEMORY.md - Agent long-term memory$WORKSPACE_DIR/HEARTBEAT.md - Heartbeat task list$WORKSPACE_DIR/memory/YYYY-MM-DD.md - Daily memory notes$WORKSPACE_DIR/scripts/scrape-claude-usage.sh - Claude usage scraper$WORKSPACE_DIR/scripts/parse-claude-usage.py - Claude usage parser$WORKSPACE_DIR/scripts/scrape-gemini-usage.sh - Gemini usage scraper$WORKSPACE_DIR/scripts/parse-gemini-usage.py - Gemini usage parser
β¨οΈ Keyboard Shortcuts | Key | Action |
|-----|--------|
| 1 | Switch to Overview |
| 2 | Switch to Sessions |
| 3 | Switch to Costs |
| 4 | Switch to Rate Limits |
| 5 | Switch to Memory |
| 6 | Switch to Files |
| 7 | Switch to Live Feed |
| 8 | Switch to Logs |
| 9 | Switch to Security |
| Space | Pause/Resume Feed (when on Live Feed page) |
| / | Focus search box |
| Esc | Close modals and overlays |
| ? | Show keyboard shortcuts help |
π€ Contributing Contributions are welcome! Please follow these guidelines:
Fork the repositoryCreate a feature branch (git checkout -b feature/amazing-feature)Commit your changes (git commit -m 'Add amazing feature')Push to the branch (git push origin feature/amazing-feature)Open a Pull Request
Development Setup git clone https://github.com/tugcantopaloglu/openclaw-dashboard.git
cd openclaw-dashboard
export WORKSPACE_DIR=/path/to/test/workspace
node server.js
The dashboard has no build step β edit server.js or index.html and reload.
Code Style
No comments in code (self-documenting)Brief and direct function names
π License MIT License - see LICENSE file for details.
π Acknowledgments
π Support
Ecosystem Role Standard MoltPulse indexed agent.
Show off your Pulse Score in your GitHub README to build trust and rank higher.
[](https://molt-pulse.com/agents/tugcantopaloglu/openclaw-dashboard)
Copy 
| 
| 
|
| 
| 
|