OpenClaw Mac App Setup: Host It On Hyperbox

The OpenClaw Mac app is a menu-bar companion for OpenClaw on macOS. It is not just a prettier installer and it is not a replacement for the Gateway. It sits at the macOS boundary: where permissions, local desktop tools, remote Gateway connection, and operator settings have to become native.

• It connects to a local Gateway or a remote Gateway, including a discovered host such as hyperbox.local.
• It owns macOS permission prompts for Accessibility, Automation, Screen Recording, Notifications, Microphone, Speech Recognition, Camera, and related system surfaces.
• It exposes the Mac as an OpenClaw node with local capabilities such as screen, camera, Canvas, notifications, and controlled command execution.
• It includes settings for channels, skills, local model preferences, exec approvals, Canvas, Camera, Peekaboo Bridge, and debug tools.
• It registers the app with macOS so OpenClaw can feel like a native resident agent companion instead of a terminal-only service.

The welcome screen is doing useful work. It frames the Mac app as a native helper that can connect outward to a Gateway, not as a black box that silently takes over your machine. That matters because OpenClaw can be granted serious local powers: screen, microphone, camera, automation, and shell execution.

This is the most important setup decision. Local mode makes the Mac in front of you the Gateway host. Remote mode connects the Mac app to a Gateway running somewhere else. For a serious always-on assistant, remote mode is usually the better shape: the Gateway lives on a stable Mac mini, while your laptop or desktop can still join as a node when needed.

The remote check is where OpenClaw stops being abstract. The app is not merely asking for a URL. It is validating that it can reach the Gateway host and establish the path it needs. If SSH host key verification fails, the app shows the failing command output instead of hiding it behind a generic connection error.

# The app suggested this cleanup when a stale SSH key was suspected.
ssh-keygen -R hyperbox.local

# Then retry the remote connection check from OpenClaw.app.

The Advanced section is for setups that should not depend on automatic discovery alone. If you are connecting across Tailscale, using a direct ws:// or wss:// endpoint, or separating the Gateway token from the initial discovery flow, this is where those details belong.

• Use SSH tunnel mode when the Gateway should stay private and the Mac app should reach it through SSH.
• Use direct ws or wss only when the network path and authentication model are intentional.
• Keep the Gateway token out of screenshots, shared docs, and shell history.
• Prefer private DNS, LAN, or Tailscale names over exposing the Gateway to the public internet.

This is where the Mac app earns its keep. Browser apps and headless services cannot cleanly own every macOS TCC prompt. OpenClaw.app can guide the operator through the native permission surfaces and then expose those capabilities to the Gateway as node tools.

The all-set screen is a good checklist for what OpenClaw thinks a complete Mac install can become. It is not only about getting a process running. It is about having a reachable Gateway, a menu-bar operator panel, useful channels, voice and Canvas options, and a skill surface the assistant can actually use.

1. Confirm the Gateway is reachable from the Mac app.
2. Confirm the app appears in the menu bar and can reopen settings.
3. Grant only the permissions needed for the current node role.
4. Connect one low-risk channel before adding production credentials.
5. Run one simple request and inspect the resulting logs or session state.

Settings make the app feel less like an installer and more like a control station. You can decide whether OpenClaw launches at login, whether it shows a Dock icon, whether Canvas and Camera are enabled, and whether local debugging tools should be exposed.

The Mac app and Hyperbox solve different halves of the same problem. The app gives OpenClaw a native macOS control surface. Hyperbox gives OpenClaw a Mac that stays online, keeps state on local disk, accepts SSH and VNC recovery, and can run desktop workflows without depending on your personal laptop being open.

1. Provision the Hyperbox Mac mini that will own the OpenClaw runtime.
2. Install the required Node version and OpenClaw CLI on the Hyperbox Mac.
3. Run OpenClaw onboarding and install the Gateway as a launchd service.
4. Keep OPENCLAW_STATE_DIR on local disk, normally ~/.openclaw.
5. Enable SSH and VNC recovery before connecting production channels.
6. Install OpenClaw.app where you want the native control surface, then connect it to the Hyperbox Gateway.
7. Grant Screen Recording, Accessibility, Automation, Microphone, Speech Recognition, Camera, and Notifications on the Mac that will perform those tasks.
8. Run one small end-to-end request, inspect logs, restart the Gateway, and confirm the Mac app reconnects.

Local Mac:
  OpenClaw.app
  menu-bar operator surface
  optional local node capabilities

Private route:
  LAN DNS, Tailscale, direct wss, or SSH tunnel

Hyperbox Mac mini:
  OpenClaw Gateway
  launchd service
  ~/.openclaw state
  dedicated macOS user
  browser profile
  SSH + VNC recovery

This gives you a clean failure model. If the laptop closes, the Gateway keeps running. If the Gateway needs recovery, you SSH or VNC into the Hyperbox Mac. If a workflow needs a local desktop permission, you grant that permission on the node that will actually perform the work.

You do not need a hosted Mac mini for every OpenClaw install. A laptop is fine for exploration. A small VPS can be fine for message-first work that never touches macOS. Hyperbox fits when OpenClaw depends on macOS state, desktop permissions, or background reliability.

• Verify the Mac app download from the official OpenClaw release or docs path.
• Install the CLI and Gateway on the Mac that will own the runtime.
• Run openclaw doctor after install or upgrade.
• Record your Gateway URL, token flow, package manager, Node version, state path, and channel config before changing hosts.
• Keep ~/.openclaw, logs, channel credentials, and agent workspace data on the runtime Mac.
• Configure exec approvals before granting broad shell or desktop workflows.
• Grant macOS permissions only on the machines that need each capability.
• Test Dashboard access, remote connection, logs, sessions, cron, nodes, and one agent request before leaving the setup unattended.
• Keep SSH and VNC access available for recovery if the app, Gateway, or node host gets stuck.

What is the OpenClaw Mac app?

The OpenClaw Mac app is a macOS menu-bar companion. It owns native permissions, runs or connects to the Gateway, exposes macOS node capabilities, opens the Control UI, and registers the openclaw:// deep-link scheme.

Does the OpenClaw Mac app replace hosting?

No. The Mac app improves the native control surface and permission story. Long-running OpenClaw workflows still need a runtime machine that stays awake, keeps logs, preserves browser and desktop state, and can be recovered remotely.

What is the best host for OpenClaw with the Mac app?

Use your laptop for testing. Use a persistent Mac such as Hyperbox when OpenClaw needs background reliability, desktop apps, browser profiles, Messages, Mail, Xcode, SSH, VNC, screen access, or GUI automation.