# OpenClaw Windows Hub: connecting a Windows PC to an OpenClaw gateway > The openclaw-windows-node repository ships a C# tray app, shared library, node and PowerToys extension that turn a Windows machine into an OpenClaw node. It installs from a prebuilt installer rather than a source build, and its main trade-off is that capability access is decided in three separate places. **openclaw/openclaw-windows-node** — Windows companion suite for OpenClaw - System Tray app, Shared library, Node, and PowerToys Command Palette extension. - Repository: https://github.com/openclaw/openclaw-windows-node - Stars: 2,127 · Forks: 300 - Language: C# - License: MIT - Published: 2026-08-04 · Updated: 2026-08-18 · Language: en - Canonical page: https://hysenlabs.com/projects/openclaw-openclaw-windows-node ## What the Windows companion adds to an OpenClaw gateway OpenClaw itself runs a gateway; this repository is the Windows side of that relationship. The README describes it as "the native Windows companion for OpenClaw" and frames the job in one line: connect your PC to a gateway, chat with your agents, and choose which Windows capabilities they can use. That third clause is the whole point. A gateway process cannot take a screenshot on your desktop, drive your Chromium browser, read your approximate location or speak through your speakers. A Windows node can, but only for the capabilities you switch on. The audience is therefore narrow and specific. You need an OpenClaw gateway already running, either on another machine or installed locally, and you need a reason to let an agent touch the machine in front of you. Developers who want an agent to run shell commands on their own workstation, or to capture the screen while debugging, are the obvious fit. Someone looking for a chat client with no backend has the wrong project. The repository is not a single program. Its top-level layout contains src/, tests/, docs/, an installer.iss Inno Setup script, build.ps1, run-app-local.ps1 and a solution file, openclaw-windows-node.slnx. The repository description names four deliverables: a system tray app, a shared library, a node, and a PowerToys Command Palette extension. Only the tray app is what most people will install. ## How a Windows PC becomes an OpenClaw node Node mode is a registration step, not a background service you configure by hand. The README is explicit that you "should not need to edit openclaw.json by hand" and routes everything through the tray app: open Companion Settings, connect to the gateway under Connection, complete any pending pairing approval, pick a containment policy under Sandbox, enable Node mode under Permissions, then tick the capabilities this PC should offer. Changes save automatically. Command Center is where you confirm the node is connected and clear any gateway allowlist or reapproval warnings. The trust model has more than one gate, and this is the part worth understanding before you enable anything. Permissions decides what the PC advertises. Gateway policy can still filter commands regardless of what the node offers. Local Windows checks can block a capability too, and Windows itself may prompt for consent before camera, microphone, location or screen features run. The README states plainly that the app "never silently opts into privacy-sensitive gateway commands". The capability list is concrete: system tools for shell commands and scripts, browser control for a compatible Chromium browser, camera stills and short clips, canvas for visual content in a hosted window, screen capture for screenshots and short recordings, approximate location, text-to-speech and local speech-to-text. Notifications and basic device status come along when Node mode is active. The README advises keeping privacy-sensitive capabilities off unless you intend to use them, and names camera capture, screen recording, microphone transcription, spoken output and command execution as that group. ## Installing OpenClaw Windows Hub and enabling node mode There is no source build in the normal path. The README lists two installers, one per architecture, both pulled from the latest release. Pick the one matching your machine and run it. ```bash OpenClawCompanion-Setup-x64.exe OpenClawCompanion-Setup-arm64.exe ``` The stated requirement is Windows 10 20H2 or later, or Windows 11. On first launch a setup wizard offers to install a dedicated local gateway in WSL or to connect to an existing gateway. If you have no gateway yet, the README says to choose "Install a local gateway (WSL)". Once the app is running, the tray menu is the entry point for everything. Open Companion Settings, then Connection, and pair with your gateway. Approve any pending pairing request the app shows. Then go to Sandbox and choose a containment policy before enabling anything that runs programs. The README lists the Sandbox choices as Locked Down, Recommended, Unprotected and Custom, and describes the Permissions page as where Node mode is switched on and capabilities are selected. Finish in Command Center. That page is where the app tells you whether the node is connected and whether gateway allowlist or reapproval warnings are outstanding. If you would rather not click through the tray, the README documents deep links that open the same screens, including openclaw://setup, openclaw://settings and openclaw://commandcenter, forwarded through IPC when the app is already running. ## The sandbox trade-off behind system.run System tools is the capability with the sharpest edge, because it is the one that executes programs on your machine. The Sandbox page governs programs launched through the node's system.run capability, and the README gives four settings. Locked Down blocks internet, clipboard and standard user folders. Recommended enables internet, read-only access to common folders and clipboard read access. Unprotected allows broad folder and clipboard access, and the README says to use it only when you accept the added risk. Custom controls set folder access, network access, clipboard access, timeout and output limits individually. The mechanism is MXC process isolation, and the important sentence is what happens without it. When MXC is enabled and available, the node uses it for system.run. If MXC is unavailable and strict fallback blocking is off, the README states OpenClaw can fall back to uncontained host execution for compatibility. That is a documented failure mode rather than a hypothetical one, and the Sandbox page is where the current state is shown. If you are enabling system tools on a machine with anything you care about, check that page rather than assuming containment is in force. The sandbox also covers only commands run through the Windows node; commands run directly on the gateway fall under the gateway's own controls, which this app does not govern. ## Gateway allowlists, reapproval, and where the app stops managing Permissions is not the last word. The README describes a two-layer arrangement: the node advertises a set of capabilities, and the gateway holds an allowlist of commands it will accept. The app can edit that allowlist through Advanced > Config, a schema-guided editor for the connected gateway's configuration, but the README also covers the case where the gateway is managed elsewhere. In that situation you edit its configuration with your own tooling, preserve existing entries, and add only the exact commands you need. The allowlist shape the README shows is a JSON array under gateway.nodes.allowCommands, with entries such as system.notify, canvas.present, canvas.hide, screen.snapshot, device.info and device.status. Two details matter. Wildcards such as canvas.* are not expanded, so you list commands individually. And paired Windows nodes already receive desktop system.* defaults including system.run, system.run.prepare and system.which, while commands outside that set, including screen.record, camera.snap, camera.clip, stt.transcribe and tts.speak, require deliberate gateway opt-in. After you change gateway command policy, the README says to approve any pending-reapproval request shown by the app and reconnect the node. Skipping that step is the most likely reason a capability looks enabled in the tray but does nothing when an agent calls it. The Command Center page is built for exactly this, offering copyable repair commands for the safe capabilities. ## Where OpenClaw Windows Hub is the wrong choice The clearest limitation is the dependency. This is a companion, not a product that stands alone. Without a reachable gateway there is no agent to serve, and the fallback the README offers is installing a local gateway in WSL, which means a second runtime on the same machine before the tray app does anything useful. If you wanted a self-contained Windows assistant, this is not it. Platform constraints follow from that. The installer targets Windows 10 20H2 or later and Windows 11, with separate x64 and ARM64 builds; there is no documented Linux or macOS path, and no source build is required or described in the README's install section. Headless machines are a poor fit too, since several capabilities are tied to a desktop session, a visible Chromium browser, or a hosted canvas window. The trust model is the other reason to hesitate. Enabling system tools on a workstation means agent-run programs execute under a policy you select, and the README itself notes that containment can degrade to uncontained host execution when MXC is unavailable. If you cannot accept that possibility on a given machine, leave system tools off there and use the node for read-only capabilities such as device.info and screen.snapshot instead. ## Alternatives and the difference in approach The most direct comparison is running the OpenClaw gateway itself on the Windows machine, which is the option the setup wizard offers through WSL. That approach puts the gateway and its security controls in one place, and commands executed there fall under the gateway's controls rather than the node sandbox. The trade-off is that a WSL gateway does not have native access to your Windows desktop, so camera, screen capture, location and text-to-speech are not available the way they are through the node. Choose the WSL route when you want command execution and nothing tied to the desktop; choose the node when the desktop capabilities are the reason you are here. The second alternative is a general-purpose remote agent that runs on Windows and exposes its own tool interface. Those tools typically own their own permission model end to end, which is simpler to reason about than the three-way split here between Permissions, gateway policy and local Windows checks. What they do not give you is the OpenClaw pairing and allowlist model, where a paired node receives a defined default command set and everything outside it needs explicit gateway opt-in. If you are already invested in an OpenClaw gateway, that model is the reason to use this app rather than bolting on a separate agent. ## Maintenance, licence and upgrade cost The repository is not archived, and the last push was on 2026-08-29. The release list shows v2026.7.1-2 on 2026-08-29, v2026.7.2-alpha.19 on 2026-08-20 and v2026.7.1 on 2026-08-11, so the project ships tagged builds alongside alpha versions. The README states that the app performs background updates from GitHub Releases, which means upgrades arrive through the app rather than a manual reinstall. Version numbering is handled by GitVersion.yml at the repository root, and a global.json pins the .NET SDK, so anyone building from source is working against a fixed toolchain rather than whatever is installed. The licence is MIT. That is permissive and short, and it is the licence identifier given for this repository; it says nothing about the OpenClaw gateway, which is a separate project with its own terms. If you plan to redistribute the installer or bundle the shared library into another product, read the LICENSE file and the gateway's licence rather than assuming one covers the other. This is a description of what the files state, not legal advice. There is a build-time dependency worth noting for anyone compiling rather than installing. The root package.json is private and exists to pull in @microsoft/mxc-sdk at ^0.8.0, described there as the MXC sandbox dependency used by the tray build to copy wxc-exec.exe into the app output. That is the same component the Sandbox page reports on at runtime, so the containment story is tied to a package dependency rather than to Windows itself. ## Conclusion Adopt OpenClaw Windows Hub if you already run an OpenClaw gateway and want a Windows PC to expose shell, browser, camera or speech capabilities under explicit switches. Do not adopt it as a standalone assistant: without a gateway the node has nothing to talk to, and the README points first-time users at the WSL local gateway option. Before enabling anything privacy-sensitive, verify three things in the app: the Connection page shows no pending pairing or reapproval request, the Permissions page lists only the capabilities you intend to advertise, and the Sandbox page reports whether MXC process isolation is actually available on that machine, because the README states OpenClaw can fall back to uncontained host execution when MXC is missing and strict fallback blocking is off. ## FAQ ### How do I add a node in OpenClaw? Install OpenClaw Companion, open Companion Settings from the tray menu, and connect to your gateway under Connection, completing any pending pairing approval. Then open Permissions, turn on Node mode, and tick the capabilities this PC should offer. Finish in Command Center to confirm the node is connected and to clear any allowlist or reapproval warnings. ### What does OpenClaw do? The README describes OpenClaw as the system this Windows app is a companion to, and the app's stated job is to connect your PC to a gateway, chat with your agents, and choose which Windows capabilities they can use. The gateway is the part that runs the agents; this repository supplies the Windows side. ### Can OpenClaw be self-hosted? The setup wizard offers to install a dedicated local gateway in WSL, and the README tells users without a gateway to choose "Install a local gateway (WSL)". That is the documented self-hosted path on Windows. The README also covers connecting the companion to an existing gateway instead. ### Is OpenClaw AI free? The README does not state pricing for OpenClaw or for the gateway. The repository itself is MIT licensed, and the installer is distributed through GitHub Releases, but nothing in the README addresses the cost of the gateway or of any model it uses. ## Sources - [Official README](https://github.com/openclaw/openclaw-windows-node#readme) - [Project repository](https://github.com/openclaw/openclaw-windows-node) - [Release notes](https://github.com/openclaw/openclaw-windows-node/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/openclaw-openclaw-windows-node