Manage your Linux and Windows servers from OpenClaw using natural language. 33 tools to run tasks and scans, search your fleet and act on cloud VMs. Works with any LLM model.
OpenClaw is an open-source personal AI assistant that runs locally. The ManageLM plugin gives it the same tools ManageLM gives Claude through MCP, so you can manage your entire server infrastructure in natural language with any LLM model (Claude, GPT, Gemini, Llama, and more).
You describe what you need in plain English. OpenClaw selects the right tool, sends the instruction to the agent running on your server via the ManageLM portal, and returns the result.
Modelled on the ManageLM MCP tools, with a managelm_ prefix: tasks, scans, fleet searches, hosting actions, task history and revert.
Works with Claude, GPT, Gemini, Llama, or any model supported by OpenClaw. Tools are model-agnostic.
When an agent needs a domain name, a password or a choice, OpenClaw asks you and answers the task.
Security, inventory, access, certificate and activity scans run on a server and return their result.
Inventory, security issues, logins, SSH keys, sudo rules, certificates, monitors, backups, credentials, keystore and cloud resources, without dispatching commands.
Signed ManageLM events logged in the gateway: servers going offline, failed tasks, monitors down, certificate renewals and more.
The plugin communicates with the ManageLM portal via REST API. The portal dispatches tasks to agents over WebSocket. Agents execute tasks using a local LLM and report results back. No SSH, no inbound ports on your servers.
openclaw plugins install managelm
Download the tarball from GitHub Releases and install locally:
openclaw plugins install managelm-openclaw-1.0.0.tar.gz
The plugin uses an API key for authentication. Configure it via the OpenClaw CLI:
Set your API Key, created in your ManageLM portal under Settings > MCP & API > API Keys. The key acts as you, limited to the authorizations you tick: add Reports for scans, Hosting for VM actions, Credentials or Keystore to search those.
Trust the plugin: openclaw config set plugins.allow '["managelm"]'
Enable tools: openclaw config set tools.allow '["managelm"]' and openclaw config set tools.profile "full"
Restart the gateway and start a fresh session
# Set API key openclaw config set plugins.entries.managelm.config.apiKey "mlm_ak_your_key" # Trust plugin and enable tools openclaw config set plugins.allow '["managelm"]' openclaw config set tools.allow '["managelm"]' openclaw config set tools.profile "full" # Restart gateway openclaw gateway stop openclaw gateway
Self-hosted users: Set the Portal URL to your own portal address: openclaw config set plugins.entries.managelm.config.portalUrl "https://portal.example.com"
The plugin provides 33 tools, modelled on the ManageLM MCP tools. Tasks and scans run on one server at a time. Approving agents, users, API keys and webhooks are managed in the portal.
| Tool | Description |
|---|---|
managelm_search_agents | Servers by status, group, site, health metrics or text |
managelm_get_agent_info | One server: OS, health, skills, recent tasks |
managelm_get_agent_skills | Skills assigned to a server |
managelm_list_available_skills | Catalog skills not yet imported |
managelm_get_account_info | Account, groups and sites |
managelm_list_team_members | Team members with role, permissions and SSH key status |
| Tool | Description |
|---|---|
managelm_run_task | Run a skill-based task on one server (auto lets the agent pick the skill) |
managelm_answer_task | Answer a task waiting for input |
managelm_follow_up_task | Continue the conversation of a completed task |
managelm_get_task_status | Status and result of a task |
managelm_get_task_history | Recent tasks on a server, optionally within a time range |
managelm_get_task_changes | Files changed by a task, with an optional full diff |
managelm_revert_task | Undo the file changes of a task |
A task waits up to 2 minutes. A longer one returns its task ID, and OpenClaw checks it later with managelm_get_task_status.
| Tool | Description |
|---|---|
managelm_run_security_audit | Security audit (SSH, firewall, ports, users, TLS, kernel) |
managelm_run_inventory_scan | Inventory scan (services, packages, containers, network, storage) |
managelm_run_access_scan | SSH authorized keys and sudo rules, or Windows local accounts |
managelm_run_certificate_scan | Certificate discovery (metadata only, never private keys) |
managelm_run_activity_scan | Logins, failed logins, sudo commands and file changes over the last 24 hours |
| Tool | Description |
|---|---|
managelm_search_inventory | Services, packages and containers across servers |
managelm_search_security | Security issues from audits, pentests and threat alerts |
managelm_search_activity | Logins, failed logins, sudo commands and file changes |
managelm_search_ssh_keys | SSH keys mapped to your team members |
managelm_search_sudo_rules | Sudo rules and Windows administrators |
managelm_search_certificates | Certificates found on servers: expired, expiring, weak, self-signed |
managelm_search_pki | Certificates ManageLM issues and renews |
managelm_search_monitors | Monitors with their current status |
managelm_search_backups | Backups with their last run |
managelm_search_credentials | Rotating credentials (metadata only, requires the Credentials authorization) |
managelm_search_keystore | Keystore keys, applications and usage (metadata only, requires the Keystore authorization) |
| Tool | Description |
|---|---|
managelm_list_connectors | Hosting connectors with sync status |
managelm_search_cloud | VMs, volumes, networks and security groups discovered by connectors |
managelm_get_cloud_info | One resource and the actions its connector allows |
managelm_cloud_action | Start, shut down, reboot or snapshot a VM. Disruptive actions need your confirmation. |
When using managelm_run_task, you specify a skill that determines what the agent can do. OpenClaw reads the skills assigned to the server with managelm_get_agent_skills, or passes auto to let the agent choose. Common skills:
| Skill | Description |
|---|---|
base | Read files, system info, resource monitoring, network diagnostics |
system | OS config, performance tuning, hostname, timezone, kernel parameters |
packages | Install, remove and update packages |
services | Services, processes and scheduled tasks |
users | User accounts, groups, SSH keys, sudo, password policies |
network | Interfaces, routes, DNS, ports, connectivity testing |
security | Hardening, fail2ban, SSH, SELinux/AppArmor |
files | Read, write and manage files |
firewall | iptables, nftables, firewalld, ufw, Windows Firewall |
containers | Docker, Podman, Compose and Kubernetes |
webserver | Apache, Nginx, IIS: virtual hosts, reverse proxy, TLS |
database | MySQL, MariaDB, PostgreSQL, SQL Server |
certificates | Let's Encrypt, self-signed, inspection, renewal |
backup | Create, schedule, restore and verify backups |
storage | Disks, volumes, partitions, LVM, encryption |
dns / vpn | DNS servers, VPNs and tunnels |
The full catalog also covers Active Directory, email, LDAP, monitoring, proxies, virtualization and more. managelm_list_available_skills lists the ones not yet imported into your account.
Tip: You don't need to know skill names. Just describe what you want, "install nginx on web-01", and the LLM will select the right skill automatically.
Open the OpenClaw TUI and type your request naturally:
# Server overview list my servers which servers have CPU above 80%? # System administration check disk usage on web-prod-01 list running services on lb-01 # Package management install nginx on web-prod-01 update all packages on db-primary # Security run a security audit on db-primary show me all critical security findings # Infrastructure search search inventory for postfix who has SSH access to production servers? show all NOPASSWD sudo rules who logged in to db-primary yesterday? which certificates expire this month?
Optionally receive real-time events from ManageLM. The plugin exposes a /managelm/webhook HTTP route on the OpenClaw gateway and logs each event it receives.
An admin adds a webhook in the portal under Settings > MCP & API > Webhooks, pointing to your gateway's /managelm/webhook endpoint, with the event categories to send and an HMAC secret
Set the same secret in the plugin:
openclaw config set plugins.entries.managelm.config.webhookSecret "your_webhook_secret"
Every delivery is checked against its X-Webhook-Signature header, and one sent more than 5 minutes ago is refused so a captured delivery cannot be replayed. Without a secret configured, deliveries are refused, so a misconfiguration shows up as failed deliveries in the portal. Event categories:
base skill has no write commands. Mutating skills must be explicitly assigned by an admin.Run openclaw config set plugins.entries.managelm.config.apiKey "mlm_ak_...". You can find your key in the portal under Settings > MCP & API.
Make sure plugin tools are enabled: openclaw config set tools.allow '["managelm"]' and openclaw config set tools.profile "full". Restart the gateway after changes.
Start a fresh session, type /new in the TUI or use openclaw tui --session fresh. Old sessions may have cached failed responses.
Verify the portal URL is correct. The default is https://app.managelm.com. If self-hosting, set your portal URL in the plugin config.
Either no agents are enrolled, or the key's owner cannot see them: a key sees the servers its owner sees. Check the portal dashboard to verify agents are enrolled and online.
Run openclaw plugins inspect managelm to check plugin status. Ensure it shows "Status: loaded" and lists 33 tools. If not, reinstall with openclaw plugins install managelm --force.