Dependencies, Installation, and Configuration

NetClaw is a polyglot platform that layers dozens of Model Context Protocol (MCP) servers over the OpenClaw runtime, and its dependency surface reflects that breadth. Four language runtimes carry the load, a wide set of network-automation libraries do the domain work, and a single interactive installer plus a two-phase setup wire everything together. This section documents the runtimes and key libraries, the external services NetClaw talks to, the install.sh installer and its eleven profiles, the openclaw onboard → setup.sh setup flow, and the on-disk configuration layout under ~/.openclaw. All details here follow the repository README as the authoritative source.

Language Runtimes and Key Libraries

NetClaw uses four runtimes in a clear tier order. Python is the primary runtime, hosting pyATS and the majority of MCP servers (often launched via uvx). Node.js/npx is secondary, powering servers such as Microsoft Graph, GitHub, Draw.io, RFC Lookup, GitLab, and Check Point. Go is tertiary, used by the Grafana MCP, gtrace, Kubeshark remote endpoints, Forward Networks, and the N2N federation daemon. Docker is optional, backing the GitHub MCP server, the OpenShell sandbox, and some remote services.

flowchart TD
    N["NetClaw MCP servers"] --> P["Python 3.10+ (primary, via uvx)"]
    N --> J["Node.js / npx (secondary)"]
    N --> G["Go (tertiary)"]
    N --> D["Docker (optional)"]
    P --> P1["pyATS core + most MCP servers"]
    J --> J1["Microsoft Graph, GitHub, Draw.io, GitLab"]
    G --> G1["Grafana, gtrace, Kubeshark, N2N daemon"]
    D --> D1["GitHub MCP, OpenShell sandbox"]

The libraries below do the network-engineering work behind the MCP servers.

Version note — pygnmi: the upstream pygnmi project documents typical support for Python 3.7–3.9, while NetClaw targets Python 3.10+. In practice pygnmi installs and runs on 3.10+ (it is packaged for 3.12 in nixpkgs), but the version gap between pygnmi's documented range and NetClaw's floor is worth flagging when troubleshooting a fresh environment. Treat the NetClaw README's 3.10+ requirement as authoritative for the platform as a whole.

External Services and APIs

NetClaw's default LLM is the Anthropic Claude API (claude-opus-4-1, claude-sonnet-4), with OpenAI, Bedrock, Vertex, and Ollama among 30+ alternative providers selectable through OpenClaw. Around that core it integrates a large catalog of network and operations platforms: Cisco DevNet (pyATS images, Meraki, Catalyst Center, SD-WAN vManage, RADKit, ThousandEyes, FMC, CML, ACI/ISE/NSO RESTCONF); AWS, Azure, and GCP network/monitoring APIs; Check Point (15 MCP servers); Juniper, Arista, Aruba, and F5 devices; NetBox, Nautobot, and Infrahub as DCIM sources of truth; ServiceNow for change-request gating and CMDB sync; Grafana, Prometheus, Datadog, and Splunk for dashboards and metrics; Kubernetes Kubeshark for L4/L7 capture; GitHub, GitLab, and Jenkins for config-as-code and CI/CD; Microsoft 365 (Graph) for storage and Teams; IETF/NVD for RFC and CVE lookups; and Slack, WebEx, Discord, and Telegram for bidirectional chat.

Installation with install.sh

Installation begins with a clone and a single interactive command. The installer presents a TUI where you select a profile and toggle individual MCP servers.

git clone https://github.com/automateyournetwork/netclaw.git
cd netclaw
./scripts/install.sh          # interactive TUI — pick profile & MCP servers

Run install.sh as a normal user, not under sudo — the installer refuses to run as root to avoid writing config and keys into an inaccessible /root/.openclaw. The TUI offers eleven install profiles ranging from a curated recommendation to the full catalog.

For automation and repeatable builds, install.sh accepts scripted flags that bypass the TUI.

./scripts/install.sh --profile recommended        # non-interactive, specific profile
./scripts/install.sh --components "pyats netbox"   # exact component list
./scripts/install.sh --all                         # everything (classic full install)
./scripts/install.sh --list                        # view all components & profiles

Re-running install.sh later preserves the previous selection, so it doubles as the add/remove tool for MCP servers.

Two-Phase Setup

After installation, NetClaw is configured in two distinct phases. Phase 1 uses OpenClaw's built-in openclaw onboard wizard to select the AI provider (Anthropic, OpenAI, Bedrock, Vertex, and 30+ others), configure the gateway (local mode, auth, port), connect chat channels (Slack, Discord, Telegram, WhatsApp), and optionally install the systemd daemon. Phase 2 runs the NetClaw-specific ./scripts/setup.sh, which edits testbed.yaml with device IPs, SSH credentials, and SNMP communities via the pyATS testbed editor, collects platform credentials only for installed components (the selection is remembered in ~/.openclaw/netclaw-components.conf), and captures identity details — name, role, timezone — for USER.md personalization.

flowchart TD
    A["git clone netclaw"] --> B["./scripts/install.sh (TUI: profile + MCP selection)"]
    B --> C["Phase 1: openclaw onboard"]
    C --> C1["Select AI provider"]
    C --> C2["Configure gateway (mode, auth, port)"]
    C --> C3["Connect chat channels"]
    C --> C4["Optional systemd daemon"]
    C1 --> D["Phase 2: ./scripts/setup.sh"]
    C2 --> D
    C3 --> D
    C4 --> D
    D --> D1["Edit testbed.yaml"]
    D --> D2["Per-component credentials"]
    D --> D3["USER.md identity"]
    D1 --> E["Runtime"]
    D2 --> E
    D3 --> E
    E --> F["openclaw gateway"]
    E --> G["openclaw tui"]

Configuration Layout

NetClaw's configuration lives under ~/.openclaw. The master environment file, ~/.openclaw/.env, holds API keys and secrets; only credentials for installed components are required.

ANTHROPIC_API_KEY=<key>
NETBOX_URL=https://netbox.example.com
NETBOX_TOKEN=<api-token>
SERVICENOW_INSTANCE=dev12345
SERVICENOW_USERNAME=netclaw_svc
SERVICENOW_PASSWORD=<password>
AWS_ACCESS_KEY_ID=<key>
AWS_SECRET_ACCESS_KEY=<secret>
MERAKI_API_KEY=<key>
GRAFANA_URL=https://grafana.example.com
GRAFANA_API_TOKEN=<token>
PROMETHEUS_URL=http://prometheus:9090

MCP server definitions live in ~/.openclaw/config/openclaw.json, where each server declares its transport type (stdio), launch command, args, and env.

{
  "mcpServers": {
    "pyats": {
      "type": "stdio",
      "command": "uvx",
      "args": ["netclaw-pyats-mcp"],
      "env": {
        "PYATS_TESTBED_PATH": "/home/user/.openclaw/testbed.yaml"
      }
    }
  }
}

Device inventory is a standard pyATS testbed.yaml, edited during Phase 2, listing each device's hostname, credentials, and platform. Alongside these, workspace context files (USER.md, SOUL.md, AGENTS.md, IDENTITY.md, TOOLS.md, HEARTBEAT.md) personalize behavior and are injected under "Project Context," capped at 20,000 characters each.

Behavior is tuned with feature flags set in .env or as CLI flags: NETCLAW_LAB_MODE (bypass ServiceNow CR gating in test environments), N2N_RISK_MODE=production (fail-closed federation security), N2N_CERT_MODE=on|enforce (TLS/TOFU certs for federation), and NETCLAW_GCF_MODE=full|graph|generic|off (Graph Compact Format token savings of 55–83%).

At runtime NetClaw runs as two processes — the gateway server and the TUI:

openclaw gateway              # Terminal 1: start the OpenClaw gateway
openclaw tui                  # Terminal 2: launch the terminal user interface
openclaw configure            # reconfigure AI provider, gateway, or channels
./scripts/setup.sh            # update network platform credentials

Because ~/.openclaw/.env follows the environment-variable indirection pattern, standard secrets hygiene applies directly: keep the file out of version control, restrict it with chmod 600, never log or pass its values as command-line arguments, and promote to a dedicated secret manager (Vault, AWS Secrets Manager, Doppler) with least-privilege access and rotation for shared or production deployments.

References