KiloClaw

KiloClaw was Kilo's hosted OpenClaw service: a managed, always-on AI agent intended to remove the infrastructure work of self-hosting OpenClaw. Kilo's current documentation now carries an explicit end-of-life warning: KiloClaw is no longer available to new users, support is ending and the documentation is retained only for existing users.¹ That status is the most important fact about the product today.

Before EOL, the service provisioned a dedicated machine for each user with 2 shared vCPUs, 3 GB RAM and a 10 GB persistent SSD. Instances were region-pinned and exposed through Kilo's controller rather than direct public OpenClaw binding.¹² Users could interact through Kilo Chat or optional Telegram, Discord and Slack channels and connect services such as Google email/calendar/Drive and GitHub.³

KiloClaw supported scheduled and webhook-triggered work, allowing an always-on agent to react to external events or run recurring jobs without a user opening chat.⁴ It also supported hundreds of models through Kilo Gateway plus BYOK providers.⁵ The value proposition was therefore broader than “hosted chatbot”: it was a managed autonomous agent with persistent compute, integrations, files and scheduled execution.

The autonomy surface was powerful enough to require explicit safety controls. Host command execution defaulted to `deny`; users could move to an allowlist or deliberately enable unrestricted execution. Kilo warned that “Allow Everything” removes the exec safety checks.⁶ Trigger documentation similarly warned that scheduled or webhook prompts can cause automatic actions if permissions are permissive.⁴

There is no current new-user price because KiloClaw is no longer available to new users.¹⁵ Historical pricing should be treated only as product-history context.

A July 2026 Capterra listing reported a Standard plan at $9/month with an introductory first-month discount and a Commit plan at $8/year, plus usage-based inference through Kilo Gateway.⁷ Kilo's own historical pricing documentation describes dedicated-machine hosting plus Gateway credits or BYOK for model inference but now redirects users to current Kilo pricing rather than maintaining a KiloClaw purchase offer.⁵

The current Kilo mobile App Store listing can still describe “Run a managed KiloClaw” and Kilo Pass credit tiers.⁸ Because Kilo's dedicated KiloClaw documentation is newer and explicit about EOL, that store copy should not be interpreted as evidence that a new KiloClaw instance can still be purchased.

KiloClaw's historical security architecture was unusually well documented. Each user had a dedicated machine and persistent volume, storage was pinned to the instance region, OpenClaw bound to loopback, external traffic was proxied through Kilo, authentication was per-user and sensitive configuration such as API keys/channel tokens was encrypted at rest.² Kilo also published a security-focused explanation of its defense-in-depth design.⁹

Command safety was explicit rather than implicit. The default execution policy denied host commands until the user configured an allowlist; local approvals were layered on top of tool policy, with the stricter rule winning.⁶ Kilo's setup guidance recommended separate bot accounts for Google and GitHub rather than connecting the agent directly to personal accounts, reducing blast radius.³

The product nevertheless operated inside the broader Kilo data environment. In August 2026 Anaconda disclosed a Metabase incident affecting a subset of Kilo users: some users or organizations may have had partial or full prompts and personal information exposed, and a small subset of Kilo Slackbot users had access tokens exposed and invalidated.¹⁰ The disclosure did not state that KiloClaw machines or connected accounts were themselves compromised, so that distinction should be preserved. It is still relevant trust context for a hosted agent product handling sensitive integrations.

The strongest current reliability signal is not a benchmark but the product's lifecycle decision. Once a vendor states that a service is EOL, unsupported and no longer maintained, historical feature quality cannot justify recommending it to new users. Capterra currently has zero KiloClaw user reviews, so there is also no mature external satisfaction corpus to counterbalance that status.⁷

KiloClaw is no longer a product for new buyers. The relevant audience is existing users who still have an instance and need to understand what they are operating while preparing a migration or shutdown.¹

For those users, the documentation remains useful for recovering configuration, reviewing command approvals, understanding dedicated-machine/network architecture, inspecting triggers and disentangling connected Google/GitHub/chat accounts.²⁶⁴³

Any migration should preserve the good security ideas rather than merely replicate capabilities: dedicated service accounts, least-privilege credentials, explicit command allowlists, separate approval for destructive actions and careful treatment of webhook/scheduled prompts. A replacement always-on agent without those controls could be easier to deploy but materially riskier.