Managed OpenClaw & Hermes hosting
Agents you can leave running.
Every agent gets a network namespace with no route off the box — except one proxy that reads your policy and refuses everything it does not name. It has a spending cap it cannot exceed, asks you before anything irreversible, and everything it did is written to a signed, append-only record.
Name it → it gets its own machine → message it. About two minutes, no terminal.
# What it may reach. Everything else is refused. allow gmail.googleapis.com read ask gmail.googleapis.com send allow api.github.com read write deny * # What it may spend before it stops. cap $2.00 / day hard
Five rules, and the agent physically cannot do anything
they do not permit. ask holds the request open and sends it to you.
What you get
The agent's own page. Everything it is allowed to do, what it has spent, and every decision it has made — in one place, on the machine it runs on.
mot.to/a/inboxWorkspace
Agents
Credentials
API keys
Operations
Fleet
inbox
runningopenclaw $0.42 of $2.00
Talk to itModelPolicy ConsoleRecord
allow gmail.googleapis.com read ask gmail.googleapis.com send deny *
| 0007 | egress.allow | gmail · read |
| 0006 | approval.released | you · send |
| 0005 | egress.hold | gmail · send |
| 0004 | egress.deny | pastebin.com |
How it is held
01 / THE BOX
No route off it
The container sits on an internal network with no gateway. There is no route to the internet to be misconfigured, because there is no route at all.
02 / THE PROXY
Verdicts, not filters
The one way out reads your policy and resolves the most specific rule that matches — the host, the path, and what the request is actually doing. Refusals are recorded.
03 / THE RECORD
Hash-chained, and signed
Every decision is appended and linked to the one before it. The head is signed, so changing an old entry means forging every entry after it too.
What you actually get
A console, files, and a shell
Run a command inside the sandbox, browse and edit its working directory, attach a disk that outlives the container. Every command lands in the record.
Credentials it can use but you cannot read
Stored under envelope encryption and granted per agent. Nothing hands one back — the container is the only thing that decrypts it.
Approvals that reach a person
An ask rule holds the request open and waits. Allow or refuse it from
your dashboard; the agent gets an answer, and so does the record.
Schedules and spend caps
Wake it on a cron line with a prompt. Give it a daily ceiling in dollars, and it stops when it gets there rather than when you notice.
Four things nobody else gives you
A CEILING ON THE BILL
It stops, rather than surprises you
Give an agent a daily figure in dollars. The proxy checks it before a request leaves, so the cap is enforced rather than reconciled from an invoice afterwards. "What if it runs up a huge bill" is the most common question about agents, and it should have an answer.
A HAND ON THE LEVER
It asks before the irreversible ones
Mark an action ask and the agent holds the request open
and waits for you. Reading your mail without asking, sending it only with permission, is one line
of policy.
A RECORD THAT HOLDS UP
Append-only, hash-chained, signed
Every decision links to the one before it and the head is signed, so editing history means forging all of it. You can verify the whole chain from the dashboard, and the record outlives the agent.
A BOX WITH ONE DOOR
Isolation you can describe
A kernel-isolated sandbox on a network with no gateway. Not a shared container with a firewall in front — there is no route to the internet at all, only a proxy that reads your policy.
Pricing
SOLO
$6/mo
1 agent
- One agent, always on
- $15 of model usage a month
- Or bring your own key
- Scheduled runs
TEAM
$24/mo
5 agents
- Five agents
- $60 of model usage a month
- Shared credential vault
- Approvals routed to people
Agent counts are enforced by the database, not by this page. Every plan gets the same enforcement — the policy engine, the record, and the proxy are not features of a tier.
Questions people actually ask
Does the agent know it is confined?
It finds out the same way anything does: a request is refused. The refusal carries a reason, so a well-built agent can adapt instead of retrying forever.
What happens to the record if I delete an agent?
Agents are archived, not deleted. The record outlives the agent — that is most of what it is for — and the hostname is never reused, so an old link cannot later reach somebody else's agent.
Can I bring my own model key?
Yes. Store it in the vault and grant it to the agents that should have it. Anthropic, OpenAI, Google, or something you run yourself.
What happens when an agent hits its spend cap?
It stops, and the refusal is recorded like any other. A cap is enforced at the proxy before the request leaves, not reconciled afterwards from a bill.