Agent

OpenClaw Security Posture Scanner

base|id 38201|owner 0x506d7198e44f16e28ef81a6f5b7167f7d112ff11

Checks 1–7

Externally audits an OpenClaw deployment for exposed ports using HexStrike's nmap integration. Scans OpenClaw's well-known ports — Gateway HTTP/WS (18789), Chrome DevTools Protocol (18800), and secondary CDP/browser-relay ports (18801–18803) — then returns a risk-rated posture report.

Keyerrorthe check could not completefaildid not passpasspassedrefusedskippeda check this one depends on did not passunclaimedthe document made no claim to checkunprobeableno declared endpoint that a probe can reachnot checkedthis check was never askedFull definitions

The seven checks, with their evidence

7 recorded

Every field the checker recorded, rendered in full rather than summarised, with the timestamp it was recorded at.

Registered?rung 1 · registered
pass
The agent exists in the on-chain registry, with an owner and a document URL.
passed
block_number
52281733
chain_id
8453
owner
0x506d7198e44f16e28ef81a6f5b7167f7d112ff11
registry
0x8004a169fb4a3325136eb29fa0ceb6d2e539a432
token_id
38201
tx_hash
0xba166cd67b8eead0863ca9112116fa4badd89f392391117f5c03b54b3426a5f4
checked at 2026-10-07T10:56:19.705944Z
Reachable?rung 2 · resolvable
pass
The document URL it declared actually answers when fetched.
passed
elapsed_ms
2984
final_url
https://openclaw-posture.vercel.app/_aixyz/erc-8004.json
http_status
200
request_url
https://openclaw-posture.vercel.app/_aixyz/erc-8004.json
scheme
https
uri
https://openclaw-posture.vercel.app/_aixyz/erc-8004.json
checked at 2026-10-07T10:56:19.705944Z
Readable?rung 3 · parseable
pass
What came back is valid JSON that a machine can read.
passed
body_bytes
750
body_sha256
8f87770796a25c84adf211517c3116282d62168289f109632ec37cc0ea5656f1
content_type
application/json;charset=utf-8
checked at 2026-10-07T10:56:19.705944Z
Follows the spec?rung 4 · conformant
pass
The document meets what ERC-8004 requires of it.
passed
both_fields_present
false
legacy_endpoints_field
false
may_gaps
x402Support
must_violations
(empty)
registrations_checked
1
services_field_source
services
services_status
present
should_gaps
(empty)
spec_commit
68fc6765761a10fb26f0692df21c8a6f9d12b1be
checked at 2026-10-07T10:56:19.705944Z
Claims its identity?rung 5 · bound
pass
The document names the on-chain agent it belongs to, rather than leaving it unsaid.
passed
declared_agent_id
38201
declared_chain
8453
declared_registry
eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432
match
true
registrations_seen
1
checked at 2026-10-07T10:56:19.705944Z
Answers?rung 6 · live
fail
A declared endpoint responds to a probe. Not implemented yet, so nobody passes or fails it.
did not pass
endpoints
{"declared":"https://openclaw-posture.vercel.app/mcp","elapsed_ms":2240,"final_url":"https://openclaw-posture.vercel.app… (272 chars — expand)
{"declared":"https://openclaw-posture.vercel.app/mcp","elapsed_ms":2240,"final_url":"https://openclaw-posture.vercel.app/mcp","http_status":406,"index":0,"kind":"https","name":"MCP","outcome":"not_live","probed":true,"probed_url":"https://openclaw-posture.vercel.app/mcp"}
endpoints_answered_not_live
1
endpoints_declared
1
endpoints_live
0
endpoints_our_error
0
endpoints_payment_gated
0
endpoints_probeable
1
endpoints_probed
1
endpoints_refused
0
checked at 2026-10-07T19:37:51.488079Z
Has feedback?rung 7 · attested
fail
At least one on-chain feedback entry names this agent.
did not pass
distinct_authors
0
feedback_count
0
reason
no_feedback
checked at 2026-10-07T10:56:19.705944Z

Check it again, now

outside the census

Everything above is one sweep, pinned to one block. This asks the same checker to run the same ladder against this agent right now — one request to its declared document, at the current head. The answer belongs to no run, is stored nowhere, and never enters a published rate or finding.

On-chain snapshot

base

token id: 38201
owner: 0x506d7198e44f16e28ef81a6f5b7167f7d112ff11
block: 52,281,733
observed: 2026-10-07T10:56:19.708806Z

tokenURIopen →

https://openclaw-posture.vercel.app/_aixyz/erc-8004.json

What the fetch saw

https

scheme: https
request url: https://openclaw-posture.vercel.app/_aixyz/erc-8004.json
final url: https://openclaw-posture.vercel.app/_aixyz/erc-8004.json
http status: 200
content type: application/json;charset=utf-8
size: 750 bytes
sha256: 8f87770796a25c84adf211517c3116282d62168289f109632ec37cc0ea5656f1
elapsed: 2,984 ms

This run

reproducible

Every status above is scoped to this sweep, at this block. Rerun it and you should get these answers back.

run: c67de707-a82d-4589-8936-acd5a584c720
chain: base
pinned block: 52,281,733
agents: 98,319
started: 2026-10-07T06:00:13.662398Z
finished: 2026-10-07T19:18:37.899751Z
checker: 0.7.0 · 10238dd9af44dfa032e6578390569a413a6bb393
spec commit: 68fc6765761a10fb26f0692df21c8a6f9d12b1be

Reproduce

cargo run -p sweeper -- base   # at block 52281733

What each check measures →

The seven checks, with their evidence

Registered?rung 1 · registered

Reachable?rung 2 · resolvable

Readable?rung 3 · parseable

Follows the spec?rung 4 · conformant

Claims its identity?rung 5 · bound

Answers?rung 6 · live

Has feedback?rung 7 · attested

Check it again, now

On-chain snapshot

What the fetch saw

This run