npx ghostpaw

Why

OpenClaw was acquired by OpenAI (Feb 15, 2026). What was the independent open-source agent is now a subsidiary. Meanwhile: Docker setups that break on install, $30–50/session token burn with no cost controls, a skill marketplace that turned into a malware marketplace (ClawHavoc — 1,184 malicious packages, the #1 ranked skill was a stealer), and 430,000 lines of code to do what should be simple.

Ghostpaw is the other direction. One .mjs file. Six core tools. Plain markdown. An API key and Node.js — nothing else.

Three Learning Loops

Most agents are stateless. They're as smart as the model, every time, forever. Ghostpaw stacks three compounding loops on top of each other.

Loop 1 — Models get better. This is the ChatGPT mode everyone knows. Ghostpaw is model-agnostic across OpenAI, Anthropic, and xAI. When the next Sonnet or GPT drops, your agent is instantly smarter at baseline. You ride the curve instead of managing local weights.

Loop 2 — You teach it. This is the OpenClaw and Claude Code mode. There's a wealth of skills, prompts, and workflows across the internet. Copy a deployment checklist into skills/, paste a coding convention, drop in a teammate's debugging playbook. Plain markdown — no marketplace needed, no approval process, no supply chain risk.

Loop 3 — It teaches itself. This is what Ghostpaw adds. The agent extracts learnings from every session, refines its own skills through training, and proactively scouts for capability gaps it hasn't been told about. No other tool in this space does autonomous self-improvement from use.

These loops multiply. Better base models × curated knowledge × self-refined skills = an agent that accelerates the longer you use it.

Skills

Three modes, one system.

Craft — the agent writes skills during normal conversation. You correct it, it captures the lesson. Skills emerge from doing.

Train — ghostpaw train. Retrospective that processes accumulated sessions into sharper skills. Three phases: absorb learnings, refine skills, clean up. You decide when to run it.

Scout — ghostpaw scout. Forward-looking ideation that mines your context for friction and capability gaps you haven't noticed. Returns evidence-grounded suggestions, then deep-researches the one you pick.

Skills are plain markdown in skills/, version-controlled by git for integrity and rollback. No plugins. No marketplace. No supply chain attack surface.

How the skill system works →

Memory

Persistent, local, automatic. The agent remembers corrections, preferences, and discoveries across sessions — and recalls them on its own when context matters.

Memories are stored in SQLite (Node.js built-in), embedded using a lightweight trigram hash (no API calls, no model downloads), and searched by meaning with a recency bias so recent corrections outrank stale context. No vector database. No cloud sync. Your memories stay on your machine, in one file.

The agent uses memory transparently: ask "what concerts are near me?" and it already knows your city, your bands, your preferences — because it recalled them before drafting its answer.

How memory works →

Web Tools

Built-in web_search and web_fetch — no browser, no Playwright, no headless Chrome. The agent searches, reads pages, and synthesizes on its own.

Search works out of the box with DuckDuckGo. Add an API key for Brave Search, Tavily, or Serper and the agent automatically upgrades to the premium provider. Fetch extracts clean content in four modes: article (readable body), text (full plaintext), metadata (links + feeds), and html (raw source). Large pages spill to disk with a preview — the agent reads sections on demand instead of burning context.

That's the zero-dependency core. Since the agent has shell access and learns through skills, nothing stops it from driving Playwright, puppeteer, or curl pipelines if they're installed — you teach it once, it writes a skill, and the capability sticks. The built-in tools cover 95% of web tasks without any of that.

Web tools, modes, and providers → · API key setup →

Communication

Talk to Ghostpaw from anywhere. Channels are persistent messaging integrations that run alongside the REPL or as a headless daemon. Each channel gets its own session with full conversation history, sticky across restarts.

Telegram — create a bot via @BotFather, store the token with ghostpaw secrets set TELEGRAM_BOT_TOKEN, start Ghostpaw. Typing indicators, split replies, emoji read receipts. Under a minute to set up.

Web UI — built-in control plane at localhost:3000. Set a password, open a browser. Full chat with real-time streaming, live training, skill scouting, memory search, session inspection — from your phone or desktop. Password-authenticated, rate-limited, CSP-hardened. Everything embedded in the single .mjs artifact.

Telegram setup, Discord, and more → · Web UI details →

Cost Controls

Every LLM call is tracked with real provider-reported token counts and costs. Set a hard dollar limit on a rolling 24-hour window — the agent blocks itself before it overspends. A live dashboard in the web UI shows spend per model, per day, and how much budget remains. Adjust the limit in real time, no restart needed.

No surprise bills. No midnight-reset loopholes. No hope-based cost management.

How cost tracking works →

Deployment Philosophy

Use frontier models. They're better than local inference and getting cheaper every quarter. A $5/mo VPS + an API key is a full agent deployment. No GPU. No VRAM. No quantization trade-offs. No Docker compose debugging.

OpenClaw Migration

Ghostpaw reads SOUL.md and skills/ natively — the same workspace format OpenClaw uses. Bring your existing setup, it works. Marketplace skills you downloaded won't transfer (by design), but everything you wrote yourself will.

Install

Requires Node.js 22.5+ (or Docker).

curl -fsSL https://raw.githubusercontent.com/Anonyfox/ghostpaw/main/install.sh | sh

The installer detects your OS, installs Node.js 22.5+ if missing, and sets up ghostpaw in ~/.local/bin. True one-shot — works on macOS, Linux, and WSL.

Already have Node.js?

npx ghostpaw                  # zero install, runs latest
npm install -g ghostpaw       # global install

Docker (no Node.js needed):

docker run --rm -it -v "$(pwd)":/workspace -v ~/.ghostpaw:/root/.ghostpaw ghcr.io/anonyfox/ghostpaw

Setup guide & troubleshooting →

Usage

ghostpaw                     # interactive chat
ghostpaw run "do the thing"  # one-shot, exits when done
ghostpaw train               # level up from experience
ghostpaw scout               # discover new capabilities
ghostpaw init                # create workspace, set API keys
ghostpaw secrets             # manage API keys (masked input, persistent)
ghostpaw service install     # systemd/launchd background service

As a library:

import { createAgent } from "ghostpaw";

const agent = createAgent({ workspace: "./my-workspace" });
const result = await agent.run("analyze this codebase");

Architecture

src/index.ts  →  esbuild  →  dist/ghostpaw.mjs

One artifact. CLI, runtime, and importable library in a single self-contained .mjs file. All npm dependencies bundled at build time — no node_modules at runtime. Built on Node built-in APIs (node:sqlite, node:http, node:fs, node:child_process).

~/.ghostpaw/
  config.json       # providers, models, cost controls
  ghostpaw.db       # SQLite: sessions, memory
  SOUL.md           # agent personality
  skills/           # procedural knowledge (markdown)

Development

git clone https://github.com/Anonyfox/ghostpaw.git && cd ghostpaw
npm install
npm run build        # build dist/ghostpaw.mjs
npm run dev          # rebuild on change
npm run check        # biome lint + typecheck
npm test             # full test suite

Support

If Ghostpaw helps your workflow, consider sponsoring its development:

Anonyfox • MIT License