OpenClaw 2026.5.16-beta.2 Adds xAI OAuth and Cron Controls
๐กEssential update for OpenClaw users featuring xAI OAuth and critical fixes for MCP tool reliability.
โก 30-Second TL;DR
What Changed
Added xAI Grok OAuth login for SuperGrok subscribers to authenticate without API keys.
Why It Matters
The xAI integration simplifies authentication for power users, while the improved MCP cancellation logic prevents resource leaks in long-running agent workflows.
What To Do Next
If you use MCP tools, update to this version to ensure your plugin tool calls respect cancellation signals properly.
Key Points
- โขAdded xAI Grok OAuth login for SuperGrok subscribers to authenticate without API keys.
- โขEnhanced CLI cron functionality with --wait, timeout controls, and run-id filtering.
- โขImproved MCP tool reliability by ensuring host-side cancellation signals propagate to plugin tools.
- โขLocalized setup wizard and channel flows for English, Simplified Chinese, and Traditional Chinese.
๐ง Deep Insight
Web-grounded analysis with 27 cited sources.
๐ Enhanced Key Takeaways
- โขOpenClaw functions as a local gateway process, not a chatbot, connecting LLM-powered agents to over 20 messaging platforms (WhatsApp, Telegram, Slack, Discord, iMessage, etc.) to perform real-world actions like file management, shell commands, and web browsing.
- โขThe project, initially named Clawdbot in November 2025 and later Moltbot, rapidly gained over 100,000 GitHub stars by early 2026, becoming one of the fastest-growing open-source AI projects in history, with its creator, Peter Steinberger, joining OpenAI in February 2026.
- โขSuperGrok, xAI's premium subscription, offers access to advanced Grok models (e.g., Grok 4, Grok 4.1/4.20 Beta) with features like DeepSearch, extended context windows (up to 256,000 tokens), and unlimited image generation, which OpenClaw's OAuth integration now leverages.
- โขOpenClaw's cron job management allows AI agents to execute natural language instructions on a schedule, transforming it from a reactive tool into a proactive assistant capable of daily briefings, weekly reports, and monitoring tasks.
- โขDespite its rapid adoption, OpenClaw has faced security concerns due to its broad system access and extensible plugin ecosystem, with audits identifying vulnerable instances and malicious third-party skills, leading to warnings from maintainers and restrictions by some authorities.
๐ ๏ธ Technical Deep Dive
- Architecture: OpenClaw operates on a hub-and-spoke architecture centered on a single "Gateway" process, which acts as the control plane, managing sessions, channel routing, tool dispatch, and events via a WebSocket server.
- Execution Environment: It functions as a long-running Node.js service, connecting various Large Language Models (LLMs) from providers like Anthropic, OpenAI, or local models (e.g., via Ollama, LM Studio) to the local machine and messaging applications.
- Agentic Loop: The system is built upon core AI agent patterns, including the agentic loop, tool use, context injection, and a persistent memory system.
- Memory System: Configuration data, interaction history, and skills are stored locally in transparent formats like Markdown and YAML files (e.g.,
MEMORY.md,HEARTBEAT.md), utilizing a hybrid memory architecture that incorporates BM25 and vector search for retrieval. - Skills/Plugins: OpenClaw features an extensible plugin system, allowing for the creation and integration of "skills" that can expand the agent's capabilities, with the potential for AI to author its own plugins.
- Proactive Autonomy: A "heartbeat system" and integrated cron job support enable the agent to operate proactively, performing scheduled tasks and monitoring in the background without constant user prompting.
- Security Model: Designed for single-user, local-first operation, with credentials and tokens stored under
~/.openclaw. The default bind address of0.0.0.0:18789has been noted as a security concern due to exposing the API to all network interfaces. - Cron Implementation: Cron jobs are persisted to disk within the Gateway and support standard cron expressions, interval scheduling, one-time runs, and timezone handling, with the AI agent autonomously interpreting natural language instructions.
- OAuth Integration: For xAI Grok, the system utilizes a browser-based OAuth login flow against
accounts.x.ai, storing and automatically refreshing access tokens in the background to enable authentication without direct API keys.
๐ฎ Future ImplicationsAI analysis grounded in cited sources
โณ Timeline
๐ Sources (27)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
- Google Search Source
Weekly AI Recap
Read this week's curated digest of top AI events โ
๐Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: OpenClaw (GitHub Releases) โ