Docs

Install

Linux x86-64 and macOS 15 or newer (Apple silicon and Intel).

tar xzf klawed-<version>-linux-x86_64.tar.gz
install -m 0755 klawed /usr/local/bin/klawed

Nothing else to install. The Linux binary carries its own libraries - libcurl, OpenSSL, SQLite, ncurses and cJSON are linked into it - and a certificate bundle to fall back on, so it needs nothing from the machine except a kernel. HTTPS is still verified against the system's own trust store wherever there is one: that is the store its owner maintains, and the one that knows about a proxy in the middle of the connection. The macOS build uses the system's libraries and keychain instead, and it is unsigned, so Gatekeeper asks once on first launch.

Providers

An API key and a model name are the whole setup. klawed ships no default model - a model named in a release is an old model by the next one, so you name yours: --model for one run, OPENAI_MODEL for the session, or the picker on first run.

export OPENAI_API_KEY="sk-..."
klawed --model gpt-5.4 "hello"

Or sign in to a plan you already pay for - no key involved:

Anything else goes in ~/.klawed/config.json (or .klawed/config.json for one project), or through /setup in the TUI:

{ "providers": {
    "deepseek": { "provider_type": "openai",
                  "model": "deepseek-chat",
                  "api_base": "https://api.deepseek.com",
                  "api_key_env": "DEEPSEEK_API_KEY" } } }

KLAWED_LLM_PROVIDER=deepseek klawed

Running it

klawed                        # the TUI
klawed "refactor the auth module"   # one-shot, then exit
klawed --web-server 8080           # browser client

Tools

Read, Write, Edit, MultiEdit, Bash, Grep, Glob, TodoWrite, Subagent, CheckSubagentProgress, MemoryStore, MemoryRecall, MemorySearch, UploadImage, ViewImage, Sleep. Dynamic tools add more.

Commands

Keys

Files

Web client

klawed ships a browser client, and you host it. One command serves the page and the API from the same binary - nothing is hosted for you, and it is free and ungated: no account, no licence, no service of ours in the middle.

klawed --web-server 8080        # then open http://127.0.0.1:8080

A thread is a conversation in a folder you pick in the UI, and it runs as a klawed process of its own in that folder: the same working directory, config and tools as the terminal, and it keeps working after you close the tab. The Settings pane edits ~/.klawed/config.json, the same file the TUI writes, so providers are set up once.

It binds to localhost until you pass --web-bind. To reach it from another machine, bind explicitly and close the API with one of two credentials - a bearer token, or a password file that serves a login screen:

# token auth: ?token=... on the page, Authorization: Bearer on the API
KLAWED_WEB_TOKEN="<a-long-random-token>" \
  klawed --web-server 8080 --web-bind 0.0.0.0

# or a login screen instead of a token
printf '%s' '<long-random-password>' > ~/.klawed/web-password
klawed --web-server 8080 --web-bind 0.0.0.0

Either credential alone is enough; with neither set the API is open, which is only safe because the default bind is loopback. Treat it as "run arbitrary commands in these folders as your user": keep it on loopback or a VPN, and put TLS in front before exposing it to a network.

The phone and tablet client is the same page, laid out for a small touch screen.

Bugs

There is no tracker. Mail it and a person reads it. Start with the environment report - it says which terminal, trust store, network and provider klawed found, and prints no secrets:

klawed --doctor

Then the three things that make a report actionable:

• What you did
• What happened
• What you expected instead