OpenClaw Setup on DGX Spark for Sovereign AI Agents

New to self-hosting AI? The Self-Hosted AI: Start Here hub walks the hardware-decision tree, inference-engine choice, and the operational gotchas that bite hardest in the first three months. Read it before or after this one, whichever fits your stage.

Set up a local AI agent runtime that switches between cloud and local models without leaving your DGX Spark.

As of 2026-05-04: OpenClaw v2026.4.24 is the version this article was last verified against. The Side-Car-Proxy that resolved the Mistral alternating-roles BadRequestError is now built into the gateway from this release on. If you are on an older release, see the alternating-roles fix post for the manual workaround that this version removes.

Quick Take

• OpenClaw runs as a Node.js gateway with Matrix bridge, TUI, HTTP API, and native MCP support
• You can alternate between Anthropic cloud models and Mistral via SGLang on the same session
• The v2026.4.24 release removes the need for a separate Mistral proxy
• Your workspace is six hardcoded Markdown files in ~/.openclaw/workspace

Install OpenClaw on DGX Spark

npm i -g openclaw@latest      # Node 22 LTS via nvm
openclaw gateway install      # systemd user service
openclaw onboard              # interactive setup (crash at token step → do it manually)

OpenClaw installs as a user-level systemd service listening on loopback port 18789. The onboard command walks you through credentials, workspace paths, and model providers. In practice, run openclaw gateway start after install to verify the service is up.

Workspace Files That Define Clawi’s Behavior

OpenClaw loads six Markdown files from ~/.openclaw/workspace on startup. Filenames are hardcoded, so SYSTEM.md or CONTEXT.md are ignored.

Persona, behavior rules, and boundaries for Clawi.

# IDENTITY.md
Clawi’s name, emoji, and vibe settings.

# USER.md
Your hardware specs, important paths, running services, and workarounds.

# HEARTBEAT.md
Today’s relevant context, updated per session.

# AGENTS.md
Multi-agent team configuration if you run more than one assistant.

# TOOLS.md
Available tools, commands, and endpoints.

Define concrete hardware specs in USER.md. Without them, Clawi hallucinates ARM64-unfriendly advice or asks basic questions at cold start. For example, if you list GB10 Blackwell, 128 GB unified, ARM64, Clawi won’t suggest x86-only workarounds.

Configure Gateway for Local-Only Access

{
  "gateway": {
    "mode": "local",
    "port": 18789,
    "auth": { "mode": "token", "token": "..." },
    "bind": "loopback",
    "controlUi": { "allowInsecureAuth": true }
  }
}

mode: "local" is required; otherwise OpenClaw exits with code 78. Binding to loopback prevents external exposure. The token is also used by the dashboard for health checks. In practice, keep bind: "loopback" unless you need remote debugging.

Switch Between Cloud and Local Models at Runtime

{
  "agents": {
    "defaults": {
      "model": {
        "primary": "anthropic/claude-sonnet-4-6",
        "fallbacks": ["sglang/Mistral-Small-4"]
      },
      "models": {
        "sglang/Mistral-Small-4": {},
        "anthropic/claude-opus-4-7": {},
        "anthropic/claude-sonnet-4-6": {}
      }
    }
  }
}

You can change the active model mid-session. /model sets the default for the next turn, while /execute anthropic/claude-sonnet-4-6 forces an immediate switch. This means you can keep Anthropic as primary and drop to Mistral Small 4 when you need local inference.

Run Mistral via SGLang Directly on Port 30000

{
  "models": {
    "providers": {
      "sglang": {
        "baseUrl": "http://127.0.0.1:30000/v1",
        "api": "openai-completions",
        "apiKey": "sk-sglang",
        "models": [{
          "id": "Mistral-Small-4",
          "contextWindow": 128000,
          "maxTokens": 8192
        }]
      }
    }
  }
}

SGLang runs on port 30000 and exposes /v1/chat/completions. The model ID must match exactly what SGLang reports. Using api: "openai-completions" routes requests correctly. In practice, verify the model list with curl http://127.0.0.1:30000/v1/models and copy the exact ID.

Wire MCP Servers for Persistent and Transient Tools

OpenClaw supports two MCP transports natively.

HTTP server (persistent)

openclaw mcp set sovereign '{"url":"http://127.0.0.1:8002/mcp"}'

stdio process (per-session)

openclaw mcp set knowledge \
  '{"command":"python3","args":["/home/user/.vibe/mcp-servers/knowledge_mcp.py"]}'

List configured servers:

openclaw mcp list
# - knowledge
# - sovereign

Here, sovereign points to a long-running HTTP server for blog search and diagnostics, while knowledge launches a Python script per session for cross-project knowledge access. In practice, keep HTTP servers for tools you need alive between turns.

Choose Token or API Key for Anthropic Auth

"auth": {
  "profiles": {
    "anthropic:default": {
      "provider": "anthropic",
      "mode": "token"
    }
  }
}

mode: "token" tells OpenClaw to treat the credential as an OAuth token. If you only have ANTHROPIC_API_KEY in the environment, set mode: "api_key" to avoid streaming drops. In practice, run claude setup-token once, then openclaw models auth setup-token to bind the token to OpenClaw.

Silence Codex Discovery Noise

OpenClaw tries to discover a Codex app server on startup. If codex binary is missing, it falls back to a static catalog and logs a harmless warning.

"plugins": {
  "entries": {
    "codex": {
      "enabled": true,
      "config": { "discovery": { "enabled": false } }
    }
  }
}

Disable discovery if the log noise bothers you. In practice, set "discovery": { "enabled": false } in your config to keep the logs clean.

Enable Matrix Bridge with Allowlists

"channels": {
  "matrix": {
    "enabled": true,
    "homeserver": "http://localhost:8008",
    "network": { "dangerouslyAllowPrivateNetwork": true },
    "accessToken": "...",
    "encryption": true,
    "dm": {
      "policy": "allowlist",
      "sessionScope": "per-room",
      "threadReplies": "off",
      "allowFrom": ["@user:server"]
    },
    "groupPolicy": "allowlist",
    "groupAllowFrom": ["@user:server"],
    "autoJoin": "allowlist",
    "autoJoinAllowlist": ["@user:server"]
  }
}

The bridge runs encrypted and only accepts invites from allowlisted users. In practice, keep policy: "allowlist" to prevent random Matrix users from triggering your agent.

What I Actually Use

• Mistral Small 4: local fallback when I don’t want cloud costs or latency
• Anthropic Claude Sonnet 4.6: primary model for coding tasks on DGX Spark
• OpenClaw gateway: user-level systemd service for reliable uptime

How OpenClaw fits into the multi-agent workflow on this stack

After the install steps in the post are done, the question is what role OpenClaw actually plays day-to-day. The honest answer is that OpenClaw is the persona-orchestration layer, not the heavy-coding layer.

For multi-step coding work the daily driver is Claude Code (cloud). For local agent work where persona consistency matters (cipherfox vs hexabella voice, Matrix bot replies, Nostr-account interactions) OpenClaw is the right fit because it can hold persona-config alongside the model and switch between them per request. The Side-Car-Proxy that resolves the Mistral alternating-roles BadRequestError is OpenClaw-specific infrastructure and earns its keep precisely because OpenClaw’s persona work needs the local model.

The Gateway local-only configuration matters more than it looks. OpenClaw’s default exposes a port that some agents will discover via local network scans; binding it to 127.0.0.1 explicitly is a small change with a real reduction in attack surface. The runtime model-switch (cloud vs local) is convenient but worth using sparingly: switching mid-session breaks the KV cache and noticeably slows the next response.

Worth naming what OpenClaw is not: it is not a replacement for the Sovereign AI Blog MCP, not a hosted multi-tenant platform, not a Claude Code competitor for codebase-spanning tasks. It is the local persona-layer that holds the cipherfox/hexabella/blog-bot identities and can talk to the same SGLang endpoint the rest of the stack uses. That niche is real and OpenClaw fills it well.

The integration cost worth naming is that each new agent persona added to OpenClaw requires touching the gateway config, the persona-rules file, and (if the persona writes to Nostr or Matrix) the credential mount. None of those steps are hard but they are easy to forget on a fresh install three months from now. The mitigation is a one-page README in /data/secrets/openclaw/ that lists every config touch-point in install order. Boring documentation discipline that pays back the moment the next persona ships.

The persona-orchestration use-case that justifies OpenClaw on this stack is specifically the cipherfox-vs-hexabella split: cipherfox is the editorial voice (first-person, hands-on, opinionated about real engineering decisions); hexabella is the strategic voice (third-person, framework-level, opinionated about architecture and tradeoffs). Two distinct personas, two different audience-relationships, both backed by the same Mistral model. OpenClaw holds them as separate config bundles and switches at session boundary. The same setup on raw SGLang would require either two separate model instances (memory-prohibitive on one DGX Spark) or per-request prompt-prefix juggling (fragile, error-prone, no separation of concerns).

The Matrix-bridge integration is the second load-bearing capability. Replies from a hexabella-tagged inbound message land back through the Matrix bot under hexabella’s identity, with persona-consistent voice, without leaking cipherfox’s voice into the response. That kind of identity-stability across an asynchronous channel is the thing that makes a multi-persona blog feel intentional rather than schizophrenic.

Where to next

If you are still mapping where this fits in the broader stack, the Self-Hosted AI: Start Here hub covers the hardware-and-inference layer that OpenClaw sits on top of (DGX Spark, SGLang nightly, Mistral Small 4 NVFP4).

If you hit the Mistral alternating-roles BadRequestError on an older OpenClaw release, the alternating-roles fix post is the prerequisite read before this setup will route Mistral cleanly.

For where OpenClaw is going next on this stack (NIP-46 Bunker signing for the hexabella Nostr persona, agent-to-agent calling between OpenClaw and the Sovereign-AI MCP server, retired vs active features), the OpenClaw roadmap post is the live state.