Fix: your gateway is on 0.0.0.0
Find agent services listening on all interfaces and bind them to localhost.
Plain Markdown for agents: /articles/fix-network-exposure.md
Check: network exposure. Controls: ASI03, MCP07. Critical when auth is off.
Detect
# macOS
lsof -nP -iTCP -sTCP:LISTEN | grep -E '\*:|0\.0\.0\.0:|\[::\]:'
# Linux
ss -ltnp | grep -E '0\.0\.0\.0:|\*:|\[::\]:'
Look for port 18789 (OpenClaw gateway) and any MCP server port. 127.0.0.1 is safe. 0.0.0.0, * and [::] are not.
Fix
sma fix gateway-bind
Manual route: set the gateway host to 127.0.0.1 in its config, restart, and run the detect command again.
Block the port at the firewall as a second layer:
# Linux (ufw)
sudo ufw deny 18789/tcp
# macOS: System Settings > Network > Firewall, block incoming for the runtime
Verify
curl -sS -m 5 -o /dev/null -w '%{http_code}\n' http://YOUR_PUBLIC_IP:18789/
Expect a timeout or connection refused. Then run npx -y securemyagent checkup.
Remote access
Use an SSH tunnel, not an open port:
ssh -N -L 18789:127.0.0.1:18789 user@your-host
Background: Exposed gateways and CVE-2026-25253.