PrivClaw is a secure, enterprise-oriented plugin marketplace, serving OpenClaw workflow customization and solving public plugin security risks for enterprises.

Background & Business Logic

We provide enterprise-level AI workflow deployment services based on OpenClaw. When enterprises build custom AI workflows, a large number of functional plugins are required.

Public plugin hubs contain unregulated, malicious and unsafe plugins, which bring huge security risks to enterprise usage. To solve this problem, PrivClaw is built as a private, audited, secure AI plugin marketplace.

Commercial Closed Loop

• We deploy exclusive AI workflows for enterprises.
• Enterprises can only purchase audited, high-security plugins from our platform to avoid security accidents.
• High-quality developers are invited to submit and monetize standardized plugins.
• Form a stable business ecosystem of workflow customization + official plugin supply.

Why PrivClaw?

• Full Commercialization — Built-in Alipay payment, wallet system, revenue sharing, and withdrawal. Not a toy project.
• One-Click Deploy — docker compose up -d launches the entire stack in 30 seconds.
• Production-Grade Architecture — FastAPI + Next.js 15 + PostgreSQL + Redis + Celery, cleanly layered.
• Comprehensive Documentation — Detailed architecture docs, local implementation guide, and auto-generated API docs.
• Full-Text Search — PostgreSQL TSVECTOR-powered plugin search with fuzzy matching.
• Security First — CORS, rate limiting, security headers, JWT dual-token auth (HS256/RS256), bcrypt password hashing, AES-256-GCM sensitive data encryption.

Quick Start

git clone https://github.com/privclaw/privclaw.git
cd privclaw
cp .env.example .env
docker compose up -d

Then visit:

• Frontend: http://localhost:3000
• API Docs: http://localhost:8000/docs
• MinIO Console: http://localhost:9001

Demo Accounts

After running make seed, you'll have 3 demo accounts:

Screenshots

Home Page	Plugin Marketplace	Admin Dashboard

Plugin Detail

Feature Checklist

Core Features

• User Authentication (JWT dual token: access + refresh, HS256/RS256)
• User Management (roles: buyer / developer / admin)
• Plugin Marketplace (CRUD + version management + file upload)
• Full-Text Search (PostgreSQL TSVECTOR)
• Category System (tree structure)
• Order System (create, list, auto-close on timeout via Celery)
• Alipay Payment (face-to-face QR code + async callback)
• Wallet Balance Payment
• Wallet System (recharge, withdrawal, transaction records)
• Admin Dashboard (user management, plugin review, order management, withdrawal review)
• Object Storage (MinIO for dev / Aliyun OSS for production)
• Docker Compose (development + production)
• HTTPS (Nginx with self-signed cert + HSTS)
• Rate Limiting (Nginx: auth 3r/m, API 30r/s, frontend 50r/s)
• Security Headers (X-Frame-Options, CSP, HSTS, etc.)
• Sensitive Data Encryption (AES-256-GCM)
• CI/CD Pipeline (GitHub Actions + ruff + pytest coverage)

In Progress

• WeChat Pay Integration
• Plugin Review System Frontend UI
• Admin Dashboard Data Visualization
• Refresh Token Rotation

Planned

• Refund Workflow
• Rating & Review System
• Dark Mode
• Notification System
• Monitoring & Alerting

Architecture

┌─────────────────────────────────────────────────────────────┐
│                        Nginx (443/80)                       │
│                   SSL + Reverse Proxy + Rate Limit           │
└──────────────┬──────────────────────┬───────────────────────┘
               │                      │
        ┌──────▼──────┐       ┌───────▼──────┐
        │  Frontend   │       │   Backend    │
        │  Next.js 15 │       │   FastAPI    │
        │  (3000)     │       │ Gunicorn ×4  │
        │  standalone │       │   (8000)     │
        └─────────────┘       └──────┬───────┘
                                     │
                    ┌────────────────┼────────────────┐
                    │                │                │
             ┌──────▼──────┐ ┌──────▼──────┐ ┌──────▼──────┐
             │  PostgreSQL │ │    Redis    │ │    MinIO    │
             │    (5432)   │ │   (6379)   │ │   (9000)   │
             └─────────────┘ └──────┬──────┘ └─────────────┘
                                    │
                             ┌──────▼──────┐
                             │   Celery    │
                             │   Worker    │
                             └─────────────┘

Tech Stack

Documentation

• API Docs — Auto-generated Swagger UI
• Contributing Guide — How to contribute
• Code of Conduct — Community guidelines
• Security Policy — Reporting vulnerabilities
• Changelog — Version history

Development

Prerequisites

• Docker & Docker Compose
• Python 3.12+ (for running scripts locally)
• Node.js 20+ (for frontend development)

Common Commands

# Initialize environment
make init

# Start all services
make dev

# Run database migrations
make migrate

# Seed demo data
make seed

# Run tests
make test

# View logs
make logs

# Stop all services
make down

# Production deployment
make prod

Project Structure

privclaw/
├── backend/                 # FastAPI backend
│   ├── app/
│   │   ├── api/v1/          # RESTful API routes
│   │   ├── core/            # Config, security, dependencies
│   │   ├── models/          # SQLAlchemy ORM models
│   │   ├── schemas/         # Pydantic validation schemas
│   │   ├── services/        # Business logic layer
│   │   ├── tasks/           # Celery async tasks
│   │   └── scripts/         # Data seed scripts
│   ├── alembic/             # Database migrations
│   ├── tests/               # Pytest test suite
│   └── Dockerfile
├── frontend/                # Next.js frontend
│   ├── src/
│   │   ├── app/             # App Router pages
│   │   ├── components/      # UI components
│   │   ├── hooks/           # React Query hooks
│   │   ├── lib/             # Utilities
│   │   ├── stores/          # Zustand state management
│   │   └── types/           # TypeScript type definitions
│   └── Dockerfile
├── deploy/                  # Deployment configs
│   ├── nginx/               # Nginx reverse proxy
│   └── postgres/            # Database init scripts
├── docker-compose.yml       # Development environment
├── docker-compose.prod.yml  # Production environment
└── Makefile                 # Build commands

Contributing

We welcome contributions of all kinds! Please read our Contributing Guide to get started.

Good First Issues

Look for issues labeled good-first-issue to find beginner-friendly tasks.

Contributors

Thanks to all contributors who have helped make PrivClaw better:

License

This project is licensed under the MIT License.

Support

If you find PrivClaw useful, please consider giving it a star! Your support motivates us to keep improving.

About Me

19 years old, a college student passionate about AI, just getting started with AI development.

Contact