Alerts

How alerts work

Scheduled scans are silent when clean no message is sent. An alert fires only when new Critical or High findings appear that weren't in the previous scan.

Alert format

⚠️ ClawVitals Plugin v0.1.0 🔌 Regression Detected

Host: mac-mini-home  ·  Scanned: 2026-04-15 08:00 BST
Score: 58 → 51  🔴 RED  (▼ 7 points)

1 new Critical finding, 1 new High finding.

─────────────────────────────────────────
🔴 CRITICAL  NC-GW-001  Gateway auth disabled
Evidence: groups[0].auth.type = "none"
Fix: openclaw gateway auth set --type bearer --token <your-token>
→ https://clawvitals.io/docs/NC-GW-001

🟠 HIGH  NC-VERS-001  OpenClaw update available
Fix: openclaw update
→ https://clawvitals.io/docs/NC-VERS-001
─────────────────────────────────────────

Reply "show clawvitals details" for full report.

Alert rules

Alerts fire only for new Critical or High findings (stable controls only)
Medium, Low, Info findings appear in the full report but do not trigger alerts
If no new Critical/High findings, scheduled scans run silently no message sent
First scan ever: all findings treated as new, full report sent (no prior baseline)
Delivery retry: one retry on failure; if that fails, logged to run file scan not marked failed

Alert threshold

clawvitals config alert_threshold critical

Critical only.

clawvitals config alert_threshold high

Critical + high this is the default.

clawvitals config alert_threshold medium

Critical + high + medium.

Delivery

Alerts are delivered via your OpenClaw messaging surface the same channel you use to run scans (Slack, Signal, iMessage, etc.). No additional configuration is needed.