Create a Slack app at api.slack.com/apps, enable Socket Mode, and paste the app-level token.
For Gmail, use an App Password. Your credentials are encrypted and never logged.
4. Tools & Permissions
What can this agent do? All actions are policy-checked and audit-logged.
Shell Commands
Run terminal commands in the agent container
iExecute bash commands inside a hardened Docker container. All commands pass through the security policy engine before running.Included
File Read / Write
Read and write files in the agent workspace
iRead and write files within the agent's isolated workspace directory. Sensitive paths (SSH keys, credentials) are blocked by the policy engine.Included
Web Browsing (fetch)
Fetch URLs and extract text content
iLightweight HTTP fetch — retrieves pages and extracts text. Good for APIs and static content. No JavaScript rendering.Included
Full Browser (Chromium)
Headless Chrome for JS-rendered pages, screenshots, form fill
iRuns a headless Chromium instance alongside your agent. Needed for JS-rendered pages, screenshots, form filling, and browser automation. Uses ~500MB extra RAM.+$3/mo
Sub-Agents
Let this agent spawn and control separate worker agents
iYour main agent becomes the brain. It can spin up sub-agents in separate containers to handle tasks — research, coding, data processing — then collect results. Each sub-agent is isolated with its own policy.
1
+$5/mo each
5. Security Policy
Control what the agent is allowed to do. You can customize the policy after deployment.
Default (Recommended)
Blocks destructive commands, sensitive files, and data exfiltration. Good for most use cases.
Strict
Read-only filesystem, no outbound network except allowed domains. For compliance-sensitive environments.
Permissive
Minimal restrictions. Full shell access, outbound network allowed. For development and testing.
Custom YAML
Upload your own policy file or edit after deployment.
Comma-separated. Leave blank to allow all outbound traffic (default policy).
6. Resource Limits
Agent pauses when LLM API spend hits this limit. Change anytime.
Rate limit for inbound messages. Prevents runaway costs.
Writable disk space for the agent container.
6. Access Control (optional)
Restrict SSH and Git access for added security. Leave empty to allow all.
Comma-separated. Empty = allow all.
Comma-separated. Empty = allow all.
Estimated Monthly Cost
Cloud Agent (base)$5.00
Total$5.00 /mo
Billed daily (~$0.17/day). Destroy anytime.
Deploys to Cloudflare Containers. Your agent gets its own isolated VM.
Your API key is billed separately by your LLM provider. TamaleBot only charges for hosting and add-ons — we never mark up API costs.
Import OpenClaw Config
Paste your OpenClaw configuration JSON below. We'll map it to TamaleBot's deploy form so you can launch in seconds.