
Research
/Security News
Coruna Respawned: Compromised art-template npm Package Leads to iOS Browser Exploit Kit
Compromised npm package art-template delivered a Coruna-like iOS Safari exploit framework through a watering-hole attack.
Dr. Claw — Desktop and mobile UI for Claude Code, Cursor CLI, Codex, and OpenRouter with Research Lab
Full-stack research workspace.
Dr. Claw is a general-purpose AI research assistant designed to help researchers and builders execute end-to-end projects across different domains. From shaping an initial idea to running experiments and preparing publication-ready outputs, Dr. Claw keeps the full workflow in one place so teams can focus on research quality and iteration speed.
Manual work is too slow. Fully automated AI is too generic. Vibe Researching is the new frontier. Dr. Claw turns your Research Taste into outsized outcomes with Agentic Execution--so you can move faster, think bigger, and still hold the line on scientific rigor.
2026-04-08 — One click to launch fully autonomous research! Pick a tool pack (ARIS, Autoresearch, DeepScientist), hit configure, choose a workflow in Chat — and watch the agent run your entire research pipeline from idea to paper while you sleep.2026-04-06 — Dr. Claw now runs as a native desktop app! Grab the .dmg / .exe from GitHub Releases, or run npx dr-claw for zero-setup instant start.2026-04-06 — Research Lab and Files now live side-by-side as switchable tabs in the right sidebar — everything you need, one glance away.2026-04-06 — Preview any project file inline with a sleek pill toggle and sidebar browser — no more context-switching!2026-04-06 — Love the terminal? Run dr-claw chat for a fully agentic session with any OpenRouter model — zero browser required.2026-03-30 — Fine-tune your AI's thinking! Codex reasoning effort and Gemini thinking strength selectors are now right in Chat.2026-03-30 — Dr. Claw automatically detects your local GPU resources — ready to put that hardware to work.2026-03-28 — Unlock hundreds of models (GPT-5, Claude, Gemini, DeepSeek, Llama, Kimi, and more) with a single API key. The world's models at your fingertips!2026-03-26 — Crashed mid-session? No sweat — hit the retry button and pick up right where you left off.2026-03-26 — Port already taken? Dr. Claw finds a free one automatically. One less thing to worry about.2026-03-26 — Tasks auto-load into Chat with a handy badge dropdown — just click and go!2026-03-26 — Sessions are now auto-tagged by research stage — instantly see where each conversation stands.2026-03-24 — New skill for crafting review rebuttals — turn reviewer feedback into publication-ready responses.2026-03-21 — Run multiple sessions in parallel with smart naming — juggle projects like a pro!2026-03-21 — Accidentally deleted a project? Relax — it's in the trash, ready to be restored.2026-03-21 — Full CLI control plus an OpenClaw integration for mobile-friendly, voice-ready research management.2026-03-20 — Manage your papers with a streamlined picker and local Zotero support — your literature, organized.2026-03-20 — Stage, commit, diff, and switch branches without ever leaving the app. Version control, built in.2026-03-14 — Stay on top of research-relevant updates right inside your workspace — never miss a trending paper!inno-pipeline-planner skill to interactively generate a structured research brief and task list — no manual templates needed| Artifact | Location | Description | |
|---|---|---|---|
| 📚 | Survey reports | Survey/reports/ | Literature reviews with citations from arXiv, Semantic Scholar, and web sources |
| 💡 | Research ideas | Ideation/ideas/ | Brainstorming outputs with multi-persona evaluation scores |
| 🔬 | Experiment code | Experiment/core_code/ | Implementation from the plan → implement → judge loop |
| 📊 | Analysis results | Experiment/analysis/ | Statistical analysis, tables, and paper-ready figures |
| 📝 | Paper draft | Publication/paper/ | Academic manuscript (IEEE/ACM format) with citations and LaTeX math |
| 🎞️ | Presentation | Promotion/slides/ | Slide deck, TTS narration audio, and demo video |
See docs/pipeline-outputs.md for the full artifact list and project directory structure.
Project Dashboard — Start from the project overview, review status, and launch end-to-end automation.
Skill Library — Browse reusable research skills across ideation, experimentation, and writing.
News Dashboard — Follow research-relevant updates without leaving the workspace.
Desktop App (Beta): Want to skip the setup below? Download the latest
.dmg(macOS) or.exe(Windows) installer from GitHub Releases and run it directly. The desktop app is currently in beta — for a more stable experience, follow the full installation steps below.
.nvmrc)node-pty and better-sqlite3. If npm install fails, see FAQ.Cursor agent support is in progress and coming soon.
No cloning or manual setup required — just run:
npx dr-claw
Or install globally for repeated use:
npm install -g dr-claw
dr-claw
Then open your browser at http://localhost:3001 to create your account and start using Dr. Claw.
git clone https://github.com/OpenLAIR/dr-claw.git
cd dr-claw
npm install
cp .env.example .env
# Edit .env with your preferred settings (port, etc.)
Need custom ports, auth, or workspace settings? See docs/configuration.md.
# Development mode (with hot reload)
npm run dev
Then create your account via the browser http://localhost:5173.
There are two ways to interact with Dr. Claw: the frontend UI workflow or the terminal-only. The UI provides richer visualization but may encounter occasional bugs; the terminal approach is more stable and lightweight.
Open your browser at http://localhost:5173 (or the port you configured in .env).
Open a second terminal (keep npm run dev running in the first) and install the drclaw CLI harness:
pip install -e ./agent-harness
Then log in with the credentials you created during setup:
drclaw auth login --username YOUR_USERNAME --password YOUR_PASSWORD
Install at least one agent CLI (if you haven't already):
| Agent | Install | Auth |
|---|---|---|
| Claude Code | npm install -g @anthropic-ai/claude-code | claude → follow OAuth prompt |
| Gemini CLI | npm install -g @google/gemini-cli | gemini → Google sign-in, or export GOOGLE_API_KEY=... |
| Codex CLI | npm install -g @openai/codex | codex login, or export OPENAI_API_KEY=... |
| OpenRouter | No CLI needed | export OPENROUTER_API_KEY=sk-or-... (get a key at openrouter.ai/keys) |
OpenRouter lets you use any model (GPT-5, Claude, Gemini, DeepSeek, Llama, Mistral, Qwen, etc.) through a single API key. Select your model in the UI or set
OPENROUTER_MODELin.env.
Navigate to the project directory you want to work in and launch any of the agents:
cd /path/to/your/project
claude # or: gemini | codex
Skills from dr-claw/skills/ are automatically symlinked into each project's .claude/skills/ directory when the project is created, so the agent discovers them without extra configuration. You can also reference any skill manually inside a session:
> Read .claude/skills/inno-experiment-analysis/SKILL.md and follow it to analyze my results.
For a lightweight terminal-only experience using any OpenRouter model, use the built-in dr-claw chat command. No browser or UI required — just an interactive agentic session with full tool-calling capabilities (file I/O, shell, grep, glob, web search/fetch).
# Make sure OPENROUTER_API_KEY is set (or pass --key)
export OPENROUTER_API_KEY=sk-or-...
# Launch a chat session with any model
node server/cli.js chat --model moonshotai/kimi-k2.5
You can also pass the API key inline:
node server/cli.js chat --model anthropic/claude-sonnet-4 --key sk-or-your-key
| Flag | Description |
|---|---|
--model <slug> | OpenRouter model slug (e.g., moonshotai/kimi-k2.5, anthropic/claude-sonnet-4, deepseek/deepseek-r1) |
--key <key> | OpenRouter API key (defaults to OPENROUTER_API_KEY env var). Prefer the env var over --key to avoid exposing secrets in shell history. |
Browse all available models at openrouter.ai/models.
# Development mode (launches Electron with hot reload)
npm run desktop:dev
# Build distributable installer (.dmg / .exe)
npm run desktop:dist
For details on the desktop architecture, IPC bridge, and CI/CD release process, see electron/README.md.
If agent web search does not work later, see Troubleshooting Web Search below.
OpenClaw connects to Dr. Claw through the
drclawCLI, giving you project control, smart digests, and proactive notifications — all from your phone or chat app.
┌─────────────────────────────────────────────────────────────┐
│ User (mobile / chat / voice) │
│ ↕ │
│ OpenClaw ── secretary layer ──────────────────────────┐ │
│ │ runs local `drclaw ...` receives push msgs │ │
│ ↓ ↑ │ │
│ drclaw CLI ── stable control plane ──────────────┐ │ │
│ │ JSON + openclaw.* schema WebSocket │ │ │
│ ↓ │ │ │ │
│ Dr. Claw Server Watcher ────┘ │ │
│ (projects, sessions, pipelines, artifacts) │ │
└─────────────────────────────────────────────────────────────┘
The integration has three layers:
| Layer | What it does |
|---|---|
| Control plane | OpenClaw executes drclaw --json ... commands locally |
| Structured contract | JSON responses carry a versioned openclaw.* schema payload |
| Proactive delivery | An event-driven watcher pushes important changes to Feishu / Lark |
npm run dev or drclaw server on)exec capability1. Start the server
npm install && npm run dev # or: drclaw server on
drclaw --json auth status # verify reachability
drclaw server statusonly reports the daemon fromdrclaw server on. If you started Dr. Claw withnpm run dev, it may showSTOPPEDeven thoughhttp://localhost:3001is working — useauth statusas the real check.
2. Install the CLI
pip install -e ./agent-harness
drclaw --help
If drclaw is not on your PATH:
PYTHONPATH=agent-harness python3 -m cli_anything.drclaw.drclaw_cli --help
3. Authenticate
drclaw auth login --username <user> --password <pass>
drclaw --json projects list # should return your projects
4. Link OpenClaw
drclaw install --server-url http://localhost:3001
# with push channel:
drclaw install --server-url http://localhost:3001 --push-channel feishu:<chat_id>
This copies the Dr. Claw skill, installs wrapper scripts, and saves the server URL and CLI path.
5. Verify the core loop
Run these four commands from OpenClaw — if they all return valid JSON, the integration is live:
drclaw --json projects list # resolve projects
drclaw --json chat waiting # find sessions needing input
drclaw --json digest portfolio # cross-project summary
drclaw --json workflow status --project <project> # single-project status
6. Reply into a session
drclaw --json chat waiting # pick a session
drclaw --json chat reply --project <proj> --session <sid> -m “Continue with option B.”
drclaw --json chat waiting --project <proj> # confirm it cleared
For multi-turn discussion within the same project:
drclaw --json chat project --project <proj> --session <sid> -m “Summarize blockers.”
Machine-facing commands return a versioned openclaw field. Current families:
| Schema | Purpose |
|---|---|
openclaw.turn.v1 | Single chat turn summary |
openclaw.project.v1 | Project digest with status, counts, and next actions |
openclaw.portfolio.v1 | Cross-project overview with recommendations |
openclaw.daily.v1 | Daily digest |
openclaw.report.v1 | Mobile-ready report payload |
openclaw.event.v1 | Watcher event with derived signals |
Client rendering tips:
| When you need to... | Read this field |
|---|---|
| Decide whether to interrupt the user | openclaw.decision.needed |
| Show quick actions or voice suggestions | openclaw.next_actions |
| Render a compact summary | openclaw.turn.summary or openclaw.focus |
| Handle watcher notifications | openclaw.event.v1.event.signals |
Always prefer the
openclawpayload over rawreplytext when both are present.
Full contract: agent-harness/cli_anything/drclaw/SCHEMA.md
The watcher is event-driven — it subscribes to Dr. Claw WebSocket events and only notifies on attention-worthy changes.
# Configure push channel
drclaw openclaw configure --push-channel feishu:<chat_id>
# Manage the watcher
drclaw --json openclaw-watch on --to feishu:<chat_id>
drclaw --json openclaw-watch status
drclaw --json openclaw-watch off
How it works:
WebSocket event → project resolution → snapshot diff → signal derivation
↓
dedup (6h TTL) ← stable signature + signal kinds
↓
openclaw agent --deliver → Feishu / Lark summary
(fallback: plain bridge push)
Derived signals:
| Signal | Meaning |
|---|---|
human_decision_needed | Agent requests permission for a tool call |
waiting_for_human | Session is blocked on user input |
blocker_detected | A task transitioned to blocked state |
blocker_cleared | A previously blocked task is now unblocked |
task_completed | One or more tasks finished |
next_task_changed | The recommended next task has changed |
attention_needed | General attention signal |
session_aborted | A session execution was aborted |
State and logs:
~/.drclaw/openclaw-watcher-state.json~/.drclaw/logs/openclaw-watcher.logWhen OpenClaw calls openclaw agent --local repeatedly, use the wrapper script to avoid session-lock collisions:
agent-harness/skills/dr-claw/scripts/openclaw_drclaw_turn.sh \
--json -m “Use your exec tool to run \`drclaw --json digest portfolio\`. Return only raw stdout.”
Rule of thumb: stable serial turns are always better than risky parallel turns.
Your OpenClaw integration is complete when all of these work:
digest portfolio summaryAt that point, OpenClaw becomes Dr. Claw's mobile secretary. Users can speak naturally:
”Which projects are waiting for my reply?” ”Summarize this project's progress and blockers.” ”Reply to that session: go with option B and report back.” ”Give me a cross-project summary and what to focus on today.” ”I have a new idea — create a project, discuss it with me, and start planning.”
Dr. Claw reads local settings from .env. For most users, the only required step is copying .env.example to .env, but these are the settings you are most likely to adjust early:
PORT: backend server portVITE_PORT: frontend dev server portHOST: bind address for the frontend and backendJWT_SECRET: required before exposing Dr. Claw beyond localhostWORKSPACES_ROOT: default root for new project workspacesFor the full environment reference and deployment notes, see docs/configuration.md.
Auto Research email notifications are configured inside the app at Settings → Email. The v1 flow supports Claude Code, Codex, Gemini, and OpenRouter engines for unattended task execution, and interrupted runs are automatically reconciled so they do not remain stuck in running.
OpenRouter is integrated as a first-class provider, giving you access to hundreds of models (GPT-5, Claude, Gemini, DeepSeek, Llama, Mistral, Qwen, Kimi, and more) through a single API key.
export OPENROUTER_API_KEY=sk-or-....env file: add OPENROUTER_API_KEY=sk-or-... to your project .envOpenRouter is also available in Auto Research on the Project Dashboard — select it as the provider and pick any model.
No browser needed. The dr-claw chat CLI gives you a fully agentic terminal session:
# Basic usage
node server/cli.js chat --model moonshotai/kimi-k2.5
# With an explicit API key
node server/cli.js chat --model deepseek/deepseek-r1 --key sk-or-your-key
The CLI supports the same tools as the UI (file I/O, shell, grep, glob, web search, web fetch, todo). Type your message and the agent will execute multi-step research tasks autonomously.
Set OPENROUTER_MODEL in .env to change the default model used when none is specified:
OPENROUTER_MODEL=moonshotai/kimi-k2.5
If unset, the default is anthropic/claude-sonnet-4.
The core feature of Dr. Claw is the Research Lab.
The typical flow is:
.pipeline/docs/research_brief.json and .pipeline/tasks/tasks.json.For full step-by-step operations, see Usage Guide below.
After starting Dr. Claw, open your browser and follow the steps below.
When you first open Dr. Claw you will see the Projects sidebar. You have two options:
.claude/, .agents/, .gemini/, standard workspace metadata, linked skills/ directories, preset research dirs (Survey/references, Survey/reports, Ideation/ideas, Ideation/references, Experiment/code_references, Experiment/datasets, Experiment/core_code, Experiment/analysis, Publication/paper, Promotion/homepage, Promotion/slides, Promotion/audio, Promotion/video), and instance.json at the project root with absolute paths for those directories. Cursor agent support is coming soon.Default project storage path: New projects are stored under
~/dr-clawby default. You can change this in Settings → Appearance → Default Project Path, or set theWORKSPACES_ROOTenvironment variable. The setting is persisted in~/.claude/project-config.json.
After creating or opening a project, Dr. Claw opens Chat by default. If no research pipeline exists yet, an onboarding banner appears with a Use in Chat button that injects a starter prompt.
Describe your research idea — even a rough one is fine. The agent uses the inno-pipeline-planner skill to ask clarifying questions and then generates:
.pipeline/docs/research_brief.json (your structured research brief).pipeline/tasks/tasks.json (the task pipeline)Switch to Research Lab to review the generated tasks, progress metrics, and artifacts. Then execute tasks:
If you want Dr. Claw to execute the generated task list end-to-end for you, use Auto Research:
Notification Email, Sender Email, and Resend API Key..pipeline/docs/research_brief.json and .pipeline/tasks/tasks.json.running.Auto Research Hub (sidebar → Auto Research) lets you browse and configure third-party research tool packs. Three packs are available:
| Pack | Description | Dependencies |
|---|---|---|
| ARIS | End-to-end autonomous pipeline with cross-model adversarial review | MCP Reviewer required |
| Autoresearch | Goal-directed iteration engine with 9 subcommands | Zero dependencies |
| DeepScientist | 13-stage research OS (ICLR 2026) with 50+ templates | Zero dependencies |
How to use:
Zero-dependency packs (Autoresearch, DeepScientist) work out of the box — no configuration step needed.
If the agent cannot search webpages, your current permission settings are likely too restrictive. Also check whether a runtime network lock is still active for the process.
echo "${CODEX_SANDBOX_NETWORK_DISABLED:-0}"
If the output is 1, network requests can remain blocked even if Settings permissions are opened. Remove or override this variable in your deployment or startup layer (shell profile, systemd, Docker, PM2), then restart Dr. Claw.
WebSearch and WebFetch in Allowed Tools.google_web_search and web_fetch in Allowed Tools when web access is required.Codex permission mode notes:
sandboxMode=danger-full-access with full disk and network access.Security note:
Each agent may require a one-time trust confirmation before it can execute code in your project directory. If Chat freezes or shows a trust prompt, switch to the Shell tab inside Dr. Claw and approve the prompt there.
Steps:
By default, trust flow is already enabled in Dr. Claw, so you usually do not need to manually run extra trust commands.
The trust decision is persisted per directory — you only need to do this once per project.
Shell tab not working? If the Shell tab shows
Error: posix_spawnp failed, see docs/faq.md for the fix, then retry.
You can switch tabs at any time:
| Tab | What it does |
|---|---|
| Chat | Start here. Use it to describe your research idea, generate a pipeline, and run tasks with the selected agent. |
| Survey | Review papers, literature graphs, notes, and survey-stage tasks for the current project. |
| Research Lab | Review the research brief, task list, progress, and generated artifacts in one place. |
| Skills | Browse installed skills, inspect their contents, and import additional local skills. |
| Compute | Manage compute resources and run experiment workloads from one place. |
| Shell | Use the embedded terminal when you need direct CLI access, trust prompts, or manual commands. |
| Files | Browse, open, create, rename, and edit project files with syntax highlighting. |
| Git | Inspect diffs, stage changes, commit, and switch branches without leaving the app. |
Dr. Claw now uses the generated Pipeline Task List as the execution flow.
The project includes 100+ skills under skills/ to support research tasks (idea exploration, code survey, experiment development/analysis, writing, review, and delivery).
These skills are discovered by the agent and can be applied as task-level assistance throughout the workflow.
If you use Claude Code as your primary coding agent and want Dr. Claw's research pipeline directly in your terminal — without running the full web UI — check out the standalone Claude Code plugin:
The plugin provides 4 slash commands (/drclaw:setup, /drclaw:status, /drclaw:run, /drclaw:reset) that let you initialize research projects, track progress across all 5 pipeline stages, and execute tasks — all from within a Claude Code session.
Inside any Claude Code session, run:
/plugin marketplace add OpenLAIR/dr-claw-plugin-cc
/plugin install dr-claw@dr-claw
/reload-plugins
The plugin is installed and will be available in future sessions. Run /drclaw:setup to initialize a new research project.
Scope options: By default the plugin is installed to your user scope (available in all projects). Add
--scope projectto install it for a specific project only, or--scope localfor a machine-local install.
research_brief.json and tasks.json schemas as the full Dr. Claw workspace, so you can switch between themNote: The plugin bundles a snapshot of skills from this repository. Skills are synchronized manually — see the plugin repo's README for details.
Dr. Claw is fully responsive. On mobile devices:
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Frontend │ │ Backend │ │ Agent │
│ (React/Vite) │◄──►│ (Express/WS) │◄──►│ Integration │
│ │ │ │ │ │
└─────────────────┘ └─────────────────┘ └─────────────────┘
🔒 Important Notice: Agent permissions are configurable per provider. Review Settings → Permissions before enabling broad file, shell, or web access.
To use web and tool-heavy workflows safely:
Recommended approach: Start with the safest permission mode that still lets you complete the task, then relax settings only when needed.
We welcome contributions! Please follow these guidelines:
git clone <your-fork-url>npm installgit checkout -b feature/amazing-featurenpm run typecheck && npm run buildgit push origin feature/amazing-featureFor setup help and troubleshooting, see FAQ.
Dr. Claw was previously known as VibeLab. For users migrating from VibeLab, we provide a compatibility layer during the transition phase:
vibelab command is still supported as an alias for drclaw but will issue a deprecation warning.VibeLab class in the agent-harness is deprecated; please use the DrClaw class instead.~/.drclaw_session.json but will automatically check for and migrate ~/.vibelab_session.json if found.DRCLAW_URL and DRCLAW_TOKEN are preferred, but VIBELAB_URL and VIBELAB_TOKEN are still supported as fallbacks.Timeline: We plan to remove legacy vibelab support in Version 2.0 (estimated Q3 2026). Please update your scripts and integrations as soon as possible.
This repository contains a combined work.
Upstream portions derived from Claude Code UI remain under GNU General Public License v3.0 (GPL-3.0), while original modifications and additions by Dr. Claw Contributors are licensed under GNU Affero General Public License v3.0 (AGPL-3.0).
See LICENSE and NOTICE for the full license texts and scope details.
If you find Dr. Claw useful in your research, please cite:
@misc{song2026drclaw,
author = {Dingjie Song and Hanrong Zhang and Dawei Liu and Yixin Liu and Zongxia Li and Zhengqing Yuan and Siqi Zhang and Lichao Sun},
title = {Dr. Claw: An AI Research Workspace from Idea to Paper},
year = {2026},
organization = {GitHub},
url = {https://github.com/OpenLAIR/dr-claw},
homepage = {https://openlair.github.io/dr-claw},
}
FAQs
Dr. Claw — Desktop and mobile UI for Claude Code, Cursor CLI, Codex, and OpenRouter with Research Lab
The npm package dr-claw receives a total of 18 weekly downloads. As such, dr-claw popularity was classified as not popular.
We found that dr-claw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised npm package art-template delivered a Coruna-like iOS Safari exploit framework through a watering-hole attack.

Company News
As AI accelerates how code is written and shipped, Socket is scaling to protect the software supply chain from the growing wave of attacks targeting open source dependencies.

Company News
Socket is scaling to defend open source against supply chain attacks as AI accelerates software development.