01
Never miss a webhook
Inbound events are persisted before delivery, so sleeping nodes and deploy restarts do not turn into dropped requests.
The purpose-built alternative to ngrok and Cloudflare Tunnels
Webhooks for private nodes.
Accept public webhook traffic, store it durably, and deliver it to private nodes over outbound WebSocket or pull.
Built for agents
Durable delivery
Private-node friendly
ngrok alternative
Works with Hermes Agent, OpenClaw, and any client that can receive events from an authenticated outbound connection. Using Hermes? Using OpenClaw?
route
/r/github-to-lab
live
delivery state
Stored until your node confirms.
Public providers get a stable endpoint. Private nodes keep control over when work is complete.
01
Ingress accepted
02
Node connected
03
Awaiting ack
02
Keep your node private
Designed for hosts behind NAT, residential routers, private LANs, and agent boxes that should only call outbound.
03
Live WebSocket delivery
Your node opens a persistent WebSocket connection and receives events when they arrive. Authenticated HTTP pull remains available as fallback.
04
Built for operators
Manage routes, inspect recent traffic, retry failures, and understand delivery state from one lightweight dashboard.
Coming from ngrok or Cloudflare Tunnels?
ngrok and Cloudflare Tunnels are excellent general-purpose tools, but clawproxy is focused on durable webhook ingress and private node delivery.
No tunnel dependency
clawproxy runs as a standalone service. Your node connects outbound, so there is no tunnel daemon to babysit on the receiving end.
Events survive restarts
Unlike tunnels that drop in-flight traffic when the process exits, clawproxy persists every event until it is acknowledged delivered.
Free while in beta
clawproxy is free while in beta. It is open source, so you can also run the whole relay yourself.
Keep the webhook path public and the node private.
clawproxy receives inbound webhook traffic on the public internet and hands it to private agent nodes through authenticated outbound requests.
Expose a public route
Create a clawproxy route and point GitHub, Stripe, Slack, or any webhook provider at the generated URL.
Queue every inbound event
Each request is validated, accepted, and stored durably before your private node touches it.
Deliver in real time or on demand
Your node receives events instantly over WebSocket, or falls back to authenticated HTTP polling when that fits better.
System overview
Webhook events travel from the public internet to your private node without exposing a single port.
Provider
Public internet
- GitHub
- Stripe
- Slack
- Any webhook service
webhook POST
clawproxy
Public cloud
- Accepts & validates
- Saves events until delivery
- Manages delivery state
outbound pull / events
OpenClaw node
Your private network
- Polls for new events
- Processes locally
- Acknowledges delivery
Your node always initiates the connection outbound. No open ports or firewall rules required.
Public ingress on one side. Secure outbound delivery on the other.
Built for the common reality that your software can call out, but should not be exposed directly to the internet.
clawproxy.io