trustclaw Setup Guide: Open Source TypeScript AI Tool

TL;DR

TL;DR: trustclaw is an emerging open-source developer tool with 715 stars; this guide follows the official README instead of guessing install steps.

Source and Accuracy Notes

This guide is based on the repository README and docs links detected at the official docs source. Extracted sections include: ⚡ Deploy your own in seconds, ⚠️ Before deploying to production, 🧰 Manual setup (local dev).

Important rule for this post: when the README does not provide a command, this guide says so instead of inventing one. GitHub projects change quickly, so always compare this article with the current README before running commands.

What Is trustclaw?

trustclaw is an open-source project hosted at ComposioHQ/trustclaw. Repository summary: A self-hostable personal AI agent with vector memory, Composio tools, and Telegram.

Repository signals at write time:

Official GitHub repo: ComposioHQ/trustclaw
README / docs source: https://github.com/ComposioHQ/trustclaw/blob/main/README.md
Stars: 715
Forks: 171
Open issues: 14
Main language: TypeScript
License: MIT
Created: 2026-05-05
Last updated: 2026-05-26

Docs-Derived Setup Notes

The following notes come from headings and text extracted from the official README and linked docs pages. They are not generic install guesses.

⚡ Deploy your own in seconds: Click here to use the Vercel Template: [![Deploy with Vercel]](https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2FComposioHQ%2Ftrustclaw&project-name=trustclaw&repository-name=trustclaw&env=BETTERAUTHSECRET,COMPOSIOAPIKE
⚠️ Before deploying to production: README section exists, but text is mostly commands, images, or links.
🧰 Manual setup (local dev): If you’d rather skip the deploy CLI and run TrustClaw locally: For local AI Gateway access, run vercel link && vercel env pull to get a short-lived OIDC token, or set AIGATEWAYAPIKEY manually. For Telegram, point your bot’s webhook at /api/

Step 1: Clone the Official Repository

Cloning is safe to document because it comes from the official GitHub repository URL. After cloning, read the README before installing dependencies.

git clone https://github.com/ComposioHQ/trustclaw.git
cd trustclaw

Step 2: Follow README Commands

Use these commands only because they were found in README or linked docs setup, usage, configuration, or example sections. If a command is missing, check the official README link above.

README Command 1: 🧰 Manual setup (local dev)

pnpm install
cp .env.example .env       # fill in DATABASE_URL, BETTER_AUTH_SECRET, COMPOSIO_API_KEY
pnpm prisma db push        # apply schema (Postgres + pgvector required)
pnpm dev                   # http://localhost:3000

Step 3: Verify Configuration Requirements

Look for environment variables, API keys, model settings, service URLs, or Docker configuration mentioned in the README sections. Do not assume defaults for AI tools because they often depend on local models, cloud APIs, or workspace-specific settings.

If the README includes an environment example, copy that exact example file and fill in local values. If no environment example is documented, avoid creating one from guesswork.

Step 4: Run a Small README-Based Test

Use the smallest command documented by the repo. Good first tests include a help command, example command, local demo, or test command only if the README explicitly shows it.

If the README does not document a smoke test, open issues and examples before trying the tool on real code or private data.

Step 5: Evaluate Before Adopting

Use this checklist before adding trustclaw to a real project:

Does the README explain installation, configuration, and common errors?
Do documented commands run on your machine without extra hidden steps?
Are issues and pull requests active?
Is the license compatible with your use case?
Are releases or tags available?
Can you pin a version or commit SHA?
Does it need access to secrets, files, browsers, shells, or production systems?

Security Notes

Treat every new developer tool as untrusted until reviewed. This matters more for AI agents, CLIs, browser automation tools, and code generators because they may read files, execute shell commands, or send data to external APIs.

Safer first-run habits:

Run it in a temporary folder or container.
Read install scripts before executing them.
Avoid piping remote scripts directly into bash.
Use a test API key with limited permissions.
Check network calls if the tool handles private code or data.

FAQ

Q: Where is the official GitHub repository? A: The official repo is ComposioHQ/trustclaw.

Q: Are install commands guessed? A: No. Commands in this post are extracted from README or linked docs sections. If no README command is found, the post tells you to use the official docs instead of inventing commands.

Q: How do I avoid duplicate coverage later? A: This blog tracks covered repositories in .data/written-repos.txt, using one lowercased owner/repo entry per line.

Q: When is the thumbnail generated? A: The generator creates a MiniMax AI image, optimizes it to WebP, and uploads it to Cloudflare R2 before writing the MDX post, so the committed article already points to the final public image URL.

Conclusion

trustclaw is worth evaluating only after reading the official README and running the documented setup path. Start with ComposioHQ/trustclaw, compare the extracted commands above with current docs, and test in a safe environment before using it on production code or private data.