OpenClaw on Mattermost

Mattermost is the self-hostable team chat, and OpenClaw reaches it through a downloadable plugin that connects with a bot token and listens to WebSocket events; channels, private channels, group DMs and DMs are all supported. The setup is four steps, and the one surprise is a guard the docs put in a note: a Mattermost server on a private, LAN or tailnet address is blocked by default, because outbound requests pass through the same anti-SSRF policy as everything else. Here is the setup, the minimal config, that guard, and the native slash commands.

The setup

• Install the plugin from its package and check the application result.
• Create a Mattermost bot account, copy its token, and add the bot to the teams and channels it should read.
• Copy the server’s base URL, a trailing API path is stripped automatically, then configure OpenClaw, enabled, the bot token, the base URL and pairing as the DM policy, or use the channel wizard with the token and URL flags, and start the Gateway.

The private-network guard

A self-hosted Mattermost on a private, LAN or tailnet address is exactly where many teams run it, and by default OpenClaw’s outbound requests to it are blocked, because private and internal IPs are refused by the SSRF guard. The opt-in is a network setting whose name starts with dangerously, at the channel level or per account, and the name is the point: you are telling the Gateway that this internal address is one you trust.

Native slash commands are opt-in.

Native slash commands

• When enabled, OpenClaw registers commands with an oc prefix on every team the bot belongs to, status, model, models, new, help, think, reasoning, verbose and queue, and receives their callbacks as posts on the Gateway’s HTTP server.
• With native skills enabled, each skill is registered as a command of its own.
• A callback path is configurable, and a callback URL is for the case where Mattermost cannot reach the Gateway directly, behind a reverse proxy or through a public URL.

OpenClaw on Matrix is the other self-hosted chat the docs cover in the same shape, and OpenClaw not responding the ladder when the bot is in the channel and silent.

On Diali

Mattermost is on Diali’s connectable list: the server, the bot account and the token are yours, and the Gateway that connects to them is ours, which also means the private-network question becomes one of reachability from our side rather than a flag in a file. Hosted OpenClaw on Diali is the assistant and Security on Diali describes the boundary.

• A bot token and a base URL; pairing by default.
• A private server is blocked until you opt in by name.
• Slash commands are opt-in and register on every team.