PrivClaw is a secure, enterprise-oriented plugin marketplace, serving OpenClaw workflow customization and solving public plugin security risks for enterprises.

🤝 We welcome contributions! Check out good first issues to get started. All PRs are reviewed and merged quickly!

We provide enterprise-level AI workflow deployment services based on OpenClaw. When enterprises build custom AI workflows, a large number of functional plugins are required.

Public plugin hubs contain unregulated, malicious and unsafe plugins, which bring huge security risks to enterprise usage. To solve this problem, PrivClaw is built as a private, audited, secure AI plugin marketplace.

• We deploy exclusive AI workflows for enterprises.
• Enterprises can only purchase audited, high-security plugins from our platform to avoid security accidents.
• High-quality developers are invited to submit and monetize standardized plugins.
• Form a stable business ecosystem of workflow customization + official plugin supply.

• Full Commercialization — Built-in Alipay payment, wallet system, revenue sharing, and withdrawal. Not a toy project.
• One-Click Deploy — docker compose up -d launches the entire stack in 30 seconds.
• Production-Grade Architecture — FastAPI + Next.js 15 + PostgreSQL + Redis + Celery, cleanly layered.
• Comprehensive Documentation — Detailed architecture docs, local implementation guide, and auto-generated API docs.
• Full-Text Search — PostgreSQL TSVECTOR-powered plugin search with fuzzy matching.
• Security First — CORS, rate limiting, security headers, JWT dual-token auth (HS256/RS256), bcrypt password hashing, AES-256-GCM sensitive data encryption.

git clone https://github.com/privclaw/privclaw.git
cd privclaw
cp .env.example .env
docker compose up -d

Then visit:

• Frontend: http://localhost:3000
• API Docs: http://localhost:8000/docs
• MinIO Console: http://localhost:9001

After running make seed, you'll have 3 demo accounts:

Home Page	Plugin Marketplace	Admin Dashboard

Plugin Detail

• User Authentication (JWT dual token: access + refresh, HS256/RS256)
• User Management (roles: buyer / developer / admin)
• Plugin Marketplace (CRUD + version management + file upload)
• Full-Text Search (PostgreSQL TSVECTOR)
• Category System (tree structure)
• Order System (create, list, auto-close on timeout via Celery)
• Alipay Payment (face-to-face QR code + async callback)
• Wallet Balance Payment
• Wallet System (recharge, withdrawal, transaction records)
• Admin Dashboard (user management, plugin review, order management, withdrawal review)
• Object Storage (MinIO for dev / Aliyun OSS for production)
• Docker Compose (development + production)
• HTTPS (Nginx with self-signed cert + HSTS)
• Rate Limiting (Nginx: auth 3r/m, API 30r/s, frontend 50r/s)
• Security Headers (X-Frame-Options, CSP, HSTS, etc.)
• Sensitive Data Encryption (AES-256-GCM)
• CI/CD Pipeline (GitHub Actions + ruff + pytest coverage)

• WeChat Pay Integration
• Plugin Review System Frontend UI
• Admin Dashboard Data Visualization
• Refresh Token Rotation

• Refund Workflow
• Rating & Review System
• Dark Mode
• Notification System
• Monitoring & Alerting

┌─────────────────────────────────────────────────────────────┐
│                        Nginx (443/80)                       │
│                   SSL + Reverse Proxy + Rate Limit           │
└──────────────┬──────────────────────┬───────────────────────┘
               │                      │
        ┌──────▼──────┐       ┌───────▼──────┐
        │  Frontend   │       │   Backend    │
        │  Next.js 15 │       │   FastAPI    │
        │  (3000)     │       │ Gunicorn ×4  │
        │  standalone │       │   (8000)     │
        └─────────────┘       └──────┬───────┘
                                     │
                    ┌────────────────┼────────────────┐
                    │                │                │
             ┌──────▼──────┐ ┌──────▼──────┐ ┌──────▼──────┐
             │  PostgreSQL │ │    Redis    │ │    MinIO    │
             │    (5432)   │ │   (6379)   │ │   (9000)   │
             └─────────────┘ └──────┬──────┘ └─────────────┘
                                    │
                             ┌──────▼──────┐
                             │   Celery    │
                             │   Worker    │
                             └─────────────┘

• API Docs — Auto-generated Swagger UI
• Contributing Guide — How to contribute
• Code of Conduct — Community guidelines
• Security Policy — Reporting vulnerabilities
• Changelog — Version history

• Docker & Docker Compose
• Python 3.12+ (for running scripts locally)
• Node.js 20+ (for frontend development)

# Initialize environment
make init

# Start all services
make dev

# Run database migrations
make migrate

# Seed demo data
make seed

# Run tests
make test

# View logs
make logs

# Stop all services
make down

# Production deployment
make prod

privclaw/
├── backend/                 # FastAPI backend
│   ├── app/
│   │   ├── api/v1/          # RESTful API routes
│   │   ├── core/            # Config, security, dependencies
│   │   ├── models/          # SQLAlchemy ORM models
│   │   ├── schemas/         # Pydantic validation schemas
│   │   ├── services/        # Business logic layer
│   │   ├── tasks/           # Celery async tasks
│   │   └── scripts/         # Data seed scripts
│   ├── alembic/             # Database migrations
│   ├── tests/               # Pytest test suite
│   └── Dockerfile
├── frontend/                # Next.js frontend
│   ├── src/
│   │   ├── app/             # App Router pages
│   │   ├── components/      # UI components
│   │   ├── hooks/           # React Query hooks
│   │   ├── lib/             # Utilities
│   │   ├── stores/          # Zustand state management
│   │   └── types/           # TypeScript type definitions
│   └── Dockerfile
├── deploy/                  # Deployment configs
│   ├── nginx/               # Nginx reverse proxy
│   └── postgres/            # Database init scripts
├── docker-compose.yml       # Development environment
├── docker-compose.prod.yml  # Production environment
└── Makefile                 # Build commands

We welcome contributions of all kinds! Whether it's fixing bugs, adding features, improving documentation, or suggesting ideas – every contribution matters.

1. Find an Issue: Check out open issues or create a new one.
2. Fork & Clone: Fork the repo and clone it locally.
3. Create a Branch: git checkout -b feature/your-feature-name
4. Make Changes: Write your code and add tests.
5. Submit a PR: Push your branch and open a Pull Request.

Look for issues labeled good-first-issue to find beginner-friendly tasks.

• Read our detailed Contributing Guide
• Join the discussion in Issues
• Contact me directly (see Contact section)

Thanks to all contributors who have helped make PrivClaw better:

geneleo537-afk 💻 📖

Want to be here? Submit your first PR today!

This project is licensed under the MIT License.

If you find PrivClaw useful, please consider giving it a star! Your support motivates us to keep improving.

19 years old, a college student passionate about AI, just getting started with AI development.