Mangrove Agent Capabilities Audit

Last updated: 2026-03-09

Container Environment

Base image: node:22-bookworm-slim (Debian Bookworm), runs as root.

System packages

• Build tools: build-essential, pkg-config
• Version control: git, gh (GitHub CLI)
• Network: curl, wget, openssh-client, net-tools, dnsutils
• Data processing: jq, ripgrep
• Media: ffmpeg
• Editors: vim, nano
• System: tmux, less, htop, tree, procps
• Python: python3, python3-pip, python3-venv, python3-dev
• Dev libraries: libffi-dev, libssl-dev, libxml2-dev, libxslt1-dev, zlib1g-dev, libjpeg62-turbo-dev, libsqlite3-dev

Python packages (in /opt/agent-python/ venv, on PATH)

• Package manager: uv (can install arbitrary packages at runtime)
• HTTP: requests, httpx
• Web scraping: beautifulsoup4, lxml
• Browser automation: playwright (Chromium installed)
• Data: numpy, pandas, openpyxl, pyyaml, pydantic
• Images: pillow
• Dev tools: ipython, pytest

Node.js

• Node 22 runtime
• openclaw (installed globally)

Model

• Provider: OpenAI (https://api.openai.com/v1)
• Model: GPT-5.4 with reasoning, multimodal (text + image input)
• Context window: 200,000 tokens
• Max output tokens: 16,384

Code Execution

All tool executions are auto-approved (openclaw approvals allowlist add --agent "*" "*" in entrypoint.sh). Agents can:

• Run arbitrary shell commands (bash, Python, Node.js)
• Write and execute code
• Install new packages at runtime (uv, pip, npm)
• Use git for version control
• Use GitHub CLI (if authenticated)
• Process media with ffmpeg
• Automate browsers with Playwright + Chromium
• Make HTTP requests to any endpoint
• SSH into remote servers
• Read/write any file on the container filesystem

Network

• Unrestricted outbound access — no egress filtering
• HTTP/HTTPS via curl, wget, requests, httpx, playwright
• SSH via openssh-client
• DNS via dnsutils (dig, nslookup)
• Full headless browser (Playwright + Chromium)

File System

• Persistent volume: /data (Fly.io volume, survives restarts)
  • /data/workspaces/ — workspace .md files
  • /data/workspaces/memory/ — daily memory logs
  • /data/openclaw.json — config
  • /data/.openclaw/ — OpenClaw internal state (sessions, memory index)
• App directory: /app (baked image, read-only in practice)
• Root access — container runs as root, full filesystem access

Discord Permissions

Participant bots (12 agents) + Tessio

Corleone (admin agent) — all of the above plus:

NOT granted: Administrator, Ban Members

Role hierarchy (top → bottom)

1. Server owner
2. corleone role
3. Human participants
4. Participant bot role (shared)
5. tessio role
6. @everyone

Gateway intents (all bots)

• Message Content, Server Members, Presence

OpenClaw Configuration

Restrictions

Hard (technically enforced)

• maxConcurrent: 1 — one conversation at a time
• maxTokens: 16,384 — output token limit per response
• requireMention: true — only responds when @mentioned in guilds
• historyLimit: 200 — only reads last 200 messages
• Discord role hierarchy — bots can’t affect higher-ranked users
• No voice permissions
• Gateway auth token required for OpenClaw API

Soft (instruction-based only)

• Never share private key or PII with non-owners
• Check with owner before external actions
• Bot-to-bot conversation limit of ~20 messages
• Don’t use heartbeats to initiate new dialogue
• Flatland = no internet (not technically enforced)

Notably absent

• No network egress filtering
• No file system sandboxing
• No package installation restrictions
• No code execution sandboxing
• No rate limiting on API calls or Discord messages (beyond maxConcurrent: 1)

Private Keys (for claiming agents on the website)