Vitto vs OpenClaw: Honest Assessment & Usage Guide

Session 116 | February 2026 This document is a candid engineering assessment, not marketing material.

TL;DR

Vitto is a multi-service AI agent platform with 13 NestJS modules, 90+ MCP tools, multi-agent handoffs, tiered vector memory, multi-LLM routing, and a layered security system. OpenClaw is a single-binary personal AI assistant with 4 core tools, 565+ community skills, and direct OS access.

They solve different problems. OpenClaw is a power-user's personal assistant. Vitto is an enterprise platform for teams running agents at scale with audit trails, cost control, and security.

What's real vs aspirational is detailed below. Read the "Honesty Check" column carefully.

Feature Comparison

Core Agent Capabilities

Messaging / Channels

Security

Enterprise / Compliance

Deployment

What's ACTUALLY Working End-to-End

These features you can use RIGHT NOW with confidence:

1. Submit a task via POST /engine/tasks and watch it execute through ANALYZE-PLAN-EXECUTE-VERIFY phases
2. Send a Slack/WhatsApp/Telegram/Discord message and get a response routed back through the same channel
3. Tool execution with security audit - every tool call is logged to MongoDB with sandbox level, duration, success/failure
4. Semantic memory recall - ask Vitto about past interactions and get vector-similarity ranked results
5. Multi-LLM routing - SmartRouter selects provider by complexity, with failover and history tracking
6. Skill CRUD with versioning - create, update (auto-snapshot), rollback, publish with security vetting
7. Cost guard limits - 25 iterations, 100K tokens, 5-minute max per task enforced
8. SSE event streaming - real-time task progress via GET /engine/events
9. Multi-agent handoffs - delegate tasks to other agents via MCP handoff protocol
10. GDPR export/delete - export or tombstone all user data via security controller

What EXISTS But Is NOT Connected (Dead Code)

These services were built but never wired into the execution flow:

Impact: These represent approximately 40% of the Phases 1-5 code. The services are correctly built, registered in modules, and injectable. They just need callers.

How to Use Vitto Today

Prerequisites

• MongoDB running (local or Atlas)
• .env.local with ANTHROPIC_API_KEY, OPENAI_API_KEY, MONGODB_URI
• Backend running: yarn serve:backend-vitto (port 3003)

Submit a Task

curl -X POST http://localhost:3003/vitto-api/engine/tasks \
  -H "Content-Type: application/json" \
  -d '{
    "request": "Analyze the authentication flow in our codebase and suggest improvements",
    "userId": "user-123",
    "context": {
      "layer": "developer",
      "spaceId": "my-space"
    }
  }'

Stream Task Progress (SSE)

curl -N http://localhost:3003/vitto-api/engine/events

Recall Memories

curl "http://localhost:3003/vitto-api/engine/memories/search?query=authentication+flow&userId=user-123&limit=5"

Manage Skills

# Create a skill
curl -X POST http://localhost:3003/vitto-api/engine/skills \
  -H "Content-Type: application/json" \
  -d '{
    "name": "code-reviewer",
    "description": "Reviews code for security and quality issues",
    "category": "developer",
    "triggers": ["review code", "check code quality"],
    "steps": [{ "action": "analyze", "params": { "focus": "security" } }]
  }'

# Publish (runs security vetting)
curl -X POST http://localhost:3003/vitto-api/engine/skills/{id}/publish

# View version history
curl http://localhost:3003/vitto-api/engine/skills/{id}/versions

# Rollback
curl -X POST http://localhost:3003/vitto-api/engine/skills/{id}/rollback \
  -d '{ "targetVersion": "1.0.0" }'

Check Security Dashboard

# Audit logs
curl "http://localhost:3003/vitto-api/security/audit?limit=20"

# Audit stats
curl http://localhost:3003/vitto-api/security/audit/stats

# Export for compliance
curl http://localhost:3003/vitto-api/security/audit/export/csv > audit.csv

# GDPR export
curl http://localhost:3003/vitto-api/security/compliance/gdpr/export/user-123

Configure Messaging Channels

# Slack: Configure webhook at POST /engine/integrations/slack/events
# Telegram: Set webhook to POST /engine/integrations/telegram/webhook
# Discord: Set webhook to POST /engine/integrations/discord/webhook
# WhatsApp: Configure Twilio webhook at POST /engine/integrations/whatsapp/webhook

Schedule Tasks

curl -X POST http://localhost:3003/vitto-api/engine/schedules \
  -H "Content-Type: application/json" \
  -d '{
    "name": "daily-health-check",
    "cronExpression": "0 9 * * *",
    "taskType": "prompt",
    "taskConfig": {
      "prompt": "Run health checks on all services and report status",
      "layer": "developer"
    }
  }'

Architectural Strengths (What's Genuinely Good)

1. Module isolation is excellent. 13 NestJS modules with clean dependency graph. No circular imports. SecurityModule exports everything downstream needs. Zero DI failures detected.

2. Audit logging is solid. Every tool call hits recordAudit() with sandbox level, input/output, timing, and success/failure. 365-day retention with TTL indexes. Hot cache for fast dashboard reads. This is real SOC 2 foundation.

3. Memory system is sophisticated. Vector embeddings with Atlas $vectorSearch, tiered hot/warm/cold recall, importance scoring that evolves with access frequency. This is genuinely better than OpenClaw's flat Markdown files.

4. Multi-agent handoffs work. MCP-based handoff protocol with WebSocket push, REST fallback, offline queuing, and sentinel reconnection. Tested across Cursor, Claude Code, VSCode, and Chrome extension.

5. Skill versioning is well-designed. Immutable snapshots before every update, semver bumping, full rollback with pre-rollback safety snapshots. The data model is sound.

6. SmartRouter is smart. Cost-based routing with provider failover, routing history, and decision persistence. The in-memory-first + MongoDB-secondary pattern is the right tradeoff for latency.

Critical Gaps to Fix (Prioritized)

P0 — Wire the Dead Code

These are the highest-leverage fixes. The code exists and is tested, it just needs callers:

Total effort: ~35 lines of glue code. This would activate 6 major security features.

P1 — Missing Integration Points

P2 — Architecture Gaps vs OpenClaw

Verdict

Vitto's foundation is strong. The module architecture, memory system, multi-agent handoffs, and audit logging are production-grade. The security services are well-designed and correctly registered.

The main problem is integration, not implementation. ~40% of the security code (Phases 1-5) exists as standalone services that aren't called from the execution flow. Fixing this requires ~35 lines of glue code, not new features.

vs OpenClaw:

• Vitto wins on: security, audit, memory, multi-agent, cost control, multi-tenant, skill versioning
• OpenClaw wins on: simplicity, self-modification, setup speed, community/skills ecosystem, desktop integration
• Neither wins on: both have unfinished edges; Vitto's are documented here, OpenClaw's are security holes

Bottom line: Wire the dead code (P0 items 1-6), and Vitto goes from "impressive architecture with gaps" to "enterprise-ready AI agent platform."