Yapay Zeka

Why Enterprise Teams Are Looking Beyond OpenClaw

OpenClaw dominates the AI agent framework space. With 186,000+ GitHub stars and the broadest skill and messaging ecosystem in the category, it is the default starting point for most teams building autonomous agents.

The problem is that popularity and security are not the same thing. As enterprise adoption has accelerated through 2025 and into 2026, the gap between what OpenClaw offers out of the box and what regulated or high-security environments require has become harder to ignore. The CVE disclosures, the malicious skill reports, and the publicly exposed instances are not theoretical risks. They are documented, numbered, and scored.

This article covers the six alternatives worth evaluating, from a team that runs OpenClaw in production every day. We are not switching away from it. We are also not pretending the security posture is adequate without significant hardening.

What follows is a framework comparison structured for enterprise decision-making: what each alternative actually secures, what it gives up, and which one fits which use case. We include a side-by-side comparison table, a decision framework, and honest assessments of what we would and would not switch to ourselves.

Quick Reference: How the Alternatives Stack Up

OpenClaw’s Security Track Record in 2026

OpenClaw has 186,000+ GitHub stars and a massive ecosystem. It is also, as of early 2026, a recurring entry in vulnerability databases.

In February 2026 alone, OpenClaw disclosed multiple CVEs spanning path traversal, missing webhook authentication, arbitrary file reads, and environment variable injection. The most severe, CVE-2026-25253, scored CVSS 8.8 and enabled one-click remote code execution. An attacker could craft a link that, when clicked, exfiltrated a user’s gateway token, connected to their local instance, modified configuration, disabled safety controls, and ran arbitrary commands on the host machine. In plain terms: an attacker sends a link to anyone on your team. If they click it, the attacker controls your agent infrastructure — no password required, no authentication bypass needed, just one click on a malicious URL.

That vulnerability was patched in version 2026.1.29, but the pattern is concerning. CVE-2026-22177 allowed environment variable injection for startup-time code execution. CVE-2026-26329 enabled path traversal through browser uploads. CVE-2026-32064 exposed noVNC sessions without authentication on multi-tenant hosts.

Beyond code vulnerabilities, the ecosystem itself has problems. Security researchers have reported 820+ malicious skills in the ClawHub marketplace. And scans have identified over 135,000 publicly exposed OpenClaw instances, many running unpatched versions.

The cumulative effect matters more than any single CVE. Each vulnerability requires teams to evaluate exposure, apply patches, and verify their deployments are not affected. For enterprise security teams accustomed to change management processes that take weeks, OpenClaw’s patch cadence creates a constant operational burden. And for regulated industries — healthcare, finance, legal — the mere presence of this many vulnerabilities in a production tool raises questions during compliance audits that are difficult to answer with “we patched it.”

None of this means OpenClaw is unusable. It means the default deployment posture, the one most teams run is not built for environments where a breach has regulatory or financial consequences.

What We Actually Run

Fountain City runs OpenClaw in production. Our autonomous SEO research agent (Scott) runs 9 scheduled workflows per week, producing 40+ content briefs per month. Aria handles content writing and publishing. Kai runs conversion optimization. Daisy manages social distribution. These are real agents doing real work on OpenClaw every day.

We stay on OpenClaw because it has the deepest ecosystem, the broadest messaging integrations, and the most mature skill library. For our use case — multi-agent orchestration across content research, writing, optimization, and social distribution — no other framework supports the full workflow without significant custom development. But we do not run defaults. Our security posture includes:

• Agent scoping: Each agent has access only to the systems and tools it needs. No agent can reach another agent’s credentials or data stores.
• Control steps: Agents perform work, then a secondary process reviews output for hallucinations, malicious injection, or actions that deviate from scope.
• Surface reduction: Agents communicate only through controlled channels. No email or other external input sources that could enable prompt injection.
• Downstream sanitation: For agents with external inputs, we sanitize data before passing it to subsequent agents in the system.
• Firewall restrictions: The server sits behind a firewall that allows only specific IP addresses and ports. Without the current tunnel configuration, there is no path in.
• Zero trust on dependencies: We review every dependency for risk and malware before installation. We prefer extending our platform manually rather than relying on community packages until security standards mature.
• Data transients: We audit every location where data is sent, processed, and stored. Running all LLM calls locally is possible for clients who prioritize security over model capability.
• Secrets management: Read-only access, never stored in configuration files, with flags for rotation.
• Credential isolation: Every client gets their own server. No multi-tenant mixing.

This works for us because we built it deliberately. We also apply these same patterns when building AI workflow automation for clients. Most teams evaluating OpenClaw do not have 27 years of operational infrastructure experience to draw on. That is exactly why the alternatives below matter.

The Six Alternatives Worth Evaluating

The AI agent framework space has fractured into specialized approaches since OpenClaw’s security issues became public. The space includes forks, clean-room rebuilds, and frameworks from infrastructure companies with their own agendas. Here is how each option handles enterprise security requirements.

NemoClaw (NVIDIA): Enterprise Security Wrapper

NemoClaw is NVIDIA’s enterprise security wrapper for OpenClaw, announced at GTC on March 17, 2026.

The architecture has three layers. OpenShell provides kernel-level sandboxing for every agent execution — not container-level isolation like NanoClaw, but OS-level sandboxing that runs beneath the application. A YAML-based policy engine defines what each agent can access, what tools it can call, and what data it can read. This is where security teams spend most of their configuration time, defining granular access controls per agent. A privacy router handles hybrid local/cloud inference, keeping sensitive data on local models while routing general tasks to cloud providers. For organizations with data residency requirements, the privacy router is the feature that matters most.

NemoClaw is fully open source and hardware-agnostic at the infrastructure level — it runs on AWS, Azure, GCP, or bare metal, not just NVIDIA hardware. There are two caveats worth knowing. First, the current release is Linux-only; Windows and macOS deployments are not supported. Second, the privacy router’s local inference capability is optimized for NVIDIA’s Nemotron model family. You can use other local models, but the integration is smoother if you stay within NVIDIA’s model ecosystem.

Strengths: Most comprehensive enterprise option for existing OpenClaw users. You keep your skills, your configurations, your messaging integrations. NemoClaw adds the security layer that OpenClaw lacks without requiring migration.

Weaknesses: It is eight days old as of this writing. Nobody has run it in production at scale. The deployment is heavier than raw OpenClaw, adding latency and infrastructure complexity. Linux-only deployment limits options for teams with Windows-based infrastructure. And as CIO coverage noted, NemoClaw does not solve governance, audit trails, or cross-system reasoning. Those are still your problem.

Best for: Teams already running OpenClaw who need enterprise-grade security without ripping out their existing setup. If you have invested months building custom skills, configuring messaging channels, and tuning agent behaviors, NemoClaw lets you add a security layer without starting over. The question is whether you trust a week-old tool to protect production workloads.

NanoClaw: Container-First Security in 700 Lines

NanoClaw takes the opposite approach to OpenClaw’s 430,000+ lines of TypeScript. The entire framework is roughly 700 lines of TypeScript, with around 21,500 GitHub stars. That line count is not a limitation — it is an engineering choice that prioritizes auditability over feature breadth.

The security model is built on container isolation. Every chat group runs in its own sandboxed Docker container. Permission gates are mandatory, not optional. There is a built-in audit log for every action an agent takes. This is the architecture that enterprise security teams want to see during compliance reviews.

Dextra Labs rated NanoClaw highest on security architecture in their SARA assessment framework, specifically for compliance-driven enterprises in healthcare, finance, and legal.

Strengths: The codebase is small enough that a security team can audit the entire thing in a day. Container isolation means a compromised agent cannot touch anything outside its own sandbox. Built-in audit logs satisfy compliance requirements without bolting on third-party tooling.

Weaknesses: NanoClaw requires container and DevOps expertise that not every team has. Setting up Docker-based agent isolation is straightforward for teams with existing container infrastructure, but adds significant complexity for organizations that have not adopted containers. The ecosystem is much smaller than OpenClaw’s — fewer skills, fewer integrations, fewer community examples to learn from. And according to Till Freitag’s analysis, NanoClaw is Claude-only with no multi-LLM support, which limits flexibility for teams running multiple model providers.

Best for: Regulated industries (healthcare, finance, legal) where auditability and container isolation are requirements, not preferences. If your security team’s first question is “can we audit the entire codebase?” and their second question is “can a compromised agent escape its sandbox?”, NanoClaw answers both.

ZeroClaw: The Rust Rewrite at 3.4MB

ZeroClaw starts from the opposite premise. Written in Rust with roughly 26,200 GitHub stars, the entire framework compiles to a 3.4MB binary. It boots in under 10 milliseconds and uses less than 5MB of RAM.

The security model is deny-by-default. Out of the box, a ZeroClaw agent cannot do anything. You explicitly permit each operation: file access, network calls, tool execution. This is the inverse of OpenClaw, where the default posture is permissive and you lock things down after the fact.

ZeroClaw supports 22+ AI providers, includes SQLite-based hybrid search, and can import OpenClaw SOUL.md and IDENTITY.md files directly, which reduces migration friction. The multi-provider support is notable because it means teams are not locked into a single LLM vendor — you can route different tasks to different models based on cost, capability, or data residency requirements.

Strengths: Rust provides memory safety guarantees that TypeScript cannot. The minimal footprint means fewer dependencies, which means fewer attack surfaces and faster patch cycles. The deny-by-default model is what security-first organizations expect.

Weaknesses: The deny-by-default approach has a real cost. Users on Reddit have described ZeroClaw as “oversecured and useless by default,” requiring manual permission grants for basic operations. A task that takes 5 minutes to configure on OpenClaw might take 30 minutes on ZeroClaw because you need to explicitly permit each file path, network endpoint, and tool invocation. The ecosystem is younger than OpenClaw’s, and browser control and canvas features are not available yet.

Best for: Edge deployments, IoT scenarios, or teams where minimal footprint and maximum control over permissions are the primary requirements. If your deployment target is a VPS with 512MB of RAM or a single-board computer running in a factory or retail environment, ZeroClaw is the only serious option.

Moltworker (Cloudflare): Serverless at the Edge

Moltworker is Cloudflare’s adaptation of the OpenClaw model for their serverless infrastructure. Agents run on Cloudflare Workers with R2 buckets for persistent state, giving you a global edge network, automatic scaling, and built-in DDoS protection without managing any infrastructure.

The security argument for Moltworker is essentially the Cloudflare security argument: a mature, battle-tested security stack that has been absorbing attacks at scale for years. You do not manage servers, patch operating systems, or configure firewalls. The trade is that Cloudflare manages all of that for you, which means your agents and their data flow through Cloudflare’s infrastructure.

Strengths: Zero infrastructure overhead. Cloudflare handles scaling, security, and availability. If your team does not want to manage servers, this removes a significant operational burden.

Weaknesses: You are locked into Cloudflare’s infrastructure. Self-hosting is not an option, and migrating away from Moltworker means rebuilding your agent deployment from scratch on a different platform. Pricing at scale can surprise teams who did not model their usage patterns carefully — agent workloads with high-frequency tool calls or large file operations can generate unexpected Worker invocation costs. And you give up the fine-grained execution control that self-hosted alternatives provide.

Best for: Teams that want managed infrastructure and are comfortable with vendor dependency. Good for organizations where “we don’t want to manage servers” is the driving requirement. Moltworker is particularly appealing for teams deploying agents as customer-facing products, where global edge distribution and automatic scaling matter more than fine-grained local control.

Moltis: Enterprise Rust with Rough Edges

Moltis aims for the enterprise Rust space, with roughly 2,000 GitHub stars and around 150,000 lines of code. The project claims zero unsafe code blocks. In Rust, “unsafe” bypasses the borrow checker and memory safety guarantees, so zero usage is a meaningful security property.

The enterprise feature set is ambitious: comprehensive agent management, extensive configuration options, multi-model support, and the Rust memory safety guarantees that security teams value. On paper, it combines the security properties of Rust with the feature depth of OpenClaw.

Strengths: Rust memory safety. Zero unsafe code. Enterprise-oriented feature depth.

Weaknesses: Stability is a documented problem. Users on Reddit’s r/LocalLLaMA have reported that the author rushed features in response to community requests, leading to bugs and reliability issues. In a production environment, framework instability translates directly to agent downtime and unreliable task completion. The community is smaller than any other alternative listed here. Comprehensive features do not help if the runtime is unreliable.

Best for: Teams who need Rust memory safety guarantees today and have the engineering capacity to debug framework issues as they arise. The one reason to bet on Moltis despite the instability: if Rust’s memory model is a hard requirement for your security posture and you cannot wait for the project to mature, Moltis is the only option that combines enterprise feature depth with zero unsafe code. Be prepared to contribute fixes upstream. Worth monitoring for everyone else; worth adopting only if Rust memory safety is a non-negotiable constraint and you have capacity to absorb framework bugs.

Honorable Mentions

PicoClaw is a Go-based framework at under 8MB, targeting IoT and embedded devices. If you need AI agents on $10 hardware — a Raspberry Pi running a monitoring agent, a sensor node making autonomous decisions — PicoClaw is purpose-built for that constraint. The footprint is roughly 8MB with under 10MB of RAM and one-second startup times. It lacks the formal security models of NanoClaw or ZeroClaw, which limits its applicability for compliance-sensitive use cases, but for embedded and edge scenarios where resource constraints dominate, nothing else in the ecosystem comes close.

IronClaw uses trusted execution environments (TEE) for cryptographic verification of agent operations. Every action an agent takes can be cryptographically attested, which provides provable execution integrity that no other framework offers. This matters for scenarios involving financial transactions, legal document processing, or any workflow where you need to prove that a specific agent performed a specific action at a specific time. The adoption footprint is small, and the TEE requirement limits deployment options, but for organizations where verifiable execution is a regulatory mandate, IronClaw is the only option purpose-built for it.

TrustClaw is a managed cloud platform. No infrastructure management, no self-hosting, no server configuration. Good for teams that want a turnkey solution and are comfortable with the tradeoffs of managed platforms — namely, that your agents and data run on someone else’s infrastructure.

Nanobot is a lightweight Python agent framework with roughly 4,000 lines of code. It is educational and approachable, with faster startup and lower memory than OpenClaw. Nanobot works well as a learning tool or for simple agent prototypes, but it is not enterprise-grade and lacks the security architecture of NanoClaw, ZeroClaw, or NemoClaw.

Side-by-Side Comparison

How to Choose: A Decision Framework

Comparison tables are useful for reference. They are less useful for making decisions. Every enterprise has different constraints — compliance requirements, existing infrastructure, team expertise, hardware budgets, integration needs. The framework below maps specific enterprise requirements to specific recommendations, based on what we have seen working with clients evaluating these options.

If you already run OpenClaw and need to harden it: NemoClaw. It wraps your existing deployment with kernel-level sandboxing and policy controls. No migration, no ecosystem loss. The risk is that NemoClaw is brand new, so you are adopting enterprise security tooling that has not been production-tested at scale.

If you are in a regulated industry: NanoClaw. Container isolation, mandatory permission gates, and built-in audit logs are the three things compliance teams ask for first. The tradeoff is a smaller ecosystem and Claude-only LLM support.

If you need minimal footprint or deploy at the edge: ZeroClaw. A 3.4MB binary with under 5MB RAM usage runs on hardware that cannot support OpenClaw or NanoClaw. The deny-by-default model means more configuration upfront, which is either a feature or a burden depending on your team’s tolerance.

If you do not want to manage infrastructure: Moltworker. Cloudflare handles servers, scaling, security, and availability. You give up self-hosting and fine-grained control. For teams where infrastructure management is the problem they are trying to solve, that is the right tradeoff.

If you need enterprise Rust features and can tolerate instability: Moltis. The architecture is sound. The execution is rough. Monitor it, do not commit to it for production workloads today.

Questions to Ask Before Choosing

These are the questions that separate productive framework evaluations from ones that waste a quarter:

• Do you need self-hosting? If yes, Moltworker is off the table. If no, Moltworker removes your biggest operational headache.
• What is your compliance regime? HIPAA, SOC 2, or FedRAMP requirements push you toward NanoClaw’s audit infrastructure. If you can answer “none” honestly, your options open up significantly.
• Do you have container and DevOps expertise? NanoClaw assumes you do. ZeroClaw is a single binary that a developer can deploy in an afternoon.
• What is your hardware budget? ZeroClaw runs on a Raspberry Pi. OpenClaw needs a proper server with at least 1GB of RAM. NemoClaw adds overhead on top of that.
• How many messaging integrations do you need? OpenClaw supports 10+ channels. Most alternatives support fewer. If your agents need to operate across Discord, Slack, WhatsApp, and Telegram simultaneously, the ecosystem size matters.
• Do you already have an OpenClaw deployment? NemoClaw preserves that investment. Everything else requires migration of varying difficulty.
• What is your team’s security expertise? ZeroClaw’s deny-by-default model requires understanding exactly what permissions each agent needs. OpenClaw with NemoClaw is more forgiving — the wrapper adds security without requiring you to define every permission from scratch.

What We Are Watching

We run OpenClaw because, as of today, nothing else matches its combination of ecosystem depth, messaging integrations, and skill library. Our managed autonomous AI agents operate on it daily, and the security measures we described above keep us comfortable with that choice. If you want OpenClaw’s ecosystem with enterprise-grade security but don’t want to build and maintain the hardening layer yourself, that’s exactly what our managed service provides — we handle the infrastructure, the security patching, the monitoring, and the operational burden so you can focus on what your agents do, not how they stay safe.

We will update this article as we test NemoClaw and as the alternative landscape evolves. If you want current findings, this page is where we publish them.

That said, we are watching NemoClaw closely. If the sandbox proves stable in production and the policy engine handles the edge cases that real-world agent workloads generate, NemoClaw becomes the path forward for our deployments. It addresses our biggest concerns without requiring migration.

Specifically, we would test NemoClaw against our most demanding agent patterns: Scott’s 9-workflow weekly schedule with simultaneous web scraping and API calls, Aria’s WordPress REST API publishing pipeline with credential isolation, and Kai’s GA4 data retrieval with cross-agent coordination. These workflows involve concurrent file system access, API authentication, tool execution chains, and inter-agent messaging — the exact scenarios where a security wrapper either proves itself or breaks down.

NanoClaw would be compelling if it added multi-LLM support. We run different models for different tasks (research gets one model, writing gets another, review gets a third). Claude-only is a constraint we cannot work around.

ZeroClaw’s efficiency numbers are impressive, but the ecosystem gap is real. When we need an agent to coordinate across Discord, file systems, web search, and WordPress publishing in a single workflow, the tool and integration library matters as much as the runtime security model. Our content pipeline alone involves 15+ tool integrations per agent — web scraping, REST APIs, file management, semantic search, image generation, messaging, and browser automation. Rebuilding that integration surface on a newer framework is not a weekend project.

We would not switch to anything that sacrifices the skill ecosystem or messaging integrations we depend on. Those are operational requirements, not preferences.

NemoClaw is eight days old. The architecture looks right and the backing is serious, but nobody knows yet whether it holds up under the load patterns that production agent teams generate. We will publish our findings when we do. In the meantime, our recommendation for teams evaluating OpenClaw alternatives today: pick the framework that matches your primary constraint, harden it properly, and build your security posture deliberately rather than relying on defaults.

Frequently Asked Questions

Is OpenClaw safe to use in 2026?

OpenClaw is safe with proper hardening: firewall restrictions, agent scoping, dependency review, secrets management, and keeping versions current. The default deployment posture is not safe for regulated or high-security environments. If you run defaults on a public-facing server, you have a problem. See the “What We Actually Run” section above for the specific hardening measures we apply in our production deployment.

What is the most secure OpenClaw alternative?

The most secure OpenClaw alternative for compliance-driven organizations is NanoClaw, with mandatory container isolation and a 700-line auditable codebase. ZeroClaw’s deny-by-default model is more restrictive at the permissions level but requires more manual configuration. NemoClaw adds the most security to existing OpenClaw deployments without requiring migration. The right choice depends on whether you need to start fresh (NanoClaw or ZeroClaw) or harden what you already run (NemoClaw).

Can I migrate from OpenClaw to NanoClaw or ZeroClaw without starting over?

ZeroClaw supports importing OpenClaw SOUL.md and IDENTITY.md files, which reduces migration effort for agent configurations. NanoClaw requires restructuring your deployment around containers. Neither is a drop-in replacement for the full OpenClaw skill and integration ecosystem. Plan on rebuilding custom skills and testing all messaging integrations — the agent logic ports over, but the tooling around it does not.

Is NemoClaw only for NVIDIA hardware?

No. NemoClaw is fully open source and hardware-agnostic at the infrastructure level. It runs on AWS, Azure, GCP, bare metal, or your own data center — NVIDIA built it, but it does not require NVIDIA GPUs. Two caveats: the current release is Linux-only (no Windows or macOS support), and the privacy router’s local inference is optimized for NVIDIA’s Nemotron model family. GPU acceleration helps but is not required; CPU-only servers work.

Which OpenClaw alternative works best for WhatsApp, Telegram, and Slack?

OpenClaw still has the broadest messaging channel support (10+ platforms). NanoClaw supports WhatsApp through Baileys. ZeroClaw supports 8+ channels. Moltworker inherits OpenClaw’s channel support through the Cloudflare Workers adaptation. If messaging breadth is critical, OpenClaw with NemoClaw hardening is the practical choice.

How much does it cost to run these alternatives?

The frameworks themselves are free and open source (except Moltworker, which uses Cloudflare’s pricing). The primary cost is LLM API usage, which runs roughly $80 to $120 per month for active agents regardless of framework. Infrastructure costs vary significantly: ZeroClaw runs on a $5/month VPS or a Raspberry Pi, OpenClaw and NemoClaw need a proper server (typically $20-80/month for a VPS with adequate RAM), and NanoClaw needs container infrastructure that adds overhead. For a breakdown of agent economics including model costs per task, see our AI agent cost calculator.

Can I use multiple alternatives together?

In theory, you could run NemoClaw-wrapped OpenClaw agents alongside ZeroClaw agents on different tasks. In practice, managing multiple agent frameworks increases operational complexity — different update cycles, different configuration formats, different debugging workflows, different security audit processes. Pick the one that fits your primary requirements and standardize on it. The overhead of maintaining two parallel frameworks almost always outweighs the benefits of mixing features.

What happened to Moltbot and Clawdbot?

Both were early forks that either merged back into the OpenClaw mainline or were abandoned as the ecosystem consolidated around the alternatives listed here. If you see references to either in older comparison articles, they are outdated. The six frameworks covered in this article represent the current state of the market as of March 2026.

When I started building Torus, a multi-core Layer 7 Edge API Gateway from scratch in Node.js, I handled incoming network requests the way I had always seen it done in standard web applications:

TypeScript

let body = '';
req.on('data', (chunk: Buffer) => {
  body += chunk.toString();
});
req.on('end', () => {
  forwardToBackend(body);
});

It worked perfectly for lightweight tests. But as I started pushing concurrent loads and larger payloads through the proxy, my server began to choke. CPU usage spiked to 100%, the event loop lagged, and memory consumption grew uncontrollably until the process crashed.

I had fallen into a classic architectural trap: I was dragging raw TCP payload bytes directly into the V8 JavaScript engine’s memory heap.

Because the V8 heap has a strict memory limit, pulling massive payloads into user-space memory forces the Node.js Garbage Collector (GC) to work overtime. The GC halts the single-threaded event loop to clean up the allocated memory, effectively stalling every other active network connection in the proxy.

I learned a fundamental rule of proxy engineering the hard way:

Proxies shouldn’t read data; they should just move it.

To build a production-grade gateway, I realized I had to bypass the V8 heap entirely. I needed to keep the data in raw C++ memory blocks and move it to the Operating System level. But as I refactored my routing logic to achieve this, I stumbled into a silent, catastrophic flaw in the standard Node.js stream API that brought my entire test suite to a halt.

The First Evolution: Bypassing V8 with .pipe()

The architectural fix required a fundamental shift in how I viewed the data. I had to stop treating payloads as static variables and start treating them as flowing water.

I didn’t need to load an entire 50MB file into memory before forwarding it. I only needed to hold a few kilobytes in a temporary buffer, flush it to the destination, and reuse that memory space.

In Node.js, this is exactly what the node:stream module and Buffer objects are designed for.

A Buffer in Node.js allocates memory outside the V8 JavaScript engine. It utilizes raw C++ memory blocks mapped directly to the OS. By keeping the network chunks as raw Buffers, the payload never enters the JavaScript heap. Because it never enters the heap, the V8 Garbage Collector completely ignores it, leaving the event loop free to handle other connections.

To wire this up, I utilized the native .pipe() method to connect the readable client stream to the writable backend stream:

TypeScript

// Connects the incoming ReadableStream directly to the outgoing WritableStream
clientReq.pipe(proxyReq);

This single line of code acts as an OS-level plumbing system. It takes the incoming TCP stream, reads the raw C++ buffers, automatically manages the backpressure (ensuring a fast client doesn’t overwhelm a slow backend connection), and pushes the bytes directly out to the routing pool.

My CPU usage plummeted. The memory footprint stayed flat, regardless of how large the incoming payloads were. It felt like I had solved the scaling problem entirely.

But .pipe() was hiding a massive, silent vulnerability.

The Plot Twist: The Silent Socket Leak

I thought I had engineered the perfect solution. The proxy was fast, the CPU was idle, and the memory footprint stayed completely flat, regardless of payload size.

Then I ran my integration test suite.

All the assertions passed. I got the green checkmarks. But the terminal just froze. Jest refused to exit, eventually spitting out that infuriating warning: “Jest did not exit one second after the test run has completed.”

My initial reaction was to treat it like a standard web app bug. I meticulously checked my teardown logic, making sure proxyServer.close() was being called and my Redis clients were fully disconnected. I ran the tests again. It still hung.

I had to drop down to the OS level to understand what was actually happening. The Node.js event loop is mathematically programmed to never exit as long as there is an active I/O handle (like a net.Socket) in its queue. Something was keeping a socket alive.

The culprit was .pipe().

When my Jest test fired a dummy request through the proxy and then disconnected, the client-side socket closed gracefully. But I learned a lesson about Node.js streams: .pipe() blindly pushes data; it does not propagate lifecycle events.

When the client dropped, .pipe() did not send an error or close event to the destination stream. It left the backend connection completely open. The proxy was sitting there holding a dead connection to the backend, waiting for network bytes that would never arrive.

I had built a machine that generated half-open sockets. In a production environment, this would silently exhaust the Operating System’s File Descriptors (FDs). Every dropped client connection would permanently lock up an FD until the OS hit its limit and violently crash the Node process with an EMFILE error.

The Fix: stream.pipeline()

The Node.js core maintainers knew .pipe() was dangerously naive for production infrastructure. That is exactly why they introduced stream.pipeline().

Instead of blindly shoving data from one socket to another, .pipeline() acts as a unified state machine that monitors the entire stream chain. It pushes the responsibility of socket teardown back to the Node.js core networking stack where it belongs.

If any stream in the pipeline fails, throws an error, or abruptly closes (like a client dropping off with an ECONNRESET), .pipeline() automatically intercepts it. It destroys all other connected streams in that specific chain and bubbles up a single error for you to catch.

I removed every instance of .pipe() and the dozens of lines of manual .on('error') spaghetti I had written. Because raw TCP proxying requires bidirectional data flow, I replaced it with two parallel, sequential pipelines:

TypeScript

try {
  await Promise.all([
    pipeline(clientSocket, backendSocket),
    pipeline(backendSocket, clientSocket)
  ]);
} catch (err: any) {
  // If either side drops, the pipeline throws, and we clean up natively.
  clientSocket.destroy();
  backendSocket.destroy();
}

The moment I swapped to this architecture and ran my integration suite, the terminal didn’t hang. Jest executed all 18 network tests and exited flawlessly in 2.7 seconds. The event loop was instantly cleared. The silent socket leak was completely eradicated.

Conclusion: Trust Nothing, Understand Everything

Building a multi-core Edge Gateway from scratch taught me that I cannot blindly trust high-level abstractions.

stream.pipe() looks elegant in a standard web tutorial, but in the trenches of raw TCP networking, it is a massive liability. If you are building infrastructure that handles thousands of concurrent connections, you must understand the Operating System-level lifecycle of your File Descriptors and your sockets. If you don’t, your system will slowly bleed to death under load, and logs won’t even tell you why.

If you want to see the exact implementation of this bidirectional TCP routing, you can check out the raw source code for Torus Proxy on my GitHub.

This post originally appeared on the Makko AI blog.

Most pixel art tutorials treat alignment, anchor points, debug positioning, and hitboxes as four separate topics. This week we treated them as one. Every piece of content built directly on the last, covering the complete pipeline any solo developer needs to get a 2D character working correctly in a game engine.

We are walking through this week in reverse, starting with Friday’s payoff and working backwards to show how each day’s content set it up. This is part of the broader one character, two games series — showing how a single 2D character created in Makko Art Studio can power completely different games without rebuilding the art from scratch.

Friday: hitbox alignment, the payoff of the whole pipeline

Friday’s video is the fourth episode in the Horror Platformer series featuring Granny’s Night-Terror and its playable character Grandma Elara. It is also the payoff of everything this week built toward.

Attacks that miss enemies standing directly in front of the player. A character that clips through geometry it should fit through. These are the hitbox problems that make a 2D game feel broken even when the art, animation, and code are all technically correct. The cause is almost always the same: a hitbox configured for the wrong animation state, sized to the maximum extent of the character rather than the majority state, or never updated after the animation was changed.

The video walks through configuring hitboxes per animation state in Makko’s Alignment Editor. The core rule: fit the hitbox to the majority state of the animation, not the maximum extent. A character whose arm extends forward during an attack should not have a hitbox that covers the fully extended position for every frame of the cycle. That produces hits that register before the animation looks like a hit, which feels wrong even if the player cannot articulate exactly why.

The episode closes the full series arc: one pixel art character, two games, zero duplication. Everything from alignment to hitboxes, built once, configured per game through the manifest system.

Thursday: debug collision boxes, making the invisible visible

Hitbox configuration only works if you can see what the engine is doing. Floating or buried sprites are almost never a pure art problem. They are a positioning problem, and you cannot fix what you cannot see.

Enabling visual debug collision boxes during runtime makes the engine’s understanding of your character visible. If the collision box is centered instead of aligned to the feet, that is the problem. If the box is not moving with the sprite, that is the problem. If the box is sized for one animation state but not updated for another, that is where attacks miss and characters clip through geometry they should pass through cleanly.

The fix is always the same: drag, reposition, lock it in, test again. You need to see what the engine sees before you can configure hitboxes correctly.

Wednesday: anchor points, the single pixel that controls everything

Before you can diagnose positioning with debug boxes, the anchor point has to be set correctly. An anchor point is the single pixel the engine uses to calculate position, rotation, and collision.

Most engines default to the center of the sprite rather than the feet. The result is characters that float above the ground by exactly half their height, sink into the ground by exactly half their height, or jitter unpredictably between animation frames. None of those are art problems. They are anchor point problems.

Makko lets you set the anchor point once at the manifest level and it updates automatically across every frame in every animation state. This is a small thing that has a large practical effect on how long it takes to get a 2D character feeling right in-engine.

Tuesday: two posts, one underlying question

Tuesday was the heaviest publishing day of the week. Two posts, two completely different angles on the same underlying question: what does it actually take to get game-ready art out of an AI tool and into a working 2D game?

The Art Studio deep dive answered the workflow question directly. Most solo developers are running four separate tools just to get one character into their engine. Makko Art Studio replaces that entire stack. Describe what you want, and the output arrives with transparent backgrounds, animation frames, and the correct file format already handled.

The second post was a devlog from Tony Valcarcel, one of Makko’s co-founders, documenting how he built over 100 unique card assets for Sector Scavengers, a roguelike salvage game, in 7 days for under $500 with no dedicated artist on the team.

blog.makko.ai

blog.makko.ai

Monday: character alignment, where the pipeline starts

Everything this week traced back to Monday’s post. Perfect art and animation can still look completely wrong in-engine if alignment is off. A character that floats above platforms, sinks into the ground, or shifts position between animation frames is almost never an art problem. It is an alignment problem.

Monday’s post established the three variables that have to work together: anchor point, scale, and position. Makko’s manifest puts all three in a single editor so you can see exactly what you are changing and what effect it has before you commit.

If alignment is wrong at the manifest level, no amount of correct anchor point or hitbox work will fix how the character behaves in-game.

The complete pipeline in order

Step 1: Alignment. Anchor point, scale, and position must be correct at the manifest level first.

Step 2: Anchor point. Set the anchor to the character’s feet. Set it once and it propagates across every frame automatically.

Step 3: Debug collision boxes. Enable them during runtime before configuring hitboxes. Diagnose rather than guess.

Step 4: Hitboxes per animation state. Fit to the majority state, not the maximum extent. Test with debug boxes active.

Everything published this week

• What Is Makko Art Studio? The AI Game Asset Generator Built for Game Developers
• AI Game Development Devlog: How I Built 100 Game Cards in 7 Days Using Makko
• One Pixel Art Character, Two Games: How to Build Genre-Specific Sprite Animations
• The Team Behind Makko AI: Amazon, PAX, and a Different Vision for Game Development

Start Building Now at Makko AI

For technical walkthroughs and live demos, visit the Makko YouTube channel.