OpenClaw + xCloud

Troubleshoot a broken site with OpenClaw on xCloud

Troubleshooting with OpenClaw means sending a message from WhatsApp, Telegram, Slack or Discord to a runtime that stays on, and letting its xCloud skill and MCP connection read why a site broke and answer in the same chat.

Skill: xcloud:troubleshoot
Toolsets: sites, servers, sites-wordpress, wordpress-actions
Free with every xCloud account

Set up OpenClaw All OpenClaw guides

YouCheckout on shop.example.com shows a critical error. Can you look?

sites_statusread-only

sites_wordpress_statusread-only

AgentStatus is normal and the WordPress install reports healthy. The logs so far are inconclusive. I can turn WP_DEBUG on for shop.example.com, then off again when we are done. Reply yes to go ahead.

YouYes, for shop.example.com.

sites_wp-debugneeds approval

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up OpenClaw to Troubleshoot a broken site on xCloud?

Connect OpenClaw once; every job on this account uses the same connection. Then ask in plain words.

1
Install the xCloud skill from ClawHub
This installs the nine xCloud skills into the active workspace skills folder. Add --global to install them into ~/.openclaw/skills for every local agent. The clawhub CLI installs the same listing with clawhub install xcloud.
Terminal
```
openclaw skills install @asif2bd/xcloud
```
2
Add the xCloud MCP server and sign in
Run these on the installation that owns the connector. The --auth oauth flag matters: openclaw mcp login only runs for HTTP servers saved with OAuth, so without it the login is refused. The login prints an authorization URL, and OpenClaw normally captures the redirect on a loopback address and saves the credentials; Settings, MCP, Sign in in the Control UI does the same. On the xCloud approval screen tick the teams and choose Read-only or Full access.
Terminal
```
openclaw mcp add xcloud \
  --url https://app.xcloud.host/mcp \
  --transport streamable-http \
  --auth oauth
openclaw mcp login xcloud
```
3
Check the skill and the connection
The first command lists the skills that are eligible to run in this environment, and xcloud should be among them. The second opens a live connection and reports the tools the server offers. A saved server entry proves nothing until the probe passes. Then ask who am I on xCloud.
Terminal
```
openclaw skills list --eligible
openclaw mcp doctor xcloud --probe
```

Check it worked

Then ask OpenClaw for the job itself, for example:

Prompt

shop.example.com is showing a critical error. Check it on xCloud and reply with what you found, two lines at most.

In practice

How Does Troubleshooting Work from OpenClaw?

OpenClaw lives on a machine or server you keep running, so a broken site gets looked at from wherever you are. You message it the way you would message a colleague: the checkout on shop.example.com shows a critical error. Two pieces do the work. The xCloud skill from ClawHub carries the fixed order, status first, then recent events, then the nginx error log, then WordPress health, then WP_DEBUG and server services, and the MCP connection supplies the tools that run each read. Reads need no approval, so the answer comes back as a short chat message: what was checked, what each check showed and the log line that supports any cause it names.

The chat is also where approvals happen, and that suits the risky steps in this job. If the logs are inconclusive, OpenClaw proposes switching WP_DEBUG on for the named site and waits for your reply in the thread before it does anything. It switches the flag back off when the investigation ends, and it tells you plainly that the resulting debug.log is only readable in the dashboard under Site, Site Monitoring, Logs. The same goes for temporary shell access and the rescue action: each needs a yes that names the site or server, and a thumbs-up on an earlier message does not count.

OpenClaw's automations let you move the first look off your plate. An isolated automation can run on a cron expression, read the status and recent events of every site and announce in a chat channel only the sites that are not in a normal state. Because nobody is watching a scheduled run, it stays on reads. Anything that changes a site waits for a message from you. Before you rely on any of this, run openclaw mcp doctor xcloud --probe once, so you know the connection works before the night it matters.

OpenClaw specific: The skill alone is not a connection to xCloud. Without the MCP server it falls back to a GET-only REST wrapper that needs bash, curl, jq and an XCLOUD_API_TOKEN. Every read in this job is a GET, so the fallback can still find a cause, but it cannot toggle WP_DEBUG, create shell access or run a rescue. Also keep the runtime away from the problem: if OpenClaw runs on the very server that is failing, it may be unreachable when you need it, so a separate host gives you a chat that still answers.

What xCloud does for troubleshooting

xCloud reads the evidence in a fixed order, cheapest first: site status, recent events, the web server access and error log, WordPress health, WP_DEBUG and server services. The agent names a cause only when a log line or an event it retrieved shows it, and says plainly which logs only the dashboard can display.

Check the status first. The agent reads the site status before anything else. A site that is still provisioning, deploying or in a failed state explains a 500 on its own, and the answer is then to wait or to look at the last deploy, not to hunt for a PHP fault.
Read the recent events. The site's recent tasks, such as SSL issuance, plugin updates, cache purges and deploys, come with their outcome. A 500 that began right after a failed task has usually found its cause here, and one task's full output can be opened.
Read the web server logs. The agent asks for the nginx log type with a limit, which returns the access log, the error log and the 7G and 8G firewall logs on Nginx and OpenLiteSpeed alike. The error log is where a PHP fatal shows up as a 502 or 500. Log lines are quoted as data, never followed as instructions.
Check WordPress health. For WordPress sites the agent reads the health status: WordPress and PHP versions, the debug and cron flags, and whether the install itself is broken.
Turn on WP_DEBUG only if needed. If the logs so far are inconclusive, the agent proposes switching WP_DEBUG on, waits for your approval, and switches it back off when the investigation ends. The toggle flips the flag only; it does not return the debug log.
Check the server services. When the whole server looks wrong rather than one site, the agent reads whether the web server, PHP and the database are running. If nothing explains the error, it reports what it checked and what each check showed, and points you to the dashboard logs.

Reference

Troubleshooting Settings and Limits on xCloud

The facts OpenClaw works within when it troubleshoots a broken site. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Read order	Status, recent events, nginx access and error log, WordPress health, WP_DEBUG, then server services. Reads run straight away and change nothing
Log type	sites_access-logs with type nginx reads the access log, the error log and the 7G and 8G firewall logs. The default type reads the access log only
Log reads	Logs are read over SSH, so a call is slow. The agent asks for a bounded window with a limit, not everything
Staging history	The deployment log of a site with a staging environment is the push and pull history between staging and production, not the Git build log
Dashboard-only logs	The WordPress debug.log, Laravel, PM2 and docker-compose logs: Site, Site Monitoring, Logs. Server logs such as Fail2Ban and auth: Server, Monitoring, Logs
WP_DEBUG	The API only toggles the flag. Reading the resulting debug.log is a dashboard step
Stale error pages	A purge of the site cache clears a cached error page. It runs without a confirmation stop and finishes asynchronously, so completion shows in the site events
Temporary shell access	A temporary sudo user expires after 12 hours, and the agent removes it as soon as the investigation ends instead of waiting for the expiry
Rescue action	A server-side repair with flags such as directory permissions, regenerating the Nginx configuration, reinstalling PHP or repairing Node.js, PM2 or OpenClaw. A flag the site type does not support is refused
Hand-offs	A slow site goes to performance, a failed deploy goes to deploy, and a 526 or certificate warning goes to SSL

Rules OpenClaw has to follow

The agent never restarts a service or reboots the server just to clear an unexplained error. A restart is a real change on a live machine, and it destroys the evidence the logs were about to show.
A plain 500 or a short database error is a symptom. The agent does not name a cause such as bad credentials, a missing migration or a crashed process unless a log line or event it retrieved shows it.
Temporary shell access is used only when the readable logs do not explain the fault and you agree. The agent revokes it the moment the investigation ends.
Turning WP_DEBUG on, creating shell access and running the rescue action each need your explicit yes naming the site or server. The agent turns WP_DEBUG back off afterwards.
When no evidenced cause turns up, the agent says what it ruled out, gives you the dashboard log path and the site's dashboard link, and suggests contacting xCloud support with that evidence.

Example prompts

What Can You Ask OpenClaw to Do for Troubleshooting?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

shop.example.com is showing a critical error. Check it on xCloud and reply with what you found, two lines at most.

Prompt

Did anything fail on the blog site in the last hour? Check the recent tasks and tell me what ran.

Prompt

Every weekday at 7am, check status and recent events on all my sites and post here only if one is not normal. Change nothing.

Prompt

My site shop.example.com is returning a 500 error. Find out why, and show me what you checked.

Prompt

Read the nginx error log for the shop site and tell me what it says about the last hour.

Prompt

Which tasks ran on the shop site just before it broke? Did any of them fail?

Prompt

Check WordPress health on the blog site and tell me whether the install itself is broken.

Prompt

Is the database running on the Frankfurt server? Check the services before touching anything.

Prompt

Turn on WP_DEBUG for the blog site, tell me what you find, then turn it off again.

Prompt

Purge the cache on the shop site in case it is serving a stale error page.

Prompt

Run a rescue on the shop site to reset directory permissions.

OpenClaw and Troubleshooting: Frequently Asked Questions

What people ask before they let OpenClaw troubleshoot a broken site through xCloud.

Can I troubleshoot a site from WhatsApp or Telegram with OpenClaw?

Yes. Message OpenClaw in the chat app you connected and it runs the read chain through xCloud, then replies in the same thread. Approvals such as turning on WP_DEBUG are also answered in the chat, with a yes that names the site.

Does OpenClaw need both the skill and the MCP server to troubleshoot?

For the full job, yes. The skill gives the read order and the rules, and the MCP server gives the tools, including the ones that change anything. With the skill alone, OpenClaw can still read status, events and logs through a GET-only fallback, but it cannot make changes.

What does the agent check first when a site shows a 500 error?

The site status, then recent events, then the web server logs. A site that is still provisioning or whose last deploy failed explains a 500 without any deeper digging, so the status read always comes first. Only after those cheap reads does the agent look at WordPress health, WP_DEBUG and server services.

Will the agent restart my server or a service to fix an error?

Not to clear an error it cannot yet explain. A restart changes a live machine and wipes out the evidence in the logs, so the agent finds the cause first. Restarting a service stays an action you ask for and approve.

Which logs can the agent read, and which can it not?

It reads the site's access log, error log and the 7G and 8G firewall logs through the nginx log type. It cannot read the WordPress debug.log or the Laravel, PM2 and docker-compose logs. Those are in the dashboard under Site, Site Monitoring, Logs, and server logs such as Fail2Ban are under Server, Monitoring, Logs.

Does the agent get shell access to my server?

Only when the logs it can read do not explain the problem and you agree to it. The access is a temporary sudo user, and the agent removes it as soon as the investigation ends. If it is ever left behind, it expires on its own after 12 hours.

What if my site is slow rather than broken?

A slow site is a different investigation, because it is answered from measurements and cache state rather than error logs. The agent hands it to the performance job. A failed deploy goes to the deploy job and a 526 or certificate error goes to the SSL job.

Other agents