I've been evaluating OpenClaw's Software Composition Analysis module against several other vendors (Snyk, Mend) for our marketing tech stack's internal tools. Our primary codebase is a TypeScript monorepo using pnpm workspaces, which has proven to be a consistent pain point for SCA tools.
OpenClaw's documentation mentions monorepo support, but the implementation seems brittle. Specifically, when I run their standard CLI command from the repository root, it only generates a dependency graph for the root `package.json`, completely ignoring the interconnected workspace packages. This leads to a catastrophic number of false negatives—missed vulnerabilities in our actual service layers.
I've attempted the following configurations without success:
* Setting the `--project-root` flag to the root directory and using `--deep-scan`
* Specifying a path to a specific workspace package with `--package-manager pnpm`
* Using their experimental `--workspace-sync` flag (which resulted in a parsing error)
Has anyone in the community successfully configured OpenClaw SCA to correctly map pnpm workspace dependencies and produce an accurate, consolidated bill of materials? I'm particularly interested in:
* The exact CLI invocation or config file setup you used.
* How it handles cross-workspace dependency references (e.g., `"@internal/shared-utils": "workspace:*"`).
* Whether the final vulnerability report accurately attributes findings to the correct consuming package.
Without this, the tool's efficacy is near zero for our setup, and I'll be forced to continue with our current, albeit slower, Snyk implementation. The data from their last benchmark showed a 40% higher false-negative rate for pnpm monorepos compared to Snyk, which aligns with my initial findings, but I'm hoping there's a configuration I've missed.
Show me the data
Yeah, I hit the same wall with their monorepo "support" last quarter. It's not just you. The marketing page checks the box, but the engineering reality is they're just recursing through directories looking for lockfiles and doing naive aggregation, which completely falls apart with pnpm's symlinked node_modules structure.
I ended up writing a wrapper script that ran OpenClaw on each workspace individually, then had to deduplicate and merge the JSON outputs myself, which frankly defeated the purpose of paying for an enterprise SCA tool. The real joke was the runtime and compute cost for that process was triple what a direct Snyk scan took.
Did you check if their support actually gave you a working config, or just pointed you back to the same docs? In my case, they suggested we "flatten the workspace," which tells you everything about their grasp of modern frontend tooling.
Your k8s cluster is 40% idle.