---
title: Grok Bot
description: How ClawMetry observes Grok Bot — where its data lives, the environment variables that move it, what cost data is real, and the traps in its store.
eyebrow: Runtime reference
---

# Grok Bot

Grok Bot is not the Grok Build CLI. It is a set of persistent named bots, each on its own cloud VM with a browser, filesystem and terminal, driven from a desktop client. The client is an Electron app built by Anysphere (Cursor's company), which is why its storage idioms rhyme with Cursor's and why a Cursor agent can appear inside a Grok Bot transcript.

| | |
|---|---|
| **Runtime id** | `grok_bot` |
| **Category** | Cloud agent, desktop client |
| **Vendor** | xAI |
| **Tier** | Paid tier (Starter and up) |
| **Upstream** | [x.ai/bot](https://x.ai/bot) |

## Where the data comes from

ClawMetry reads these locations, in order, and never writes to any of them.

- `~/Library/Application Support/Grok Bot/sand-client-persistence/<base32>.blob` — conversations (macOS)
- `%APPDATA%\Grok Bot\sand-client-persistence/` — same, on Windows
- `~/.config/Grok Bot/sand-client-persistence/` — same, elsewhere
- `~/.grokbot/` — the local-exec control plane, NOT under the data root

**Format.** Each `.blob` filename is the lowercase base32 of its slice key with padding stripped; the body is plaintext JSON `{"schemaVersion", "value"}`. Nothing is encrypted, so no key material is needed and none is touched.

## Environment variables

| Variable | Effect |
|---|---|
| `CLAWMETRY_GROK_BOT_DATA_ROOT` | conversation data root override |
| `CLAWMETRY_GROK_BOT_HOME` | control-plane root override (~/.grokbot) |

See [Environment variables](/docs/config/environment/) for the variables that apply to every runtime.

## Tokens and cost

**Tokens.** None. An exhaustive walk of the store for token, usage, model, price and credit keys returns nothing — not a zero, not a null; the fields do not exist. Inference happens on the cloud VM and the metering never comes back to the client.

**Cost.** Unavailable. `cost_usd` is `None` with `cost_status="unavailable"` and the runtime does not claim the COST capability. A dollar figure here would be invented from nothing.

:::note Why this section exists
Runtimes differ enormously in what they persist. Rather than showing a plausible number everywhere, ClawMetry reports what the store actually contains and marks the rest unknown. A cost of `$0.00` and a cost of *unknown* mean different things, and the dashboard keeps them different.
:::

## Sub-agents and delegation

A `cursor-agent` transcript entry records a handoff to a Cursor background agent by id and title. That is a link to another runtime's work, not a sub-agent tree of its own.

## Things worth knowing

- A `~/.grok`-shaped check finds neither root. Grok Build (`grok`) and Grok Bot are different products that share a brand.
- A `send-message` entry reads like an outbound queue and is not — it is the bot's own reply. Treating it as an outbox drops every assistant turn and leaves a transcript of the user talking to themselves.
- `local-tool-permission` is the one genuine governance signal: the bot asks to act on YOUR machine, recording `action`, `target` and `status`. `status="always"` is a standing grant that outlives the one ask.
- The ask is the only tool signal persisted locally. There is no execution record, so ClawMetry emits the ask as a tool call and never fabricates a result.
- One desktop process serves every bot, so there is no per-session control and there never can be. Pause, stop and kill are refused with a reason rather than offered as buttons that do nothing.

## Verify it is being read

```bash
# Is this runtime detected, and would this install unlock it?
clawmetry runtimes --json | jq '.runtimes[] | select(.id=="grok_bot")'

# Why is it locked, if it is?
clawmetry runtimes --why grok_bot

# Any sessions ingested yet?
curl -s 'http://localhost:8900/api/local/sessions?limit=5' \
  | jq '.rows[] | {session_id, agent_id, events, cost_usd}'
```

If detection succeeds but no sessions appear, work through [Troubleshooting](/docs/ops/troubleshooting/) — the usual causes are a relocated data directory (set the override above), a session limit that is hiding older runs, or a runtime that simply has not written anything yet.