Repolode
Submit
SafeAI-Lab-X

SafeAI-Lab-X/ClawKeeper

Host-agnostic safety middleware that sits between tool-using AI agents and their tools to block risky calls and redact sensitive results.

View on GitHub
Stars
1,018
Forks
59
Open issues
7
Last commit
2 months ago

What is it?

ClawKeeper is a safety layer for agentic systems that call tools such as shell, Python, browser, filesystem, and network functions. It intercepts tool calls before execution and scans tool results after they return, so a host agent can be protected without rewriting its core logic. It can be wired into Hermes Agent, MCP tools, HTTP bridges, OpenClaw-style runtimes, or a custom host.

The default guard set targets common agent security failures: prompt injection, credential reads, credential exfiltration chains, unsafe shell commands, protected-path access, SSRF-style URLs, base64 or hex encoded payloads, and poisoned tool output. Non-Python hosts can call a Judge API exposed by an HTTP server.

An optional Watcher daemon reviews intent, recent tool history, and proposed calls for decisions that single-command rules cannot capture. Watcher detections can be turned into learned patterns stored under ~/.clawkeeper/ and hot-reloaded into the live guard layer.

Key features

  • 01Blocks risky shell, Python, browser, filesystem, and network tool calls before execution.
  • 02Redacts sensitive content in tool results and scans returned output for poisoning.
  • 03Detects credential exfiltration chains and access to protected paths.
  • 04Provides an HTTP core with judge, event, audit, and log/skill scan endpoints.
  • 05Offers an optional Watcher daemon that reviews intent and multi-step tool history.

Use cases

  • Adding a safety guard to a Hermes Agent deployment with a few lines of Python.
  • Protecting a non-Python agent runtime by calling the HTTP Judge API before tool execution.
  • Auditing agent tool calls for credential access and exfiltration attempts.
  • Letting a guard layer learn new attack patterns from Watcher detections.

Quick start

  1. 1

    Clone the repository

    git clone git@github.com:SafeAI-Lab-X/ClawKeeper.git
  2. 2

    Create a virtual environment

    python -m venv .venv
  3. 3

    Install the package with dev extras into the environment

    pip install -e ".[dev]"
  4. 4

    Run the test suite as a sanity check

    pytest -q

Things to know

  • The repository has no license specified, so usage rights are unclear.
  • The optional Watcher needs an LLM API key and a configured model.

Topics

#agent-security#ai-agents#tool-calling#prompt-injection#guardrails#safety#personal-agent#agents#openclaw#plugins

FAQ

What is ClawKeeper?
Host-agnostic safety middleware that sits between tool-using AI agents and their tools to block risky calls and redact sensitive results. ClawKeeper is a safety layer for agentic systems that call tools such as shell, Python, browser, filesystem, and network functions. It intercepts tool calls before execution and scans tool results after they return, so a host agent can be protected without rewriting its core logic. It can be wired into Hermes Agent, MCP tools, HTTP bridges, OpenClaw-style runtimes, or a custom host.
Is ClawKeeper free to use? What license does it have?
ClawKeeper has no declared license. Its code is public, but without a license you have no explicit permission to reuse it; ask the author before relying on it.
Is ClawKeeper still maintained?
Updated within 6 months. The last commit to ClawKeeper was on Aug 17, 2026.
What can I use ClawKeeper for?
Adding a safety guard to a Hermes Agent deployment with a few lines of Python. Protecting a non-Python agent runtime by calling the HTTP Judge API before tool execution. Auditing agent tool calls for credential access and exfiltration attempts. Letting a guard layer learn new attack patterns from Watcher detections.
How do I install ClawKeeper?
Clone the repository: git clone git@github.com:SafeAI-Lab-X/ClawKeeper.git Create a virtual environment: python -m venv .venv Install the package with dev extras into the environment: pip install -e ".[dev]" Run the test suite as a sanity check: pytest -q
Where can I get ClawKeeper?
The source code and installation instructions are on GitHub: https://github.com/SafeAI-Lab-X/ClawKeeper

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects