ClawKeeper
Host-agnostic safety middleware for tool-using agentic systems (can be wired into Hermes Agent, MCP tools, HTTP bridges, OpenClaw-style runtimes, or a custom host).
ClawKeeper sits between an agent and its tools. It can block risky tool calls, redact sensitive tool results, remember recurring attack patterns & self improve guardrail layers, and delegate harder trajectory-level decisions to an external Watcher.
What it is for
- Guarding shell, Python, browser, filesystem, and network tool calls before execution.
- Catching common agent-security failures: prompt injection, credential reads, credential exfiltration chains, unsafe shell execution, protected-path access, SSRF-like URLs, encoded second-stage payloads, and poisoned tool output.
- Running a host-independent Judge API for non-Python adapters.
- Running an optional Watcher daemon that reasons over intent, recent tool history, deterministic findings, and proposed tool calls.
- Self-improving guard coverage: Watcher catches can synthesize learned patterns, persist them under
~/.clawkeeper/, and hot-reload them into the live guard layer.
Install
git clone git@github.com:SafeAI-Lab-X/ClawKeeper.git
cd ClawKeeper
python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"
Sanity check:
pytest -q
Use with Hermes Agent
from run_agent import AIAgent
from clawkeeper_core import Judge
from clawkeeper_core.adapters.hermes import install as install_clawkeeper
agent = AIAgent(...)
install_clawkeeper(Judge(), agent)
agent.run("your task")
This installs the default pre-tool guard chain and post-tool-result scanners. No Hermes patching is required.
Run the HTTP core
For hosts that cannot import the Python package directly:
clawkeeper-server
curl http://127.0.0.1:7474/v1/health
Useful endpoints include /v1/judge, /v1/event, /v1/audit, /v1/scan/logs, , and maintenance harden/rollback routes.