Claw Patrol Security firewall for agents

Claw Patrol launched a security firewall for AI agents that intercepts and gates outbound requests to databases, Kubernetes, and APIs. The tool parses traffic at the wire, enforces rules via LLM judges or human approval, and maintains an audit log to prevent credential leaks and prompt injection attacks.

LLM judge require llm A model with a custom prompt votes on each request. Verdicts are cached so it doesn’t re-bill. approver "llm approver" "secret-judge" { model = "claude-haiku-4-5-20251001" credential = anthropic manual key.anthropic-key policy = "Reject any SELECT that projects secret-bearing columns." } The security firewall for any agent Claw Patrol guards credentials, parses traffic at the wire, and gates actions according to rules you author—all while keeping an audit log of everything that happens. curl -fsSL https://clawpatrol.dev/install.sh | sh Prefix any agent command with clawpatrol run . Same workflow; every action gated and tracked. An agent that can talk to Postgres can DROP TABLE as easily as SELECT. If the agent is compromised by prompt injection, the credentials it holds leak with it. Reconstructing what actually happened means stitching together logs from multiple services. A walkthrough of the operator UI at demo.clawpatrol.dev https://demo.clawpatrol.dev/ . Drill into any request to see what the gateway captured. Every outbound request runs through Claw Patrol's rule engine /docs/rules/ . Match on HTTP method, SQL verb, k8s resource, and more; not just URLs. Rules go live the second you press save. Match anything on the wire Match on method, path, headers, or body, and route it through an LLM judge before it goes out. User-visible messages sent from the agent are scanned by an LLM judge before they go out: catches unsafe content, missing context, and markdown that should not ship. rule "message-send-content-check" { endpoint = https.messaging-api condition = <<-CEL http.method == 'POST' && http.path == '/v1/messages/send' CEL approve = llm approver.message-content-judge } Postgres and ClickHouse traffic parsed verb-by-verb. Match by SQL verb, table, function name, and substrings of the statement itself. Block Postgres functions that could read the filesystem or open outbound connections from inside the database — pg read file, lo get, and the whole dblink family. rule "pg-banned-functions" { endpoint = postgres.pg-staging priority = 100 condition = <<-CEL sets.intersects sql.functions, 'pg read file', 'pg read binary file', 'lo get', || sql.functions.exists f, f.startsWith 'dblink ' CEL verdict = "deny" reason = "filesystem-reaching function" } API calls to kube-apiserver. Match by namespace, resource, verb, and name. Catch destructive verbs on the wrong cluster, or hand exec commands to an LLM. kubectl exec is gated by an LLM judge that reads the command argv: allows ls / ps / df, denies env dumps, sensitive file reads, and anything touching pod tokens or container sockets. rule "k8s-exec-content-check" { endpoints = kubernetes.k8s-dev, kubernetes.k8s-prod priority = 500 condition = "k8s.resource == 'pods/exec'" approve = llm approver.k8s-exec-content-judge } Extend Claw Patrol with plugins Read more → /docs/plugins/ Defer ambiguous requests to a model with your prompt, or a real human via Slack. You decide which one runs when. require llm A model with a custom prompt votes on each request. Verdicts are cached so it doesn’t re-bill. ␃WPNCODE4␃ SELECT id, name, api key FROM users LIMIT 10 api key , a secret-bearing column. require human A person votes in Slack, the dashboard, or your own webhook. Times out closed if no one’s home. approver "human approver" "ops" { channel = " agent-ops" credential = slack tokens.slack-bot timeout = 600 } /repos/acme/checkout Record real actions from the dashboard. Drop the JSON files into a fixtures directory. Run clawpatrol test in CI: when a policy change flips a verdict, the runner prints the diff and fails the build. No gateway, no database, no auth. A single binary that loads your HCL, replays each fixture against the rule engine, and asserts the verdicts still match. bash $ clawpatrol test gateway.hcl tests/ ok tests/anthropic-implicit-allow.json ok tests/clickhouse-default-deny.json ok tests/clickhouse-read.json ok tests/deno-com-require-approval.json ok tests/api-resource-read.json ok tests/github-api-implicit-allow.json ok tests/k8s-allow-meta.json ok tests/k8s-debug-pods.json ok tests/k8s-default-deny.json FAIL tests/k8s-no-secrets.json want verdict="deny" rule="k8s-no-secrets" got verdict="allow" rule="k8s-no-secrets" ok tests/k8s-reads.json ok tests/orb-dev2-immutable-operations-allow.json ok tests/pg-staging-banned-functions.json ok tests/pg-staging-default-deny.json ok tests/pg-staging-reads.json 36 action s checked, 1 mismatch es Lots of tools exist in the agent space, solving individual problems. Claw Patrol takes a holistic approach. Route LLM calls between providers and log usage. Claw Patrol watches LLM traffic too, but focuses on what agents do downstream. Scan model output for unsafe content. Claw Patrol scans actions, not just words. HTTP proxies that hold credentials and apply policies. Claw Patrol does the same, plus non-HTTP protocols like Postgres. Confine what an agent does on its machine. Claw Patrol limits what it can reach instead — stack the two. Hold secrets so the agent never sees them. Claw Patrol does that, paired with wire-level rules on every call those credentials authorize. The proxy holds your secrets and watches every byte your agents send. It has to be auditable, so it’s MIT licensed https://github.com/denoland/clawpatrol/blob/main/LICENSE.md . curl -fsSL https://clawpatrol.dev/install.sh | sh