Runtime security enforcement for autonomous AI agents. Local LLM reasoning. No cloud. No telemetry. SIGKILLs rogue processes.
Every AI agent security tool I evaluated was either cloud-hosted, required an API key pointed at a vendor, or logged what your agent did without stopping it. ButterClaw is a self-hosted security layer that intervenes — before the LLM call, after it, and before each tool execution — and executes hard responses when something goes wrong.
Not affiliated withbutterclaw.ai
, OpenClaw, or any OpenClaw forks. ButterClaw Tech has its own architecture, runtime, and execution semantics. Looking for a hosted agent framework? →[or OpenClaw. Looking for a local-first kinetic security layer? → You're here.]butterclaw.ai
Incoming agent log / tool call
│
▼
┌─────────────────────────┐
│ Arsenal (pre-brain) │ ← 7 regex signatures, fires in milliseconds
│ sig_kin_01, sig_cswh_01│ SIGKILL or BLOCK on match — LLM never called
└────────────┬────────────┘
│ no match
▼
┌─────────────────────────┐
│ Guardian Brain │ ← Local Ollama, temperature 0.3, action mandate
│ (ask_guardian_agent) │ behavioral drift: last 5 MCP calls as context
└────────────┬────────────┘
│
▼
┌─────────────────────────┐
│ Auditor │ ← Same local model, temperature 0.0, skepticism mandate
│ (run_self_audit) │ independently verifies the Guardian's verdict
└────────────┬────────────┘
│ CRITICAL verdict
▼
┌─────────────────────────┐
│ Kinetic Response │ ← SIGKILL rogue process and/or Gibson credential shred
│ + Alert Dispatch │ ntfy / Discord / Telegram / SMTP / Webhook / Gotify
└─────────────────────────┘
Everything runs on your machine. SQLite for state. No outbound data.
| ButterClaw | Halo | LangSmith / LangFuse | Traditional WAF / IDS | |
|---|---|---|---|---|
| Deployment | ||||
| Self-hosted, local | Cloud-hosted | Cloud-hosted | Self-hosted | |
| LLM reasoning | ||||
| Local Ollama — stays on your machine | Cloud API calls | None | None | |
| Telemetry | ||||
| Zero — SQLite only, no outbound data | Sent to Halo cloud | Sent to vendor cloud | Network-layer only | |
| Agent framework | ||||
| Model-agnostic — any agent producing log output | Specific LLM provider APIs | LangChain / LlamaIndex native | None | |
| What it monitors | ||||
| OS-level telemetry + MCP tool call chain | LLM API calls | LLM traces and spans | Network traffic | |
| Pre-LLM gate | ||||
| ✅ Arsenal — 7 regex signatures fire before inference | ❌ | ❌ | ❌ | |
| Behavioral drift | ||||
| ✅ Last 5 MCP tool calls as verdict context | ❌ | ✅ Tracing only — no enforcement | ❌ | |
| Verdict mechanism | ||||
| Dual-pass: Guardian Brain (0.3) + Auditor (0.0) | Single LLM evaluation | Logging only | Rule-based | |
| Kinetic response | ||||
| ✅ SIGKILL rogue process | ❌ Alert only | ❌ | ❌ Alert / block | |
| Credential shredding | ||||
| ✅ Active HTTP revocation + local vault wipe | ❌ | ❌ | ❌ | |
| Deterministic policy engine | ||||
| ✅ 15 operators, no eval(), 3 scopes | ❌ | ❌ | ✅ Varies | |
| Live-fire test suite | ||||
| ✅ 25/25 reproducible — clone and run | ❌ | ❌ | Varies | |
| Dependencies | ||||
| 7 pip packages | Managed service | Managed service | Varies | |
| License | ||||
| Apache 2.0 | Proprietary | Apache 2.0 | Varies |
LangSmith and LangFuse are
observabilitytools — they log what your agent did. ButterClaw is asecurity enforcementlayer — it intervenes and executes kinetic responses. These solve different problems.
All 7 patterns rebuilt sanitizer-aware in v0.6.7. Validated against the exact characters
watcher.py
's sanitize_log_line()
strips before payloads reach the engine.
| ID | Name | Severity | Scope | Response |
|---|---|---|---|---|
sig_cswh_01 |
||||
| CSWH WebSocket Port Scanning | 🔴 CRITICAL | pre_brain | SIGKILL | |
sig_exfil_01 |
||||
| Credential Exfiltration via Network Tool | 🔴 CRITICAL | pre_brain | SIGKILL | |
sig_exfil_02 |
||||
| Base64 Exfiltration Pipeline | 🟡 WARNING | pre_brain | BLOCK | |
sig_inj_01 |
||||
| System Prompt Override / Jailbreak | 🟡 WARNING | pre_brain | BLOCK | |
sig_kin_01 |
||||
| Reverse Shell Indicators | 🔴 CRITICAL | pre_brain | SIGKILL | |
sig_exfil_03 🆕 |
||||
| Cloud Metadata Service Probe | 🔴 CRITICAL | pre_tool | SIGKILL | |
sig_kin_02 🆕 |
||||
| Persistence Mechanism Injection | 🔴 CRITICAL | pre_brain | SIGKILL |
Requires: Docker · Ollama running on the host · a consumer GPU (CPU fallback works, slower)
git clone https://github.com/butterclaw-tech/butterclaw.git
cd butterclaw
ollama pull gemma4:e4b
ollama create butterclaw-optimized -f Modelfile.example
cp .env.example .env
mkdir -p nginx/certs
docker run --rm -v "${PWD}/nginx/certs:/certs" alpine/openssl req -x509 -nodes \
-days 365 -newkey rsa:2048 \
-keyout /certs/butterclaw.key -out /certs/butterclaw.crt -subj "/CN=localhost"
docker compose up -d --build
On first boot, look for the 🔑 [AUTH]
line in docker compose logs -f butterclaw
— that's your bootstrap admin API key. Shown once.
./dash
Dashboard → ** https://localhost** · ntfy UI →
http://localhost:2586→ Full deployment guide (systemd, bare-metal, TLS): docs/DEPLOYMENT.md
Clone, run, verify. No mocking — fires against a live container.
25 attack variants across all 7 signatures. Payloads pre-sanitized to match real engine input. CI-compatible — exits with code 1 on any failure.
The Paranoia Dial— Level 1 (Observe), Level 2 (SIGKILL), Level 3 (SIGKILL + vault shred). Switch at runtime without restart.** ButterVault + Gibson Kill Switch**— Fernet-encrypted credential vault. On compromise: fires live HTTP DELETE/POST to GitHub and OAuth providers to invalidate tokens globally, then shreds local data atomically.Deterministic Policy Engine— 3-scope pipeline (pre-brain / post-brain / pre-tool), 15 safe operators, noeval()
. Implements the DRIFT framework pattern.6 Alert Channels— ntfy (self-hosted), Discord, Telegram, SMTP, Webhook (HMAC-SHA256 signed), Gotify. Fires before any kinetic action.** 4-Tier RBAC**— infrastructure / admin / operator / viewer. HMAC-SHA256 API keys and session tokens.** 49 API routes**— full programmatic control over every subsystem. →docs/API.md
| Doc | Contents |
|---|---|
docs/ARCHITECTURE.md |
docs/API.md
docs/DEPLOYMENT.md
docs/SECURITY.md
CHANGELOG.md
CONTRIBUTING.md
ButterClaw is applying for the Agentic AI Foundation (AAIF) Growth Stage and is actively seeking security-focused co-maintainers — particularly those working with the Model Context Protocol (MCP) — to help scale the v0.7 stdio transport layer. Grab a good first issue
or read CONTRIBUTING.md and
GOVERNANCE.md
Apache 2.0 — see LICENSE.
🦞 ButterClaw v0.6.7 — The Agentic SOC
Deterministic guardrails for probabilistic reasoning. Evaluation before execution.