{"slug": "show-hn-butterclaw-ai-agent-runtime-security-sigkill-on-breach-no-cloud", "title": "Show HN: ButterClaw – AI agent runtime security, SIGKILL on breach, no cloud", "summary": "ButterClaw Tech released ButterClaw, a self-hosted AI agent runtime security layer that enforces kinetic responses including SIGKILL on rogue processes, with no cloud dependency or telemetry. The tool uses a dual-pass local LLM reasoning system with a Guardian Brain and Auditor to detect behavioral drift and can execute credential shredding and alert dispatch via ntfy, Discord, Telegram, SMTP, Webhook, or Gotify. ButterClaw is licensed under Apache 2.0 and its live-fire test suite is 25/25 reproducible.", "body_md": "**Runtime security enforcement for autonomous AI agents. Local LLM reasoning. No cloud. No telemetry. SIGKILLs rogue processes.**\n\nEvery AI agent security tool I evaluated was either cloud-hosted, required an API key pointed at a vendor, or logged what your agent did without stopping it. ButterClaw is a self-hosted security layer that intervenes — before the LLM call, after it, and before each tool execution — and executes hard responses when something goes wrong.\n\nNot affiliated with`butterclaw.ai`\n\n, OpenClaw, or any OpenClaw forks. ButterClaw Tech has its own architecture, runtime, and execution semantics. Looking for a hosted agent framework? →[or OpenClaw. Looking for a local-first kinetic security layer? → You're here.]`butterclaw.ai`\n\n```\nIncoming agent log / tool call\n         │\n         ▼\n┌─────────────────────────┐\n│  Arsenal (pre-brain)    │  ← 7 regex signatures, fires in milliseconds\n│  sig_kin_01, sig_cswh_01│    SIGKILL or BLOCK on match — LLM never called\n└────────────┬────────────┘\n             │ no match\n             ▼\n┌─────────────────────────┐\n│  Guardian Brain         │  ← Local Ollama, temperature 0.3, action mandate\n│  (ask_guardian_agent)   │    behavioral drift: last 5 MCP calls as context\n└────────────┬────────────┘\n             │ \n             ▼\n┌─────────────────────────┐\n│  Auditor                │  ← Same local model, temperature 0.0, skepticism mandate\n│  (run_self_audit)       │    independently verifies the Guardian's verdict\n└────────────┬────────────┘\n             │ CRITICAL verdict\n             ▼\n┌─────────────────────────┐\n│  Kinetic Response       │  ← SIGKILL rogue process and/or Gibson credential shred\n│  + Alert Dispatch       │    ntfy / Discord / Telegram / SMTP / Webhook / Gotify\n└─────────────────────────┘\n```\n\nEverything runs on your machine. SQLite for state. No outbound data.\n\n| ButterClaw | Halo | LangSmith / LangFuse | Traditional WAF / IDS | |\n|---|---|---|---|---|\nDeployment |\nSelf-hosted, local | Cloud-hosted | Cloud-hosted | Self-hosted |\nLLM reasoning |\nLocal Ollama — stays on your machine | Cloud API calls | None | None |\nTelemetry |\nZero — SQLite only, no outbound data | Sent to Halo cloud | Sent to vendor cloud | Network-layer only |\nAgent framework |\nModel-agnostic — any agent producing log output | Specific LLM provider APIs | LangChain / LlamaIndex native | None |\nWhat it monitors |\nOS-level telemetry + MCP tool call chain | LLM API calls | LLM traces and spans | Network traffic |\nPre-LLM gate |\n✅ Arsenal — 7 regex signatures fire before inference | ❌ | ❌ | ❌ |\nBehavioral drift |\n✅ Last 5 MCP tool calls as verdict context | ❌ | ✅ Tracing only — no enforcement | ❌ |\nVerdict mechanism |\nDual-pass: Guardian Brain (0.3) + Auditor (0.0) | Single LLM evaluation | Logging only | Rule-based |\nKinetic response |\n✅ SIGKILL rogue process | ❌ Alert only | ❌ | ❌ Alert / block |\nCredential shredding |\n✅ Active HTTP revocation + local vault wipe | ❌ | ❌ | ❌ |\nDeterministic policy engine |\n✅ 15 operators, no eval(), 3 scopes | ❌ | ❌ | ✅ Varies |\nLive-fire test suite |\n✅ 25/25 reproducible — clone and run | ❌ | ❌ | Varies |\nDependencies |\n7 pip packages | Managed service | Managed service | Varies |\nLicense |\nApache 2.0 | Proprietary | Apache 2.0 | Varies |\n\nLangSmith and LangFuse are\n\nobservabilitytools — they log what your agent did. ButterClaw is asecurity enforcementlayer — it intervenes and executes kinetic responses. These solve different problems.\n\nAll 7 patterns rebuilt sanitizer-aware in v0.6.7. Validated against the exact characters\n`watcher.py`\n\n's `sanitize_log_line()`\n\nstrips before payloads reach the engine.\n\n| ID | Name | Severity | Scope | Response |\n|---|---|---|---|---|\n`sig_cswh_01` |\nCSWH WebSocket Port Scanning | 🔴 CRITICAL | pre_brain | SIGKILL |\n`sig_exfil_01` |\nCredential Exfiltration via Network Tool | 🔴 CRITICAL | pre_brain | SIGKILL |\n`sig_exfil_02` |\nBase64 Exfiltration Pipeline | 🟡 WARNING | pre_brain | BLOCK |\n`sig_inj_01` |\nSystem Prompt Override / Jailbreak | 🟡 WARNING | pre_brain | BLOCK |\n`sig_kin_01` |\nReverse Shell Indicators | 🔴 CRITICAL | pre_brain | SIGKILL |\n`sig_exfil_03` 🆕 |\nCloud Metadata Service Probe | 🔴 CRITICAL | pre_tool | SIGKILL |\n`sig_kin_02` 🆕 |\nPersistence Mechanism Injection | 🔴 CRITICAL | pre_brain | SIGKILL |\n\nRequires: [Docker](https://docs.docker.com/get-docker/) · [Ollama](https://ollama.com/) running on the host · a consumer GPU (CPU fallback works, slower)\n\n```\ngit clone https://github.com/butterclaw-tech/butterclaw.git\ncd butterclaw\n\n# Pull the model\nollama pull gemma4:e4b\nollama create butterclaw-optimized -f Modelfile.example\n\n# Configure\ncp .env.example .env\n# Edit .env — set BUTTERCLAW_INSTANCE_ID and BUTTERCLAW_ALERT_NTFY_TOPIC at minimum\n\n# Generate local TLS certs for nginx\nmkdir -p nginx/certs\ndocker run --rm -v \"${PWD}/nginx/certs:/certs\" alpine/openssl req -x509 -nodes \\\n  -days 365 -newkey rsa:2048 \\\n  -keyout /certs/butterclaw.key -out /certs/butterclaw.crt -subj \"/CN=localhost\"\n\n# Start the stack (3 containers: server, nginx, ntfy)\ndocker compose up -d --build\n```\n\nOn first boot, look for the 🔑 `[AUTH]`\n\nline in `docker compose logs -f butterclaw`\n\n— that's your bootstrap admin API key. Shown once.\n\n```\n# Launch the live TUI dashboard\n./dash\n```\n\nDashboard → ** https://localhost** · ntfy UI →\n\n[http://localhost:2586](http://localhost:2586)→ Full deployment guide (systemd, bare-metal, TLS): `docs/DEPLOYMENT.md`\n\nClone, run, verify. No mocking — fires against a live container.\n\n```\npython scripts/test_attack.py\n=================================================================\n  RESULT: 25/25 passed  |  0 failed  |  0 connection errors\n=================================================================\n```\n\n25 attack variants across all 7 signatures. Payloads pre-sanitized to match real engine input. CI-compatible — exits with code 1 on any failure.\n\n**The Paranoia Dial**— Level 1 (Observe), Level 2 (SIGKILL), Level 3 (SIGKILL + vault shred). Switch at runtime without restart.** ButterVault + Gibson Kill Switch**— Fernet-encrypted credential vault. On compromise: fires live HTTP DELETE/POST to GitHub and OAuth providers to invalidate tokens globally, then shreds local data atomically.**Deterministic Policy Engine**— 3-scope pipeline (pre-brain / post-brain / pre-tool), 15 safe operators, no`eval()`\n\n. Implements the DRIFT framework pattern.**6 Alert Channels**— ntfy (self-hosted), Discord, Telegram, SMTP, Webhook (HMAC-SHA256 signed), Gotify. Fires before any kinetic action.** 4-Tier RBAC**— infrastructure / admin / operator / viewer. HMAC-SHA256 API keys and session tokens.** 49 API routes**— full programmatic control over every subsystem. →`docs/API.md`\n\n| Doc | Contents |\n|---|---|\n`docs/ARCHITECTURE.md` |\n\n`docs/API.md`\n\n`docs/DEPLOYMENT.md`\n\n`docs/SECURITY.md`\n\n`CHANGELOG.md`\n\n`CONTRIBUTING.md`\n\nButterClaw is applying for the **Agentic AI Foundation (AAIF) Growth Stage** and is actively seeking security-focused co-maintainers — particularly those working with the **Model Context Protocol (MCP)** — to help scale the v0.7 stdio transport layer. Grab a `good first issue`\n\nor read [ CONTRIBUTING.md](/butterclaw-tech/butterclaw/blob/main/CONTRIBUTING.md) and\n\n[.](/butterclaw-tech/butterclaw/blob/main/GOVERNANCE.md)\n\n`GOVERNANCE.md`\n\nApache 2.0 — see [ LICENSE](/butterclaw-tech/butterclaw/blob/main/LICENSE).\n\n**🦞 ButterClaw v0.6.7 — The Agentic SOC**\n\n*Deterministic guardrails for probabilistic reasoning. Evaluation before execution.*\n\n[butterclaw.tech](https://butterclaw.tech)", "url": "https://wpnews.pro/news/show-hn-butterclaw-ai-agent-runtime-security-sigkill-on-breach-no-cloud", "canonical_source": "https://github.com/butterclaw-tech/butterclaw", "published_at": "2026-07-29 13:12:47+00:00", "updated_at": "2026-07-29 13:22:31.002147+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "ai-infrastructure"], "entities": ["ButterClaw Tech", "ButterClaw", "Ollama", "LangSmith", "LangFuse", "Halo", "Apache 2.0"], "alternates": {"html": "https://wpnews.pro/news/show-hn-butterclaw-ai-agent-runtime-security-sigkill-on-breach-no-cloud", "markdown": "https://wpnews.pro/news/show-hn-butterclaw-ai-agent-runtime-security-sigkill-on-breach-no-cloud.md", "text": "https://wpnews.pro/news/show-hn-butterclaw-ai-agent-runtime-security-sigkill-on-breach-no-cloud.txt", "jsonld": "https://wpnews.pro/news/show-hn-butterclaw-ai-agent-runtime-security-sigkill-on-breach-no-cloud.jsonld"}}