# Show HN: ButterClaw – AI agent runtime security, SIGKILL on breach, no cloud > Source: > Published: 2026-07-29 13:12:47+00:00 **Runtime security enforcement for autonomous AI agents. Local LLM reasoning. No cloud. No telemetry. SIGKILLs rogue processes.** Every AI agent security tool I evaluated was either cloud-hosted, required an API key pointed at a vendor, or logged what your agent did without stopping it. ButterClaw is a self-hosted security layer that intervenes — before the LLM call, after it, and before each tool execution — and executes hard responses when something goes wrong. Not affiliated with`butterclaw.ai` , OpenClaw, or any OpenClaw forks. ButterClaw Tech has its own architecture, runtime, and execution semantics. Looking for a hosted agent framework? →[or OpenClaw. Looking for a local-first kinetic security layer? → You're here.]`butterclaw.ai` ``` Incoming agent log / tool call │ ▼ ┌─────────────────────────┐ │ Arsenal (pre-brain) │ ← 7 regex signatures, fires in milliseconds │ sig_kin_01, sig_cswh_01│ SIGKILL or BLOCK on match — LLM never called └────────────┬────────────┘ │ no match ▼ ┌─────────────────────────┐ │ Guardian Brain │ ← Local Ollama, temperature 0.3, action mandate │ (ask_guardian_agent) │ behavioral drift: last 5 MCP calls as context └────────────┬────────────┘ │ ▼ ┌─────────────────────────┐ │ Auditor │ ← Same local model, temperature 0.0, skepticism mandate │ (run_self_audit) │ independently verifies the Guardian's verdict └────────────┬────────────┘ │ CRITICAL verdict ▼ ┌─────────────────────────┐ │ Kinetic Response │ ← SIGKILL rogue process and/or Gibson credential shred │ + Alert Dispatch │ ntfy / Discord / Telegram / SMTP / Webhook / Gotify └─────────────────────────┘ ``` Everything runs on your machine. SQLite for state. No outbound data. | ButterClaw | Halo | LangSmith / LangFuse | Traditional WAF / IDS | | |---|---|---|---|---| Deployment | Self-hosted, local | Cloud-hosted | Cloud-hosted | Self-hosted | LLM reasoning | Local Ollama — stays on your machine | Cloud API calls | None | None | Telemetry | Zero — SQLite only, no outbound data | Sent to Halo cloud | Sent to vendor cloud | Network-layer only | Agent framework | Model-agnostic — any agent producing log output | Specific LLM provider APIs | LangChain / LlamaIndex native | None | What it monitors | OS-level telemetry + MCP tool call chain | LLM API calls | LLM traces and spans | Network traffic | Pre-LLM gate | ✅ Arsenal — 7 regex signatures fire before inference | ❌ | ❌ | ❌ | Behavioral drift | ✅ Last 5 MCP tool calls as verdict context | ❌ | ✅ Tracing only — no enforcement | ❌ | Verdict mechanism | Dual-pass: Guardian Brain (0.3) + Auditor (0.0) | Single LLM evaluation | Logging only | Rule-based | Kinetic response | ✅ SIGKILL rogue process | ❌ Alert only | ❌ | ❌ Alert / block | Credential shredding | ✅ Active HTTP revocation + local vault wipe | ❌ | ❌ | ❌ | Deterministic policy engine | ✅ 15 operators, no eval(), 3 scopes | ❌ | ❌ | ✅ Varies | Live-fire test suite | ✅ 25/25 reproducible — clone and run | ❌ | ❌ | Varies | Dependencies | 7 pip packages | Managed service | Managed service | Varies | License | Apache 2.0 | Proprietary | Apache 2.0 | Varies | LangSmith and LangFuse are observabilitytools — they log what your agent did. ButterClaw is asecurity enforcementlayer — it intervenes and executes kinetic responses. These solve different problems. All 7 patterns rebuilt sanitizer-aware in v0.6.7. Validated against the exact characters `watcher.py` 's `sanitize_log_line()` strips before payloads reach the engine. | ID | Name | Severity | Scope | Response | |---|---|---|---|---| `sig_cswh_01` | CSWH WebSocket Port Scanning | 🔴 CRITICAL | pre_brain | SIGKILL | `sig_exfil_01` | Credential Exfiltration via Network Tool | 🔴 CRITICAL | pre_brain | SIGKILL | `sig_exfil_02` | Base64 Exfiltration Pipeline | 🟡 WARNING | pre_brain | BLOCK | `sig_inj_01` | System Prompt Override / Jailbreak | 🟡 WARNING | pre_brain | BLOCK | `sig_kin_01` | Reverse Shell Indicators | 🔴 CRITICAL | pre_brain | SIGKILL | `sig_exfil_03` 🆕 | Cloud Metadata Service Probe | 🔴 CRITICAL | pre_tool | SIGKILL | `sig_kin_02` 🆕 | Persistence Mechanism Injection | 🔴 CRITICAL | pre_brain | SIGKILL | Requires: [Docker](https://docs.docker.com/get-docker/) · [Ollama](https://ollama.com/) running on the host · a consumer GPU (CPU fallback works, slower) ``` git clone https://github.com/butterclaw-tech/butterclaw.git cd butterclaw # Pull the model ollama pull gemma4:e4b ollama create butterclaw-optimized -f Modelfile.example # Configure cp .env.example .env # Edit .env — set BUTTERCLAW_INSTANCE_ID and BUTTERCLAW_ALERT_NTFY_TOPIC at minimum # Generate local TLS certs for nginx mkdir -p nginx/certs docker run --rm -v "${PWD}/nginx/certs:/certs" alpine/openssl req -x509 -nodes \ -days 365 -newkey rsa:2048 \ -keyout /certs/butterclaw.key -out /certs/butterclaw.crt -subj "/CN=localhost" # Start the stack (3 containers: server, nginx, ntfy) docker compose up -d --build ``` On first boot, look for the 🔑 `[AUTH]` line in `docker compose logs -f butterclaw` — that's your bootstrap admin API key. Shown once. ``` # Launch the live TUI dashboard ./dash ``` Dashboard → ** https://localhost** · ntfy UI → [http://localhost:2586](http://localhost:2586)→ Full deployment guide (systemd, bare-metal, TLS): `docs/DEPLOYMENT.md` Clone, run, verify. No mocking — fires against a live container. ``` python scripts/test_attack.py ================================================================= RESULT: 25/25 passed | 0 failed | 0 connection errors ================================================================= ``` 25 attack variants across all 7 signatures. Payloads pre-sanitized to match real engine input. CI-compatible — exits with code 1 on any failure. **The Paranoia Dial**— Level 1 (Observe), Level 2 (SIGKILL), Level 3 (SIGKILL + vault shred). Switch at runtime without restart.** ButterVault + Gibson Kill Switch**— Fernet-encrypted credential vault. On compromise: fires live HTTP DELETE/POST to GitHub and OAuth providers to invalidate tokens globally, then shreds local data atomically.**Deterministic Policy Engine**— 3-scope pipeline (pre-brain / post-brain / pre-tool), 15 safe operators, no`eval()` . Implements the DRIFT framework pattern.**6 Alert Channels**— ntfy (self-hosted), Discord, Telegram, SMTP, Webhook (HMAC-SHA256 signed), Gotify. Fires before any kinetic action.** 4-Tier RBAC**— infrastructure / admin / operator / viewer. HMAC-SHA256 API keys and session tokens.** 49 API routes**— full programmatic control over every subsystem. →`docs/API.md` | Doc | Contents | |---|---| `docs/ARCHITECTURE.md` | `docs/API.md` `docs/DEPLOYMENT.md` `docs/SECURITY.md` `CHANGELOG.md` `CONTRIBUTING.md` ButterClaw is applying for the **Agentic AI Foundation (AAIF) Growth Stage** and is actively seeking security-focused co-maintainers — particularly those working with the **Model Context Protocol (MCP)** — to help scale the v0.7 stdio transport layer. Grab a `good first issue` or read [ CONTRIBUTING.md](/butterclaw-tech/butterclaw/blob/main/CONTRIBUTING.md) and [.](/butterclaw-tech/butterclaw/blob/main/GOVERNANCE.md) `GOVERNANCE.md` Apache 2.0 — see [ LICENSE](/butterclaw-tech/butterclaw/blob/main/LICENSE). **🦞 ButterClaw v0.6.7 — The Agentic SOC** *Deterministic guardrails for probabilistic reasoning. Evaluation before execution.* [butterclaw.tech](https://butterclaw.tech)