Show HN: ButterClaw – AI agent runtime security, SIGKILL on breach, no cloud

ButterClaw Tech released ButterClaw, a self-hosted AI agent runtime security layer that enforces kinetic responses including SIGKILL on rogue processes, with no cloud dependency or telemetry. The tool uses a dual-pass local LLM reasoning system with a Guardian Brain and Auditor to detect behavioral drift and can execute credential shredding and alert dispatch via ntfy, Discord, Telegram, SMTP, Webhook, or Gotify. ButterClaw is licensed under Apache 2.0 and its live-fire test suite is 25/25 reproducible.

Runtime security enforcement for autonomous AI agents. Local LLM reasoning. No cloud. No telemetry. SIGKILLs rogue processes. Every AI agent security tool I evaluated was either cloud-hosted, required an API key pointed at a vendor, or logged what your agent did without stopping it. ButterClaw is a self-hosted security layer that intervenes — before the LLM call, after it, and before each tool execution — and executes hard responses when something goes wrong. Not affiliated with butterclaw.ai , OpenClaw, or any OpenClaw forks. ButterClaw Tech has its own architecture, runtime, and execution semantics. Looking for a hosted agent framework? → or OpenClaw. Looking for a local-first kinetic security layer? → You're here. butterclaw.ai Incoming agent log / tool call │ ▼ ┌─────────────────────────┐ │ Arsenal pre-brain │ ← 7 regex signatures, fires in milliseconds │ sig kin 01, sig cswh 01│ SIGKILL or BLOCK on match — LLM never called └────────────┬────────────┘ │ no match ▼ ┌─────────────────────────┐ │ Guardian Brain │ ← Local Ollama, temperature 0.3, action mandate │ ask guardian agent │ behavioral drift: last 5 MCP calls as context └────────────┬────────────┘ │ ▼ ┌─────────────────────────┐ │ Auditor │ ← Same local model, temperature 0.0, skepticism mandate │ run self audit │ independently verifies the Guardian's verdict └────────────┬────────────┘ │ CRITICAL verdict ▼ ┌─────────────────────────┐ │ Kinetic Response │ ← SIGKILL rogue process and/or Gibson credential shred │ + Alert Dispatch │ ntfy / Discord / Telegram / SMTP / Webhook / Gotify └─────────────────────────┘ Everything runs on your machine. SQLite for state. No outbound data. | ButterClaw | Halo | LangSmith / LangFuse | Traditional WAF / IDS | | |---|---|---|---|---| Deployment | Self-hosted, local | Cloud-hosted | Cloud-hosted | Self-hosted | LLM reasoning | Local Ollama — stays on your machine | Cloud API calls | None | None | Telemetry | Zero — SQLite only, no outbound data | Sent to Halo cloud | Sent to vendor cloud | Network-layer only | Agent framework | Model-agnostic — any agent producing log output | Specific LLM provider APIs | LangChain / LlamaIndex native | None | What it monitors | OS-level telemetry + MCP tool call chain | LLM API calls | LLM traces and spans | Network traffic | Pre-LLM gate | ✅ Arsenal — 7 regex signatures fire before inference | ❌ | ❌ | ❌ | Behavioral drift | ✅ Last 5 MCP tool calls as verdict context | ❌ | ✅ Tracing only — no enforcement | ❌ | Verdict mechanism | Dual-pass: Guardian Brain 0.3 + Auditor 0.0 | Single LLM evaluation | Logging only | Rule-based | Kinetic response | ✅ SIGKILL rogue process | ❌ Alert only | ❌ | ❌ Alert / block | Credential shredding | ✅ Active HTTP revocation + local vault wipe | ❌ | ❌ | ❌ | Deterministic policy engine | ✅ 15 operators, no eval , 3 scopes | ❌ | ❌ | ✅ Varies | Live-fire test suite | ✅ 25/25 reproducible — clone and run | ❌ | ❌ | Varies | Dependencies | 7 pip packages | Managed service | Managed service | Varies | License | Apache 2.0 | Proprietary | Apache 2.0 | Varies | LangSmith and LangFuse are observabilitytools — they log what your agent did. ButterClaw is asecurity enforcementlayer — it intervenes and executes kinetic responses. These solve different problems. All 7 patterns rebuilt sanitizer-aware in v0.6.7. Validated against the exact characters watcher.py 's sanitize log line strips before payloads reach the engine. | ID | Name | Severity | Scope | Response | |---|---|---|---|---| sig cswh 01 | CSWH WebSocket Port Scanning | 🔴 CRITICAL | pre brain | SIGKILL | sig exfil 01 | Credential Exfiltration via Network Tool | 🔴 CRITICAL | pre brain | SIGKILL | sig exfil 02 | Base64 Exfiltration Pipeline | 🟡 WARNING | pre brain | BLOCK | sig inj 01 | System Prompt Override / Jailbreak | 🟡 WARNING | pre brain | BLOCK | sig kin 01 | Reverse Shell Indicators | 🔴 CRITICAL | pre brain | SIGKILL | sig exfil 03 🆕 | Cloud Metadata Service Probe | 🔴 CRITICAL | pre tool | SIGKILL | sig kin 02 🆕 | Persistence Mechanism Injection | 🔴 CRITICAL | pre brain | SIGKILL | Requires: Docker https://docs.docker.com/get-docker/ · Ollama https://ollama.com/ running on the host · a consumer GPU CPU fallback works, slower git clone https://github.com/butterclaw-tech/butterclaw.git cd butterclaw Pull the model ollama pull gemma4:e4b ollama create butterclaw-optimized -f Modelfile.example Configure cp .env.example .env Edit .env — set BUTTERCLAW INSTANCE ID and BUTTERCLAW ALERT NTFY TOPIC at minimum Generate local TLS certs for nginx mkdir -p nginx/certs docker run --rm -v "${PWD}/nginx/certs:/certs" alpine/openssl req -x509 -nodes \ -days 365 -newkey rsa:2048 \ -keyout /certs/butterclaw.key -out /certs/butterclaw.crt -subj "/CN=localhost" Start the stack 3 containers: server, nginx, ntfy docker compose up -d --build On first boot, look for the 🔑 AUTH line in docker compose logs -f butterclaw — that's your bootstrap admin API key. Shown once. Launch the live TUI dashboard ./dash Dashboard → https://localhost · ntfy UI → http://localhost:2586 http://localhost:2586 → Full deployment guide systemd, bare-metal, TLS : docs/DEPLOYMENT.md Clone, run, verify. No mocking — fires against a live container. python scripts/test attack.py ================================================================= RESULT: 25/25 passed | 0 failed | 0 connection errors ================================================================= 25 attack variants across all 7 signatures. Payloads pre-sanitized to match real engine input. CI-compatible — exits with code 1 on any failure. The Paranoia Dial — Level 1 Observe , Level 2 SIGKILL , Level 3 SIGKILL + vault shred . Switch at runtime without restart. ButterVault + Gibson Kill Switch — Fernet-encrypted credential vault. On compromise: fires live HTTP DELETE/POST to GitHub and OAuth providers to invalidate tokens globally, then shreds local data atomically. Deterministic Policy Engine — 3-scope pipeline pre-brain / post-brain / pre-tool , 15 safe operators, no eval . Implements the DRIFT framework pattern. 6 Alert Channels — ntfy self-hosted , Discord, Telegram, SMTP, Webhook HMAC-SHA256 signed , Gotify. Fires before any kinetic action. 4-Tier RBAC — infrastructure / admin / operator / viewer. HMAC-SHA256 API keys and session tokens. 49 API routes — full programmatic control over every subsystem. → docs/API.md | Doc | Contents | |---|---| docs/ARCHITECTURE.md | docs/API.md docs/DEPLOYMENT.md docs/SECURITY.md CHANGELOG.md CONTRIBUTING.md ButterClaw is applying for the Agentic AI Foundation AAIF Growth Stage and is actively seeking security-focused co-maintainers — particularly those working with the Model Context Protocol MCP — to help scale the v0.7 stdio transport layer. Grab a good first issue or read CONTRIBUTING.md /butterclaw-tech/butterclaw/blob/main/CONTRIBUTING.md and . /butterclaw-tech/butterclaw/blob/main/GOVERNANCE.md GOVERNANCE.md Apache 2.0 — see LICENSE /butterclaw-tech/butterclaw/blob/main/LICENSE . 🦞 ButterClaw v0.6.7 — The Agentic SOC Deterministic guardrails for probabilistic reasoning. Evaluation before execution. butterclaw.tech https://butterclaw.tech