Show HN: Claw Patrol, a security firewall for agents Claw Patrol, a new open-source security firewall for AI agents, intercepts agent traffic at the network level and enforces rules written in HCL before requests reach production systems. The tool can block destructive SQL commands, pause dangerous Kubernetes operations for human approval, and supports multiple deployment modes including per-process tunnels and full-host WireGuard connections. The security firewall for agents. Claw Patrol sits between your agents and prod, parses their traffic at the wire, and gates each action against rules you write in HCL. For example, you can block destructive SQL, or pause kubectl delete pod until a human approves it before the request reaches Kubernetes. For the full overview see clawpatrol.dev https://clawpatrol.dev . curl -fsSL https://clawpatrol.dev/install.sh | sh From source: make requires Go and Node.js . A real rule from our own production config: rule "k8s-no-secrets" { endpoint = k8s-prod condition = "k8s.resource == 'secrets'" verdict = "deny" reason = "Secret values must not leave the cluster via the agent" } Conditions are CEL expressions over wire-level facts the gateway extracts per protocol: SQL verbs and table names for Postgres / ClickHouse, resource / verb / namespace for Kubernetes, method / path / headers / body for HTTP. The full set of facts lives in the config reference https://clawpatrol.dev/docs/config-reference . Three deployment shapes; pick whichever fits. clawpatrol gateway config.hcl run the proxy itself clawpatrol join