{"slug": "show-hn-phpclaw-ai-agent-runtime-for-php-with-tools-memory-and-guards", "title": "Show HN: phpClaw – AI agent runtime for PHP with tools, memory and guards", "summary": "PhpClaw, an open-source AI agent runtime for PHP released under the MIT license, packages a ReAct tool-calling loop, pluggable memory, prompt-injection guards and a bundled MCP server into a core with zero framework dependencies beyond ext-curl, ext-json and ext-mbstring. The runtime auto-detects 7 LLM providers from environment variables — Anthropic, OpenAI, Groq, Gemini, Mistral, DeepSeek and Ollama — in that order, and caps agent iterations at a default of 20 via the max_iterations setting. It ships 8 framework-native adapters, 8 default prompt-injection guards with opt-in rate limiting, and Pipeline and Graph primitives for chaining agents with retry, human pause-and-resume and worker-drained fan-out, though it deliberately omits RAG features such as embeddings and vector stores.", "body_md": "Tools, memory, security, and a ReAct loop, already built. Zero framework dependencies in core. Any LLM provider.\n\n[Documentation](https://phpclaw.ai/docs) · [Adapters](#framework--cms-adapters) · [Why phpClaw](#why-phpclaw) · [Install](#first-agent-in-seconds) · [MCP](#mcp-server) · [Security](#security)\n\n```\ncomposer require phpclaw/phpclaw\nexport ANTHROPIC_API_KEY=\"sk-ant-...\"\nphp\n$agent = PhpClaw\\Claw::builder()->build();\necho $agent->send('What can you help me with?')->text;\n```\n\nOne env var, one builder, one `send()`. The builder checks `ANTHROPIC_API_KEY`, then `OPENAI_API_KEY`, `GROQ_API_KEY`, `GEMINI_API_KEY`, `MISTRAL_API_KEY`, `DEEPSEEK_API_KEY`, `OLLAMA_HOST`, in that order, and uses whichever it finds first. No YAML, no agent framework to learn, no vendor lock-in.\n\nAn agent without tools can only talk. Register the ones your application needs and it starts doing real work:\n\n``` php\nuse PhpClaw\\Claw;\nuse PhpClaw\\Tools\\ShellTool;\nuse PhpClaw\\Tools\\HttpTool;\nuse PhpClaw\\Tools\\FileReadTool;\nuse PhpClaw\\Tools\\DatabaseQueryTool;\nuse PhpClaw\\Tools\\CodeSearchTool;\n\n$agent = Claw::builder()\n    ->tools([\n        new ShellTool(allowlist: ['ls', 'df', 'tail']),\n        new HttpTool(),\n        new FileReadTool(),\n        new DatabaseQueryTool($pdo),\n        new CodeSearchTool(),\n    ])\n    ->build();\n> Check disk usage and tail the last 20 lines of the error log\n> Is api.example.com responding right now?\n> Run a read-only SELECT to count today's orders\n> Find every place UserService is used in this codebase\n```\n\nThe agent decides which tools to call and in what order, running a ReAct loop (reason, act, observe, repeat) until it has an answer or hits the iteration cap. This works identically whether the tools touch your shell, your database, your HTTP APIs, or your codebase.\n\nEvery \"AI in PHP\" tutorial ends the same way: an HTTP client bolted onto a provider API, a hand-rolled tool-call loop, and a prayer that the prompt holds up in production. A generic LLM SDK gives you the API client. phpClaw gives you the agent runtime around it: the loop, the guards, the memory, the framework wiring, already assembled.\n\n|  | phpClaw | Generic LLM SDK | \n|---|---|---|\n| Tool-calling loop | ReAct, built in | You write it | \n| Framework-native adapters | 8, idiomatic per framework | None | \n| Prompt injection defence | 8 default guards + opt-in rate limiting | None | \n| Memory abstraction | Swappable drivers | None | \n| Streaming + tool-calls together | Hybrid mode | Varies | \n| MCP server bundled | Expose any app to Claude Desktop | None | \n| Chains and multi-agent graphs | `Pipeline` and`Graph` : loops, human pause and resume, fan-out | You build it | \n| Zero framework deps in core | `ext-curl` ,`ext-json` ,`ext-mbstring` , done | Depends | \n| Core license | MIT, nothing gated | Varies | \n\n**Not trying to be everything.** phpClaw isn't a RAG framework: there are no embeddings or vector stores. It's built to give an LLM tools, memory and security controls against your real application, and to chain those agents into pipelines and graphs when one call isn't enough.\n\n**Agent runtime.** A ReAct loop with a hard iteration cap (`max_iterations`, default 20), pluggable tools, pluggable memory, and skills the model loads on demand through the `load_skill` tool, all running inside a single reasoning cycle.\n\n**Pipelines and graphs.** `Pipeline` chains steps (prompt template, agent, structured output, your own callables) with retry and fallback. `Graph` runs nodes that loop, branch, pause for a human, resume in another process, and fan out to branches that run inline or are drained by workers from cron, a queue or the CLI. See [Pipelines and Graphs](https://phpclaw.ai/docs/pipelines-and-graphs/).\n\n**Provider flexibility.** 7 providers auto-detected from environment variables: Anthropic, OpenAI, Groq, Gemini, Mistral, DeepSeek, Ollama. A custom OpenAI-compatible endpoint is also supported, opt-in via `PHPCLAW_PROVIDER=custom`. Switch providers with `->provider()` and `->model()`, no code changes elsewhere.\n\n**Production controls.** 8 security guards on by default (prompt injection, PII, code injection, Unicode, homoglyph, role-switch, destructive SQL, message length), plus rate limiting available as an opt-in guard. Tool results are sanitised unconditionally by `ToolOutputGuard`, which sits outside the guard registry, and LLM output sanitisation is on by default and can be disabled with `->sanitiseOutput(false)`. `ShellTool` is allowlist-only with a hard-coded command blocklist that can't be overridden. `HttpTool` validates resolved IPs, not just hostnames, closing the DNS-rebinding gap a prefix blocklist alone would miss. `FileReadTool`/` FileWriteTool` are workspace-sandboxed and refuse sensitive paths and extensions.\n\n**Developer experience.** Token-by-token streaming, prompt caching (cached input tokens billed at Anthropic's discounted cache-read rate, see [Anthropic's pricing](https://www.anthropic.com/pricing) for the exact figure), and extended thinking (Claude's reasoning chain exposed on `$response->thinking`).\n\n**Ecosystem.** 8 framework and CMS adapters, an MCP server for exposing your tools to Claude Desktop and Claude Code, and an optional cloud transport for a hosted, continuously-updated prompt-scan guard.\n\nEach adapter wires phpClaw into its host's own idioms: Eloquent for Laravel, Doctrine for Symfony, WP-CLI for WordPress, Drush for Drupal, and so on. Every adapter ships an admin chat or CLI and the same 3-table memory schema underneath.\n\n| Platform | Package | Install | Versions | \n|---|---|---|---|\n| Laravel | `phpclaw/phpclaw-laravel` | Composer | 10, 11, 12, 13 | \n| Symfony | `phpclaw/phpclaw-symfony` | Composer | 6.4, 7.x, 8.x | \n| Drupal | `phpclaw/phpclaw-drupal` | Composer | 10, 11 | \n| Magento / Adobe Commerce | `phpclaw/phpclaw-magento` | Composer | 2.4.x | \n| WordPress + WooCommerce | -- | ZIP upload | 6.2+ | \n| Joomla | -- | ZIP upload | 4, 5, 6 | \n| OpenCart | -- | ZIP upload | 3.x, 4.x | \n| PrestaShop | -- | ZIP upload | 8.x, 9.x | \n\nCMS adapters ship as ZIP downloads from [Releases](https://github.com/phpclaw-php/phpclaw-monorepo/releases), not Composer, because that's how their host platforms install extensions.\n\n```\nphp artisan phpclaw \"deploy staging and notify #ops\"          # Laravel\nbin/console phpclaw \"check all database connections\"          # Symfony\ndrush phpclaw:run \"list recently-active users\"                # Drupal\nbin/magento phpclaw:run \"check order-queue status\"             # Magento\nwp phpclaw send \"summarise today's posts\"                     # WordPress\nphp cli/joomla.php phpclaw \"list recent articles\"              # Joomla\nphp cli/phpclaw.php send \"check low stock products\"            # OpenCart\nphp modules/phpclaw/cli/phpclaw.php send \"check stock levels\"  # PrestaShop\n```\n\nFull per-adapter reference (tools, REST routes, CLI commands, settings, memory drivers) lives on the [doc site](https://phpclaw.ai/docs/adapters/). Each adapter's own README is a short pointer, not a manual. Building a new one? See the [community adapter guides](https://phpclaw.ai/docs/community/building-an-adapter).\n\n`phpclaw/phpclaw-mcp` exposes your existing `ToolRegistry` over the Model Context Protocol, so [Claude Desktop](https://claude.ai/download), [Claude Code](https://claude.com/claude-code), Cursor, or any MCP-compatible client can call your tools directly, with the default guards scanning every tool call's arguments (the prompt-only code-injection, PII and length guards apply to chat messages, not tool arguments). No changes to the tools themselves.\n\n```\ncomposer require phpclaw/phpclaw-mcp\n```\n\nFull quick start, transport, and security details: [phpclaw.ai/docs/mcp](https://phpclaw.ai/docs/mcp).\n\nEvery message runs through the default guard chain before it reaches the provider. `ShellTool` runs only commands on its allowlist (default `ls`, `pwd`, `df`, `wc`, `date`, `uptime`, `hostname`, `whoami`), matched exactly and case-sensitively; a fixed, non-overridable blocklist of dangerous commands is checked first regardless of what's allowlisted. `HttpTool` blocks requests by hostname prefix, then re-validates every resolved IP address, catching CGNAT and DNS-rebinding attempts that hostname checks alone would miss. `FileReadTool` and `FileWriteTool` are sandboxed to a configured workspace root and refuse credentials, keys and security directories (`.git`, `.ssh`, `wp-admin`, ...) unconditionally, and `vendor/` and `node_modules/` by default.\n\nFull guard reference, the exact `ShellTool` blocklist, and the SSRF/sandbox implementation details: [phpclaw.ai/docs/security](https://phpclaw.ai/docs/security). Found a vulnerability? See [SECURITY.md](https://github.com/phpclaw-php/phpclaw-monorepo/blob/0.x/.github/SECURITY.md), do not open a public issue.\n\n```\nMessage\n  → Guards       (blocks injection/PII before the LLM sees it)\n  → Hooks         (lifecycle events fire, 44 across the loop)\n  → Agent          (ReAct loop: provider + tools + memory + skills)\n  → AgentResponse  (text, tokens, tool calls, timing)\n```\n\nProviders, tools, memory, guards, and skills are all pluggable through registries; every adapter wires them from its own config or environment. Full architecture diagram and design rules: [phpclaw.ai/docs/architecture](https://phpclaw.ai/docs/architecture).\n\nFive static registries (`GuardRegistry`, `HookRegistry`, `MemoryRegistry`, `ProviderRegistry`, `SkillRegistry`) plus the per-agent `ToolRegistry` instance. Drop a class in `packages/core/src/<Subsystem>/` with the matching attribute (`#[Tool]`, `#[Provider]`, `#[Memory]`, `#[Skill]`, `#[Hook]`, `#[Guard]`), run `composer dump-autoload`, it's live. Or register from code: `GuardRegistry::register()`, `HookRegistry::on()`, `$toolRegistry->register([...])`.\n\nFull extension recipes with working code for every subsystem: [phpclaw.ai/docs](https://phpclaw.ai/docs).\n\n```\nfor pkg in core cloud mcp; do (cd packages/$pkg && composer test); done\n```\n\nUnit tests use mocks and stubs for HTTP clients, `\\Redis`, and the filesystem: no external network calls and no API keys are needed to run the suite for core, cloud, or mcp. The full testing rules, including how to test a core change through an adapter, are in the [contributing guide](https://phpclaw.ai/docs/contributing).\n\nThis README gets you installed. Everything else, architecture, the full provider/tool/guard/hook/memory/skill reference, per-adapter tool and REST tables, code examples, upgrading, troubleshooting, lives at:\n\n- **PHP:** 8.1, 8.2, 8.3, 8.4\n- **Extensions:**`ext-curl` ,`ext-json` ,`ext-mbstring` (core only; adapters may need more, documented per-package)\n\n[MIT](https://github.com/phpclaw-php/phpclaw-monorepo/blob/0.x/LICENSE), built with love for the PHP community. Part of the [phpClaw](https://github.com/phpclaw-php/phpclaw-monorepo) project.", "url": "https://wpnews.pro/news/show-hn-phpclaw-ai-agent-runtime-for-php-with-tools-memory-and-guards", "canonical_source": "https://github.com/phpclaw-php/phpclaw-monorepo", "published_at": "2026-10-29 18:06:22+00:00", "updated_at": "2026-10-29 18:17:23.753334+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "large-language-models", "ai-tools", "agent-protocols"], "entities": ["phpClaw", "Anthropic", "OpenAI", "Groq", "Gemini", "Mistral", "DeepSeek", "Ollama"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-phpclaw-ai-agent-runtime-for-php-with-tools-memory-and-guards", "markdown": "https://wpnews.pro/news/show-hn-phpclaw-ai-agent-runtime-for-php-with-tools-memory-and-guards.md", "text": "https://wpnews.pro/news/show-hn-phpclaw-ai-agent-runtime-for-php-with-tools-memory-and-guards.txt", "jsonld": "https://wpnews.pro/news/show-hn-phpclaw-ai-agent-runtime-for-php-with-tools-memory-and-guards.jsonld"}}