Clawdstrike
Runtime security enforcement and threat hunting engine for autonomous AI fleets. Build Swarm Detection & Response (SDR) platforms with Clawdstrike.
Install / Use
/learn @backbay-labs/ClawdstrikeREADME
<p align="center"> <img src="assets/promo-reel.gif" alt="Clawdstrike Workbench" width="960" /> </p>
The Problem
Google's 2026 Cybersecurity Forecast calls it the "Shadow Agent" crisis: employees and teams spinning up AI agents without corporate oversight, creating invisible pipelines that exfiltrate sensitive data, violate compliance, and leak IP. The AI agent hype cycle accelerates it: prototypes become deployments before anyone can threat-model the blast radius. No one sanctioned them. No one is watching them. And most security stacks were built for defined, static attacks — not continuous, goal-driven agentic behavior.
Your org provisioned 50 agents. Shadow IT spun up 50 more outside your asset inventory. One exfiltrates .env secrets to an unclassified endpoint. Another patches auth middleware with no peer review, no receipt, no rollback. A third runs chmod 777 against a production filesystem. Your SIEM stays green because these actions don’t generate the signals it was built to detect.
Logs tell you what happened. Clawdstrike stops it before it happens.
Every decision is signed. Every receipt is non-repudiable. If it didn't get a signature, it didn't get permission.
Clawdstrike enforces policy at the tool boundary — fail-closed, with signed proof.
What Clawdstrike Is
Clawdstrike is a fail-closed policy engine and cryptographic attestation runtime for AI agent systems. It sits at the tool boundary, the exact point where an agent's intent becomes a real-world action, and enforces security policy with signed proof. From a single SDK install to a fleet of thousands of managed agents, the same engine, the same receipts, the same guarantees.
flowchart LR
A[Agent Swarm<br/>OpenAI / Claude / OpenClaw / LangChain] --> B[Clawdstrike Adapter]
B --> C[Canonical Action Event]
C --> D[Policy Engine<br/>+ Guard Stack]
D -->|allow| E[Tool Execution]
D -->|deny| F[Fail-Closed Block]
D --> G[Ed25519 Signed Receipt]
G -.->|enterprise| H[Spine Audit Trail]
H -.-> I[Control API + Control Console]
Three layers, one system:
| Layer | What It Does | | ----- | ------------ | | Guard Stack | 13 composable guards at the tool boundary: path access, egress, secrets, shell commands, MCP tools, jailbreak detection, prompt injection, CUA controls, Spider-Sense threat screening. Every verdict is Ed25519-signed into a non-repudiable receipt. | | Swarm C2 | An operational control plane for managing agent fleets in production. Durable, replayable fleet transport over NATS JetStream, policy flow coordination via Spine, enrollment and credential provisioning, posture commands with request/reply acknowledgements, and a Proofs API + Control Console for verification and SOC workflows. | | Swarm Trace | Prevention + hunting at the agent tool boundary. Hunt across signed receipts, kernel telemetry (Tetragon, auditd), and network flows (Hubble), build timelines, run natural-language and structured queries, correlate against detection rules, and ship OCSF-formatted findings straight into your SIEM. |
<table> <tr> <td width="50%">
Without Clawdstrike
- Agent reads
~/.ssh/id_rsa. You find out from the incident report - Secret leaks into model output. Compliance discovers it 3 months later
- Jailbreak prompt bypasses safety. No one notices until the damage is public
- Multi-agent delegation escalates privileges. Who authorized what?
- "We have logging." Logs are stories anyone can rewrite
With Clawdstrike
ForbiddenPathGuardblocks the read, signs a receiptOutputSanitizerredacts the secret before it ever leaves the pipeline- 4-layer jailbreak detection catches it across the session, even across multi-turn grooming attempts
- Delegation tokens with cryptographic capability ceilings. Privilege escalation is mathematically impossible
- Ed25519 signed receipts. Tamper-evident proof, not narratives
Every action. Every agent. Every time. No exceptions.
Beta software. Public APIs and import paths are expected to be stable; behavior and defaults may still evolve before 1.0. Not yet production-hardened for large-scale deployments.
Quick Start
<p align="center"> <a href="#python"><kbd>Python</kbd></a> <a href="#typescript"><kbd>TypeScript</kbd></a> <a href="#go"><kbd>Go</kbd></a> <a href="#cursor-plugin"><kbd>Cursor</kbd></a> <a href="#openclaw-plugin"><kbd>OpenClaw</kbd></a> <a href="#claude-code-plugin"><kbd>Claude Code</kbd></a> <a href="#observe-synth-tighten"><kbd>Observe -> Synth -> Tighten</kbd></a> </p>Install
brew tap backbay-labs/tap
brew install clawdstrike
clawdstrike --version
Initialize
# Scaffold a .clawdstrike/ project (policy, config, signing keys)
clawdstrike init --keygen
# → creates policy.yaml, config.toml, keys/clawdstrike.key + .pub
Start the Daemon
# Start the enforcement daemon (runs hushd on 127.0.0.1:9876)
clawdstrike daemon start
# Verify it's running
clawdstrike daemon status
# → Status: healthy | Version: 0.2.7 | Uptime: 2s
# Stop when do
