Gate agent actions with policy rules before prod
Claw Patrol is a security firewall for AI agents that gates their production traffic against HCL rules at the wire level.
Maintainer of this project? Claim this page to edit the listing.
0.5.8Add to Favorites
Why it matters
Enforce security policies on AI agent traffic by intercepting and validating every action against custom rules before requests reach production systems, preventing destructive operations and requiring human approval for sensitive commands.
Outcomes
What it gets done
Block destructive SQL queries from reaching production databases
Pause kubectl delete commands until human approval is granted
Parse wire-level traffic for Postgres, Kubernetes, and HTTP protocols
Enforce custom HCL rules on agent actions using CEL expressions
Install
Add it to your toolbox
Run in your project directory:
curl -fsSL https://spark.entire.vc/get/denoland-clawpatrol | bash Overview
Clawpatrol
Claw Patrol is a security firewall for AI agents that inspects their production traffic at the wire level and gates actions against HCL rules. Use it when agents have network access to production databases, Kubernetes, or HTTP APIs and you want enforced policy, not just agent self-restraint.
What it does
Claw Patrol is a security firewall for AI agents: it sits between your agents and production, parses their traffic at the wire level, and gates each action against rules you write in HCL. A rule can block destructive SQL outright, or pause a command like kubectl delete pod until a human approves it before the request ever reaches Kubernetes.
When to use - and when NOT to
Use it when agents have network access to production systems - a database, a Kubernetes cluster, or HTTP APIs - and you want a policy layer that inspects and can deny or hold their actions before they land, rather than trusting the agent's own judgment. Rules are CEL expressions evaluated over wire-level facts the gateway extracts per protocol - SQL verbs and table names for Postgres/ClickHouse, resource/verb/namespace for Kubernetes, method/path/headers/body for HTTP - so policy is written against the actual request, not the agent's stated intent. A real production rule from the project itself:
rule "k8s-no-secrets" {
endpoint = k8s-prod
condition = "k8s.resource == 'secrets'"
verdict = "deny"
reason = "Secret values must not leave the cluster via the agent"
}
Inputs and outputs
Input: an agent's network traffic to a configured endpoint (Postgres, ClickHouse, Kubernetes, or HTTP) plus an HCL rule config. Output: each action allowed, denied, or held pending human approval, per the matching rule's verdict.
curl -fsSL https://clawpatrol.dev/install.sh | sh
Building from source instead requires Go and Node.js, via make.
Integrations
Ships as a single binary with three deployment shapes: clawpatrol gateway config.hcl runs the proxy itself, loading the HCL config and accepting clients tunneling in over WireGuard or Tailscale; clawpatrol join <gateway-url> brings up a WireGuard tunnel that routes the whole host through a gateway; and clawpatrol run claude wraps a single agent process tree, opening a per-process tunnel via netns on Linux or NetworkExtension on macOS so only that wrapped command's traffic passes through the gateway.
Getting-started and config-reference guides at clawpatrol.dev walk through a first configuration end-to-end and document every available wire-level fact, and an annotated gateway.example.hcl file in the repo's examples gives a starting template to copy rather than write rules from a blank file.
Who it's for
Teams giving AI agents live access to production databases, Kubernetes clusters, or HTTP services who want a policy-enforced choke point between the agent and the system of record, rather than relying on the agent to self-restrict. Open source under the MIT license.
Source README
clawpatrol
The security firewall for agents.
Claw Patrol sits between your agents and prod, parses their traffic
at the wire, and gates each action against rules you write in HCL.
For example, you can block destructive SQL, or pause kubectl delete pod
until a human approves it before the request reaches Kubernetes.
For the full overview see clawpatrol.dev.
Install
curl -fsSL https://clawpatrol.dev/install.sh | sh
From source: make (requires Go and Node.js).
A rule
A real rule from our own production config:
rule "k8s-no-secrets" {
endpoint = k8s-prod
condition = "k8s.resource == 'secrets'"
verdict = "deny"
reason = "Secret values must not leave the cluster via the agent"
}
Conditions are CEL expressions over wire-level facts the gateway
extracts per protocol: SQL verbs and table names for Postgres /
ClickHouse, resource / verb / namespace for Kubernetes, method /
path / headers / body for HTTP. The full set of facts lives in the
config reference.
Run
Three deployment shapes; pick whichever fits.
clawpatrol gateway config.hcl # run the proxy itself
clawpatrol join <gateway-url> # join a gateway
clawpatrol run claude # wrap one agent's process tree
clawpatrol run opens a per-process tunnel on Linux (via netns) or
macOS (via NetworkExtension); only the wrapped command's traffic
goes through the gateway. clawpatrol join brings up a WireGuard
tunnel that routes the whole host. clawpatrol gateway is the
proxy: a single binary that loads your HCL config and accepts
clients tunneling in via WireGuard or Tailscale.
Configure
clawpatrol.dev/docs/getting-started
walks through a first config end-to-end.
clawpatrol.dev/docs/config-reference
is the auto-generated field reference. Seegateway.example.hcl for an
annotated starting template.
Discussion
Questions & comments · 0
Sign In Sign in to leave a comment.