ClawGuard: A Default-Deny Firewall for Local AI Agents

ClawGuard is a daemon that sits between local AI agents (OpenClaw, Hermes) and the OS, applying a default-deny policy to every tool call. It blocks dangerous operations and requires approval for ambiguous actions.

How it works

The daemon checks each tool call against a policy file. Dangerous operations such as cat .env, rm -rf /, or accessing SSH keys are hard-blocked. Ambiguous operations (e.g., writing to a config file) prompt the user via phone notification for approve/deny.

Key features

• Default-deny: All tool calls gated unless explicitly allowed by policy.
• Hard blocks: Commands like rm -rf and read ~/.env are blocked without prompt.
• Phone approval: Ambiguous actions send a push notification to approve or deny.
• Tamper-evident logs: Every decision is logged in an append-only chain.

Limitations

The developer is clear: ClawGuard is a “second lock, not a vault.” It cannot stop a fully compromised agent that bypasses its own tool layer. The threat model assumes the agent's tool-call routing is intact.

Get started

ClawGuard is open source under MIT license. The repository is at github.com/VickyTarun89/clawguard. Contributions and threat model reviews are welcome.