tophant-ai/ClawVault

What it solves

ClawVault is a security layer designed to prevent AI agents from leaking private data, accessing sensitive credentials, or executing dangerous commands. It acts as a protective vault that monitors and controls how AI agents interact with your files and API keys, ensuring that sensitive information does not leave your local environment or get mishandled by a model.

How it works

The system operates as a transparent proxy gateway and a set of local hooks (for tools like Claude Code and OpenClaw). It intercepts traffic between the AI agent and the model provider, scanning for sensitive patterns—such as API keys, PII, and dangerous shell commands—before they are sent. It can either block the request, alert the user, or sanitize the data by replacing secrets with placeholders.

Who it’s for

It is built for users and developers who use AI agents and want to ensure their private files, credentials, and system commands are protected from accidental leakage or prompt injection attacks.

Highlights

• Sensitive Data Detection: Identifies 15+ pattern types, including credit cards, passwords, and API keys.
• Prompt Injection Defense: Blocks role hijacking and instruction overrides to prevent data exfiltration.
• Dangerous Command Guard: Intercepts high-risk commands like rm -rf or curl|bash.
• Auto-Sanitization: Replaces secrets with placeholders locally so the upstream model never sees the original data.
• Token Budgeting: Sets daily or monthly token limits with cost alerts.
• Generative Policy Orchestration: Allows users to create security rules using natural language via a chat interface.
• Visual Monitoring: Provides a web dashboard for audit logs and real-time protection monitoring.