ucsandman/DashClaw

Remote approvals, policy checks, and execution evidence for unattended AI agents.

What is DashClaw?

DashClaw is a runtime‑guard that sits between an AI‑driven coding agent (e.g., Claude Code, Codex, Hermes, OpenClaw) and the tools it wants to run. When the agent proposes a potentially destructive or expensive operation—like deleting a directory, force‑pushing a repo, or exfiltrating credentials—DashClaw intercepts the request before the tool actually executes. It then routes the request to an approvals inbox (web UI, CLI, Telegram, Discord, etc.) where a human can allow, deny, or create a scoped “allow‑once” grant. Every decision is recorded in a signed ledger for later audit.

Why you might need it

  • Unattended agent runs – Night‑time CI jobs, background fleets, or long‑running autonomous agents can issue dangerous commands when you’re not watching.
  • Safety‑first policy enforcement – Define rules (e.g., block rm -rf, prevent DROP TABLE on production) and have the system automatically stop violations.
  • Audit trail – Each decision is signed with Ed25519, giving you tamper‑evident proof of what was allowed or blocked.
  • Remote approvals – Approve actions from anywhere (web inbox, phone PWA, chat bots) without needing a live terminal.

How it works (the core loop)

  1. Agent proposes an action (e.g., a shell command).
  2. A hook installed in the agent’s runtime (Claude Code, Codex, Hermes, OpenClaw, or the dashclaw_invoke helper) calls DashClaw’s guard API.
  3. The guard scores the request against your policies and returns one of:
    • allow / warn – execution proceeds (optionally with a warning).
    • require_approval – the call is frozen and a pending item appears in the approvals inbox.
    • block – the hook exits with code 2; the tool never runs.
  4. If approval is required, you resolve it remotely. The decision (including a signed receipt) is stored in the decision ledger.
  5. Once approved, DashClaw issues an atomic execution claim and the agent’s callback runs. The claim guarantees “run‑once” semantics for the ledger; if the claim is lost the SDK does not retry automatically.

The system supports both mechanical enforcement (the fail‑closed hooks) and cooperative enforcement (plain SDK or API callers that must honor the guard’s verdict).

Key features (as listed in the README)

Feature What it gives you
Fail‑closed intercept Hooks in Claude Code, Codex, Hermes, OpenClaw, and dashclaw_invoke can abort a call before it runs.
One‑click remote approval Approve/deny from a web inbox, CLI, phone PWA, Telegram, or Discord.
Plain‑English summaries Each pending item shows a concise description of what the command would do and flags irreversible actions.
“Allow, don’t ask again” Create scoped standing grants that auto‑approve future matching actions.
Signed decision records Ed25519 receipts let you verify that a decision was recorded unchanged.
Calibrated interruptions Policy thresholds adapt to reduce false prompts; you can tune how often you’re interrupted.
Autonomy score Agents report a confidence number; over‑confident actions are highlighted in the ledger.
Liveness probes DashClaw can test whether the installed hook is still functional and report version/fingerprint info.
Prompt‑injection scanning Built‑in detection of malicious prompt patterns that try to bypass the guard.
Multi‑runtime support Node & Python SDKs, REST API, and native plugins for Claude Code, Codex, Hermes, OpenClaw.
Self‑hostable (MIT‑licensed) Deploy locally or on your own cloud instance; npm and PyPI packages are available.

Getting started (quick‑start)

# Install the CLI (npm) and spin up a local instance
npm i -g @dashclaw/cli
npx dashclaw up          # provisions Postgres, generates keys, starts server on :3000
  • The command prints an API key to ~/.dashclaw/instance.json.
  • Verify the server is alive: GET http://localhost:3000/api/health or npx dashclaw doctor.
  • Follow the on‑screen prompts to wire Claude Code hooks (or use the dashclaw install <agent> commands for Codex, Hermes, etc.).

For cloud deployment you can use the provided Vercel button, which sets up a PostgreSQL instance (Neon) and runs the migration before building the web UI.

Connecting an agent

Agent Integration point Enforcement type
Claude Code Plugin + PreToolUse hook Mechanical (fail‑closed)
Codex Plugin Mechanical
Hermes Plugin (lifecycle hooks) Mechanical
OpenClaw Gateway plugin Mechanical
dashclaw_invoke (MCP) Guarded invoke Mechanical
Claude Desktop (chat) OAuth connector Cooperative
LangChain / CrewAI / AutoGen Python SDK Cooperative
Any HTTP client REST API + webhooks Cooperative

Each integration ships a small SDK (runGoverned in Node, run_governed in Python) that wraps the risky call, waits for approval, and records the outcome.

What DashClaw is not

  • It isn’t a general tracing or observability platform – it only governs before execution.
  • It isn’t an all‑in‑one agent framework – it provides a single, well‑defined guard surface.
  • It does not guarantee universal hard enforcement; enforcement is mechanical only where the hook is installed, otherwise callers must cooperate.
  • It isn’t tamper‑proof against a malicious agent that can modify the hook itself – you must run it in an isolated container or separate OS user.
  • It’s a very new project (first commit Feb 2026) and has not been battle‑tested at massive scale.

Who maintains it

The repository is maintained by an AI agent under a human‑held charter. The charter enforces five invariants (blocks are absolute, no self‑approval, human ratification of policy relaxations, credential‑gated actions stay human‑controlled, and the charter itself stays human‑controlled). All major design decisions are logged in docs/maintainer‑log.md.

Where to learn more

  • Website & docs – https://dashclaw.io and https://dashclaw.io/docs
  • Full API spec – docs/openapi/critical-stable.openapi.json
  • Architecture & threat model – docs/architecture/enforcement-boundary.md
  • Example projects – examples/
  • License – MIT (see LICENSE)

TL;DR

DashClaw gives you a fail‑closed gate for AI coding agents, letting you run long‑duration, unattended jobs while keeping a human‑in‑the‑loop for any risky operation. It records every decision with cryptographic receipts, supports remote approvals, and works across Node, Python, and several popular LLM‑agent runtimes.

Related

  • Project
    Intelligent-Internet/zenith

    Zenith is a Python harness that lets Claude Code, Codex, or Hermes run as long‑running coding agents. An orchestrator repeatedly checks project state, spawns worker/tester sub‑agents, registers reusable skills, replans, and only stops when the task is truly complete. Benchmarked on the Frontier SWE suite, Zenith (using GPT‑5.5) achieves the best average rank while costing less than half of the strongest baseline (RALPH). The repo provides a CLI, MCP server, ACP adapters, and a full technical report.

  • Project
    Stability-AI/stable-audio-metrics

    A collection of evaluation metrics for music and audio generative models, providing tools to calculate Fréchet Distance, KL divergence, and CLAP scores for long-form stereo audio.

  • Project
    vocoder712/OpenUtauMobile

    An open-source singing synthesis editor for mobile devices that supports DiffSinger, UTAU, and Vogen voicebanks.

  • Project
    gendigitalinc/sage

    Sage is a security plug‑in for AI coding assistants (Claude Code, Cursor, VS Code, OpenClaw, OpenCode). It intercepts tool calls—shell commands, URL fetches, file writes, package installs—and runs multiple threat checks (cloud URL reputation, 300+ local YAML heuristics, a prompt‑injection ML model, supply‑chain analysis, and Windows AMSI). If a request looks unsafe, Sage blocks it and logs the decision. Installation is done via the respective assistant’s marketplace or npm, and the project is open‑source under Apache 2.0.