DashClaw

DashClaw is an approval and governance layer for unattended AI Agent runs, with the project at https://github.com/ucsandman/DashClaw，采用 MIT licensed and self-hostable. Its core idea is "fail-closed": when an AI Agent attempts to perform a destructive or high-cost operation, DashClaw intercepts it before the action actually runs and requests approval from the operator, even if the operator is not at the keyboard. Every decision goes into a signed ledger.

Purpose and Positioning

DashClaw is aimed at unattended coding Agent sessions, such as overnight runs, CI Agents, background fleets, and similar scenarios. It sits at the seam between the Agent deciding to call a tool and actually executing the tool, existing as an approval layer. Its main purpose is to let Agents run unattended without granting them unconditional permissions. The target users are independent developers or small teams running long unattended coding Agent sessions.

Main Capabilities

DashClaw provides the following capabilities:

• Fail-closed interception at the execution seam: Hooks for Claude Code, Codex, and Hermes, the OpenClaw gateway, and dashclaw_invoke can cancel blocked calls before execution. Bare SDKs, APIs, and ordinary MCP integrations are cooperative, and the caller must comply with the ruling.
• One-click remote approval: Can be handled from the /approvals inbox, CLI, mobile PWA, Telegram, or Discord, with no need to be present.
• Plain-English approval explanations: Each pending item explains in one sentence what the command actually does, flags irreversible operations, and warns when files contain credentials. When no rule can interpret a command with high confidence, it says so explicitly rather than guessing.
• "Allow, don't ask again": Before creating a scoped long-term authorization, you can preview the target, lease, and matching pending items. Long-term authorizations remain visible and revocable in the inbox.
• Verifiable recorded evidence: Decision records, Ed25519 receipts (at issuance time), and signed exports support later review.
• Calibrated interruption frequency: The user's approve/reject rulings regulate the interruption frequency.
• Autonomy level determined numerically: Each action carries the confidence declared by the Agent, and the ledger scores it based on the reported result.
• Execution liveness detection: Probe tests whether a synthetic reserved action executes through the installed hook path.
• Prompt injection scanning enabled by default: High-confidence system override patterns are forcibly blocked at guard time, while weaker ones trigger warnings.
• Multi-runtime support: Claude Code, Codex, Hermes, OpenClaw, MCP, Node and Python SDKs, pure REST.
• MIT licensed self-hosting: Run locally or deploy your own instance.

How to Use

Deployment can be completed with a single command: the npm command configures Postgres (Docker or embedded), generates keys, mints an API key, applies migrations, starts on port :3000, optionally connects Claude Code hooks, and opens a logged-in browser. Agents can use npx dashclaw up --yes --no-browser(Note: ordinary commands will prompt and hang a non-interactive shell). The API key is located at ~/.dashclaw/instance.json; available GET http://localhost:3000/api/health and npx dashclaw doctor verification. For the full runbook, see dashclaw.io/llms.txt. The hosted trial is a secondary entry point, but its captcha requires manual handling and cannot be attempted headlessly.

Connecting Agents: All paths land on the same guard engine, the same decision ledger, and the same Approvals inbox. Coding Agent plugins (Claude Code, Codex, Hermes) share one plugin source (plugins/dashclaw/), with each manifest containing MCP configuration, the dashclaw-governance protocol skill, and a different agent_id. The repository is also a native Claude Code plugin marketplace, with no CLI required.

SDK integration uses runGoverned()(for Python, use run_governed()): it waits for the required approval, claims an execution attempt under a fresh policy check, invokes the callback, and reports the result. If the claim or completion acknowledgment is lost, the assistant will not repeat the callback. Upgrade order: first deploy the matching schema and server, then upgrade the governed SDK assistant.

Real interception examples

According to the maintainer log and THESIS.md, operations actually intercepted include: executing against the working directory rm -rf, executing against the live database DROP TABLE, executing git push --force origin main, reading .env and preparing to exfiltrate (risk 100, two policies triggered simultaneously). The last one also intercepted the maintainer's own shell command: extracting an API key from .env.local, blocked in real time at risk 100.

Limitations and boundaries

• Enforcement is mechanical only at the seams: Claude Code, Codex, Hermes PreToolUse hooks (fail-closed, exit-2 on block), the OpenClaw gateway, and dashclaw_invoke. Everywhere else (bare SDK, API, MCP callers, desktop chat), governance is cooperative: the caller consults the guard and complies with the decision.
• Not a general-purpose tracing product: if you mainly need model tracing and evaluation dashboards, this is not the tool.
• Not a general-purpose agent platform: it does not provide a broad suite of calendar, CRM, messaging, or RAG tools.
• Not universally enforced control: mechanical enforcement only at the seams, cooperative elsewhere.
• Not tamper-proof against the agents it governs: hooks run at the agent's own privilege level, within the blast radius of what they govern. True isolation is a deployment property—containers, a separate OS user, or read-only hook paths.
• Not battle-tested at scale: first commit in February 2026.

How it is maintained

This project is built and maintained publicly by AI agents under a human-held charter (MAINTAINER.md). The charter fixes five immutable invariants: blocking is absolute, self-approval is not allowed, every relaxation is approved by a human, credential-gated behavior remains under human control, and the charter remains human-held. Major maintainer changes and design decisions are recorded in the maintainer log.