Skip to main content
TAKE INTERESTAI systems your business runs on.
Runtime security · Live

Security for agents that act on real systems.

GuardClaw is runtime security for teams building tool-using agents. Policy checks on every tool call, seven layers of defense, and a tamper-evident receipt for every decision, running locally on your hardware.

1,600+ patterns·97%+ on our test corpus·local-first·rule-based
guardclaw · decision.log
agent> tool.call payments.refund(amount=9900)
policy> scope refund not granted for this token
DENIEDat L3 · Policy Enforcement
receipt 0x9f2a…c41e → chain +1
decision under 5ms · nothing left the machine

01 / Where GuardClaw sits

Other tools watch the code or the model. We watch the agent act.

AI security has three layers. Most tools live in the first two. GuardClaw owns the third: the runtime, where an agent actually invokes tools, reads files, and calls out.

Layer 1

Code & dependency scanning

Catches vulnerabilities in your source before it runs. Necessary, but blind once the agent is live.

Layer 2

Model input / output filtering

Checks prompts in and responses out. Helpful at the model's edge, but the plan still has to execute.

Layer 3 · GuardClaw

Runtime agent security

Shell commands, file reads, edits, and web fetches the agent makes are checked against policy in the fast path, before they run.

02 / Try it

Send an attack. Watch it get denied.

Pick a hostile action an agent might attempt. GuardClaw runs it through all seven layers and stops it at the first that catches, then writes a signed receipt.

Receipt chain
// pick an attack above to run the pipeline

03 / Defense in depth

Seven layers. Each assumes the others can fail.

One filter that catches 95% misses 5 in 100. Seven layers, each built to catch what the ones before it missed, cut that a long way down. We publish the numbers we actually measure rather than a compound figure we cannot test.

1

Threat Intelligence

Known-threat detection from compiled patterns and live feeds. A vector one team reports protects everyone.

2

Input Validation

Catches prompt injection, data leakage, and malicious payloads before they reach your agent.

3

Policy Enforcement

Deny-by-default. Every action is checked against explicit rules: allow, deny, or escalate.

4

Capability Tokens

Short-lived, signed, single-use tokens scoped to one approved action. Replays fail automatically.

5

Sandboxed Execution

On macOS, supervised runs execute inside an OS sandbox profile that limits which files and network destinations the agent can reach. Linux runs get process isolation today, and filesystem confinement is in progress. Windows is not sandboxed yet.

6

Human-in-the-Loop

High-risk operations pause for approval, cryptographically bound to the exact request.

7

Receipt Chain

A tamper-evident, cryptographically linked audit trail. Every decision, reconstructable.

04 / What defines it

Three decisions, made on purpose.

Local-first

The detection engine runs on your hardware. Your code and your agent's actions are not sent to us or to any third party for scoring. Receipt metadata syncs to the cloud only if you turn that on.

Deterministic

Compiled pattern matching and rule-based policy in place of a model deciding. Ask why an action was blocked and you get the rule, the pattern, and the score that did it, recorded in a receipt. Given the same configuration and pattern set, the same input gets the same answer.

Defense in depth

Seven independent layers, each built assuming the others can be bypassed. Compound coverage is the only thing that holds against creative attackers.

05 / Drops into your stack

Works with the agents you already run.

CC
Claude Code
Agent runtime
Cu
Cursor
AI editor
CLI
Shell / CLI agents
Command execution
API
Custom agents
SDK & hooks

06 / FAQ

Questions, answered.

What exactly does GuardClaw secure?+

The runtime. After the model produces a plan, GuardClaw checks each concrete action the agent takes, including shell commands, file reads, network calls, and tool invocations, against your policy before any side effect happens. Turn on deny-by-default and anything outside your allowlist is refused.

How is it different from a code scanner or an LLM guardrail?+

Scanners check code at rest (layer 1). Guardrails filter what goes into and out of the model (layer 2). GuardClaw operates at layer 3: it watches what the agent does while running. Different layer, different problem: it complements the others rather than replacing them.

Does my code or data leave my machine?+

No. GuardClaw is local-first: the detection engine runs on your hardware and security decisions happen locally, with no network round-trip. Every plan checks for pattern updates on a schedule you set, and Pro adds a live pattern feed.

Is detection AI-based?+

No. GuardClaw uses compiled pattern matching (Bloom filters, Aho-Corasick, RE2) and rule-based policy. Given the same configuration and pattern set, the same input gets the same decision, and every decision is written to a receipt you can audit.

What are capability tokens and receipts?+

Every approved action gets a short-lived, signed, single-use token scoped to just that action; replays fail. Every decision is written into a cryptographically linked receipt chain, a tamper-evident record built for compliance and fast incident review.

Will it slow my agents down?+

Checks run in the fast path, locally, typically in well under a millisecond. Security that adds heavy latency gets disabled under pressure, so low-latency enforcement was a design requirement from day one.

Does it guarantee 100% detection?+

No tool does. GuardClaw publishes its rates (97%+ on our built-in corpus) and layers seven controls so a miss at one has another chance to be caught. You keep your security team and threat model. GuardClaw is infrastructure underneath them.

Give your agents guardrails.

Deterministic, local, and layered from the first commit. Start free, check for pattern updates on a schedule you set, upgrade when you need the live feed.