Summary

Claw Patrol is a security firewall designed to protect production environments from agent actions. It intercepts and inspects agent traffic, enforcing custom rules written in HCL to prevent potentially destructive or unauthorized operations before they reach their targets. This provides a crucial safety layer for AI agents and automated systems interacting with sensitive infrastructure.

How It Works

The system operates by parsing network traffic at the wire level for various protocols, including SQL, Kubernetes, and HTTP. It extracts protocol-specific facts (e.g., SQL verbs, Kubernetes resource types, HTTP methods/paths) which are then evaluated against user-defined rules. These rules, written in HashiCorp Configuration Language (HCL), leverage Common Expression Language (CEL) for conditions, allowing for precise and expressive security policies. This approach offers granular control, enabling developers to define specific actions that are permitted or denied, thereby mitigating risks associated with autonomous agent behavior.

Quick Start & Requirements

• Install: Execute curl -fsSL https://clawpatrol.dev/install.sh | sh.
• Build from Source: Requires Go and Node.js; run make.
• Documentation:
  • Getting Started: https://clawpatrol.dev/docs/getting-started
  • Config Reference: https://clawpatrol.dev/docs/config-reference
• Prerequisites: Go and Node.js are needed for building from source.

Highlighted Details

• Rule Enforcement: Example HCL rule demonstrates blocking Kubernetes secrets from leaving the cluster.
• Condition Language: Utilizes CEL for flexible, fact-based condition evaluation over extracted wire traffic data.
• Flexible Deployment: Offers three distinct deployment shapes: gateway (a standalone proxy), join (host-wide WireGuard tunnel), and run (per-process tunnel for Linux/macOS).
• Protocol Support: Extracts facts for Postgres/ClickHouse (SQL), Kubernetes, and HTTP.

Maintenance & Community

No specific details on contributors, sponsorships, or community channels were provided in the README.

Licensing & Compatibility

• License: MIT.
• Compatibility: No explicit restrictions mentioned for commercial use or closed-source linking.

Limitations & Caveats

No specific limitations, alpha status, or known issues were detailed in the provided README excerpt.