cf-clawguard

Antivirus for AI Agents. 131 detection rules across static scanning, MCP runtime proxy, and pre-install vetting. Covers 8/10 OWASP Agentic Security Initiative categories. Protects against prompt injection, data exfiltration, MCP protocol attacks, memory poisoning, trust exploitation, and supply chain compromise.

Install

npm install -g @foxifi.io/clawguard

The CLI is installed as clawguard:

clawguard --help

Without installing globally:

npx @foxifi.io/clawguard --help

Quick Start

cd /path/to/your/openclaw/project
clawguard init

init detects your OpenClaw installation, creates a .clawguard/ config directory, generates a .env with secure defaults, and seeds bundled threat definitions.

clawguard scan       # scan installed skills for security threats
clawguard fix        # auto-remediate fixable issues
clawguard protect    # start the continuous protection daemon

Commands

| Command | Description | |---------|-------------| | clawguard init | Set up ClawGuard for your OpenClaw installation | | clawguard scan | Check all installed skills for security threats (--mcp-only to scan just MCP servers) | | clawguard fix | Fix security issues (quarantine, dependency updates, credential rotation) | | clawguard report | View or export the latest scan results (terminal / JSON / HTML) | | clawguard watch | Watch for new or changed skills in real time | | clawguard protect | Start ongoing protection with alerting (--daemon to background, --mcp to proxy MCP traffic) | | clawguard update | Fetch the latest threat definitions | | clawguard status | Check whether ClawGuard is running and healthy | | clawguard log | View recent security activity | | clawguard mcp-check <pkg> | Pre-install security check for an MCP server package | | clawguard mcp-relay | [internal] MCP stdio proxy with security inspection, invoked by protect --mcp | | clawguard mcp-audit | View the MCP message audit log (--stats for per-server summary) | | clawguard verify-audit-mcp | Verify the MCP audit log's hash chain hasn't been tampered with | | clawguard mcp-policy | Show the active MCP tool policy (allow/deny/confirm, rate limits) |

Run clawguard <command> --help for the full option list of each command.

What Gets Scanned

| Module | What It Checks | |--------|-----------------| | GatewayScan | Proxy config, bind address, auth token, CORS, TLS | | InstalledSkillsScan | Static analysis, injection patterns, dependencies, reputation | | CredentialScan | Leaked secrets in config files and environment | | EnvironmentScan | Platform security, Node.js version, permissions | | MCP Static (CG-MCP-001~004) | Unresolvable source, env secret exposure, tool description injection, excessive tools | | MCP Runtime (CG-MCP-RT-001~018) | Tool policy, injection, rate limit, credentials, response injection, memory poisoning, trust exploitation, server-initiated sampling, tools/list drift, SSRF, command injection, path traversal, protocol version drift, lockout, notification flood | | MCP Registry (CG-MCP-REG-001~003) | npm metadata evaluation, Smithery lookup, pre-install code scan with tarball integrity verification | | OWASP ASI06 (CG-MEM-001~004) | Persistent memory injection, context stuffing, RAG poisoning, history manipulation | | OWASP ASI09 (CG-TRUST-001~004) | Fake confirmations, approval bypass, role impersonation, social engineering |

Detection rules span static, runtime, and pre-install scanning, covering 8/10 OWASP Agentic Security Initiative categories.

MCP Security

ClawGuard protects Model Context Protocol servers at three points in their lifecycle:

1. Before you install a server — check it before it ever touches your machine:

clawguard mcp-check @modelcontextprotocol/server-filesystem

This evaluates npm registry metadata (age, download counts, maintainers), cross-checks the Smithery registry, and runs a static code scan against a npm pack --ignore-scripts tarball whose SHA-512 hash is verified against the registry's published dist.integrity — so postinstall RCE and MITM/hijacked-mirror tampering are caught before any script executes. It prints a SAFE / WARNING / DANGEROUS grade and recommendation.

2. While a server is running — proxy and inspect live MCP traffic:

clawguard protect --mcp

This rewrites your OpenClaw MCP config so each configured server is launched through ClawGuard's stdio relay (mcp-relay) instead of directly, transparently inspecting every JSON-RPC message in both directions. The inspector enforces tool allow/deny/confirm policy, per-tool rate limiting with progressive-penalty server lockout, and blocks or alerts on prompt injection, credential leaks, SSRF/command-injection/path-traversal in tool arguments, memory poisoning, trust exploitation, and unexpected tools/list drift or protocol-version mismatches. Run clawguard protect --restore to revert the config back to launching servers directly.

Tune the policy in .clawguard/config.yml:

mcp:
  tool_policy:
    allow: ['*']
    deny: ['exec_shell']
    require_confirmation: ['delete_file']
  rate_limit:
    default: '60/min'
    overrides:
      search: '120/min'
  inspect_responses: true
  block_on_injection: true
  block_sampling: false

Check the effective policy at any time with clawguard mcp-policy.

3. After the fact — every inspected message is written to a tamper-evident, hash-chained audit log:

clawguard mcp-audit --stats     # per-server totals: events, blocked, alerts
clawguard mcp-audit -n 50       # last 50 raw events
clawguard verify-audit-mcp      # verify the hash chain hasn't been tampered with

Connecting to a Hub

For centralized management across a fleet of agents, point the client at a ClawGuard Hub:

# .env
HUB_URL=https://hub.example.com
HUB_API_KEY=your-api-key-here
HUB_HMAC_SECRET=your-hmac-secret-here

This enables centralized scan results, fleet-wide threat definition distribution, license management, and organization-level dashboards. The Hub is optional — the client works fully standalone.

Requirements

• Node.js >= 18.0.0 (CI and development use Node 22)

Links

• Repository
• Issues