The Problem

Your files are precious. Your AI agent's memory. Your dotfiles. Your configs. Your writing.

One bad edit. One corrupted file. One accidental delete. Gone.

Cloud backups? They can read your data. Time Machine? No encryption. Manual exports? You'll forget.

You need backups that are automatic, encrypted, and private.

The Solution

ClawKeep gives you continuous, encrypted backups with full version history. Every change is captured. Every version is recoverable. Everything is AES-256 encrypted before it leaves your machine.

clawkeep init       →  start protecting a directory
clawkeep watch      →  auto-backup every change (encrypted)
clawkeep restore    →  go back to any point in time

Three commands. Your files are protected forever. Nobody can read them but you.

🔐 Privacy First

ClawKeep is built on a simple principle: your data is yours.

• AES-256-GCM encryption — Military-grade encryption for all backups
• Zero-knowledge — Your backup target only sees numbered .enc chunks
• No file names leaked — Directory structure, file names, everything encrypted
• Local-first — Works entirely offline, no account required
• Open source — Audit the code yourself

What your NAS/cloud sees:     What's actually inside:
├── chunk-000001.enc          ├── MEMORY.md
├── chunk-000002.enc          ├── config/
├── manifest.enc              │   ├── secrets.yaml
                              │   └── api-keys.json
                              └── notes/
                                  └── journal.md

Your backup target learns nothing. Not file names, not sizes, not structure. Just opaque encrypted blobs.

Quick Start

npm install -g clawkeep

cd ~/my-important-files
clawkeep init

✔ ClawKeep initialized!
  🐾 Directory is now protected
  Tracked     42 files
  Backup      a8f3c2d1

# Set it and forget it — runs in background
clawkeep watch --daemon

Done. Every file change is now automatically versioned and ready for encrypted backup.

Encrypted Backup Targets

Send your encrypted backups anywhere. They can't read them anyway.

# Set your encryption password (once)
clawkeep backup set-password

# Back up to a local path (NAS, external drive, USB)
clawkeep backup local /mnt/nas/backups

# Sync — only new changes are uploaded
clawkeep backup sync

# Check backup status
clawkeep backup status

Your backup target receives encrypted chunks only. No metadata. No history. Nothing useful without your password.

| Target | Status | Description | |---|---|---| | Local path | ✅ Available | Any mounted folder — NAS, USB drive, network share | | S3 / R2 | ✅ Available | Object storage (Cloudflare R2, AWS S3, MinIO, Backblaze B2, Wasabi) | | ClawKeep Cloud | ✅ Available | Managed zero-knowledge backup with browser-based setup |

ClawKeep Cloud Setup

The easiest way to get started. Your encryption password is set in the browser — the CLI never sees it.

# Connect to ClawKeep Cloud
clawkeep cloud setup

# Opens browser → log in → set your encryption password
# CLI receives only the encrypted key material, never the password

✔ Authorization received
✓ Connected to ClawKeep Cloud
  Workspace ws_01abc123...

What's next:
  $ clawkeep watch --sync --daemon

Security: The encryption key is derived in your browser. Your plaintext password never leaves the browser, never hits our API, and the CLI never sees it. We store only encrypted chunks — true zero-knowledge.

# Start auto-syncing (no password in environment needed!)
clawkeep watch --sync --daemon

S3 / R2 Setup

# Configure S3-compatible target
clawkeep backup s3 \
  --endpoint https://your-account.r2.cloudflarestorage.com \
  --bucket my-backups \
  --access-key AKIAIOSFODNN7EXAMPLE \
  --secret-key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY \
  --region auto \
  --prefix clawkeep/

# Or use environment variables for credentials
export CLAWKEEP_S3_ACCESS_KEY=your-access-key
export CLAWKEEP_S3_SECRET_KEY=your-secret-key
clawkeep backup s3 --endpoint https://... --bucket my-backups

# Sync encrypted chunks to S3
clawkeep backup sync

Works with any S3-compatible service: Cloudflare R2 (zero egress fees), AWS S3, Backblaze B2, MinIO, Wasabi, and more.

Commands

| Command | What it does | |---|---| | clawkeep init | Start protecting a directory | | clawkeep watch | Auto-backup on file changes. --daemon for background | | clawkeep snap | Manual backup with optional -m "message" | | clawkeep log | Browse your backup timeline | | clawkeep restore <ref> | Time-travel to any backup | | clawkeep diff | See what changed since last backup | | clawkeep backup | Manage encrypted backup targets | | clawkeep backup sync | Push encrypted backup to target | | clawkeep backup restore | Restore from encrypted backup | | clawkeep export | Portable encrypted archive | | clawkeep import | Restore from encrypted archive | | clawkeep status | Show protection stats | | clawkeep ui | Launch the web dashboard |

Web Dashboard

A clean, dark-themed dashboard to manage your backups visually.

clawkeep ui --daemon --port 3333

Four tabs, everything you need:

• ◉ Dashboard — Protection status, recent changes, pending files
• ↻ History — Full timeline with diffs, compare any two points
• ☁ Backup — Configure targets, sync, download encrypted exports
• ≡ Browse — File browser with time-travel — view any file at any point

Also includes:

• 🎨 Syntax highlighting for code files
• ✏️ Named backups from the UI
• ⏪ One-click restore to any backup
• 🔐 Token-based auth

Watch Mode

The killer feature. Continuous protection without thinking about it:

# Foreground (see live output)
clawkeep watch

# Background daemon (survives terminal close)
clawkeep watch --daemon

# Stop the daemon
clawkeep watch --stop

# Auto-sync to backup target after each change
clawkeep watch --sync --daemon

Smart debouncing, stability detection, configurable ignore patterns. Your files are continuously protected.

🔑 Keyless Daemon

When using ClawKeep Cloud, the watch daemon doesn't need your password in the environment. The encrypted key material is stored locally during cloud setup — the daemon uses it automatically.

# No CLAWKEEP_PASSWORD needed!
clawkeep watch --sync --daemon

# Works with PM2, systemd, or any process manager
pm2 start "clawkeep watch --sync" --name clawkeep-watch

For local/S3 targets, run clawkeep backup set-password once to store the encrypted key material, then the daemon works the same way.

Time-Travel Restore

Go back to any point in time. Your current state is preserved — nothing is ever lost.

# See the timeline
clawkeep log

# Restore to a specific backup
clawkeep restore abc123f

# Restore to 3 backups ago
clawkeep restore HEAD~3

Restores are non-destructive — your full history is always intact.

Portable Encrypted Archives

Take your backups anywhere with encrypted exports:

# Create encrypted archive
clawkeep export -p "your-password"
# → my-project.clawkeep.enc

# Restore on another machine
clawkeep import backup.clawkeep.enc -p "your-password"

One file. Fully encrypted. Restore anywhere.

Built for AI Agents

ClawKeep was originally built to protect AI agent workspaces — memory files, personality configs, conversation history. One bad inference and your agent's identity is gone.

| Framework | What to protect | |---|---| | Clawdbot | MEMORY.md, SOUL.md, IDENTITY.md, daily notes | | Claude Code | CLAUDE.md, project context, artifacts | | CrewAI | Agent memory, task outputs, crew configs | | AutoGPT | Agent state, workspace, memory | | Any agent | Memory, config, state files |

ClawKeep ships with a SKILL.md that AI agents can read and follow autonomously.

Works for Everything

AI agents are the origin story, but ClawKeep protects anything:

• Dotfiles — ~/.config, shell rc files, SSH configs
• Writing — Manuscripts, notes, journals
• Configs — Server configs, infrastructure as code
• Development — Project files, local databases
• Any directory — If it changes, ClawKeep can protect it

Smart Ignore

Sensible defaults out of the box:

# .clawkeepignore (auto-generated)
node_modules/
__pycache__/
dist/
.env
*.log

Add your own patterns. Large files and build artifacts stay out automatically.

Programmatic API

const { ClawKeep } = require('clawkeep');

const claw = new ClawKeep('/path/to/project');
await claw.init();

// Create backup
const snap = await claw.snap('before risky changes');

// Browse history
const history = await claw.log(10);

// Restore
await claw.restore('abc123');

// Time-travel file access
const oldContent = await claw.showFileAtCommit('abc123', 'config.yaml');

Roadmap

• [x] S3 / R2 / MinIO backend
• [ ] clawkeep.com — zero-knowledge cloud backup
• [ ] End-to-end encrypted team sharing
• [ ] Webhooks on file changes
• [ ] Mobile app for backup status

License

MIT — ClawKeep 🐾