Clawvisor

Your agents act. You stay in control.

The gatekeeper between your AI agents and the APIs they act on.

Get Started · CLI · Agent Integration · Dashboard · Services · Runtime Proxy · Security

[!WARNING] Use at your own risk. Clawvisor is experimental software under active development. It has not been audited for security. LLMs are inherently nondeterministic — we make no guarantees that policies or safety checks will behave as expected in every case. Do not use Clawvisor as your sole safeguard for sensitive data or critical systems.

AI agents are getting good at doing things. The problem is letting them — safely. Give an agent your Gmail credentials and it can read, send, and delete anything. Refuse, and it can't help you at all.

Clawvisor sits in the middle. Agents never hold credentials. Instead, they declare tasks describing what they need to do, the user approves the scope, and Clawvisor handles credential injection, execution, and audit logging for every request under that task.

The typical flow: a user asks their agent to triage their inbox. The agent creates a Clawvisor task declaring what it needs — read emails, but ask before sending. The user approves the scope once, and the agent makes as many requests as it needs within that scope without further interruption. Actions outside the scope go to the user for per-request approval. Restrictions can hard-block specific actions entirely.

Approve a purpose, not a permission. Clawvisor enforces it on every request.

Get Started

Sign up (recommended)

The fastest way to try Clawvisor is hosted: sign up at clawvisor.com. No installation required — connect services and agents directly from the dashboard.

Self-host

Prefer to run Clawvisor yourself? Install the daemon:

curl -fsSL https://clawvisor.com/install.sh | sh

[!WARNING] Run your agent in a separate environment from Clawvisor — a sandboxed container, separate machine, or cloud VM. If the agent shares a host with Clawvisor, it can bypass the gateway by reading the database or process environment directly.

This downloads the latest binary, adds it to your PATH, and starts an interactive setup wizard that walks you through configuration — database, LLM provider for intent verification, Google OAuth, and more. No Go, Node, or Docker required.

Once setup completes, the daemon opens the web dashboard in your browser automatically.

Connect your agent

With Clawvisor running (hosted or self-hosted), connect your agent:

clawvisor-server connect-agent

This auto-detects installed agents (Claude Code, Claude Desktop) and walks you through connecting them. You can also target a specific agent directly:

clawvisor-server connect-agent claude-code      # install skill + env vars for Claude Code
clawvisor-server connect-agent claude-desktop   # configure MCP for Claude Desktop

For manual setup or other agents, see the integration guides: Claude Code · Claude Desktop (MCP) · OpenClaw · Any HTTP agent

Other self-host options

From source (Go + Node)

git clone https://github.com/clawvisor/clawvisor.git
cd clawvisor
make setup    # interactive config wizard
make run      # start server (SQLite, magic link auth)
make tui      # terminal dashboard (separate terminal)

make setup generates config.yaml and a vault.key (database, Google OAuth, intent verification). make run starts the server, creates an admin@local user, and opens the dashboard via a magic link. make tui auto-authenticates using the local session file.

Requires Go 1.25+ and Node.js 18+. See docs/SETUP_LOCAL.md for details.

Docker

git clone https://github.com/clawvisor/clawvisor.git
cd clawvisor
make up       # docker compose (app + postgres)

See docs/SETUP_DOCKER.md for details.

Cloud / remote server

See docs/SETUP_CLOUD.md for deploying to a VPS, container platform, or Cloud Run.

For the complete agent API protocol, see skills/clawvisor/SKILL.md.

CLI Reference

The clawvisor-server CLI is the primary interface for managing Clawvisor. Run clawvisor-server install on a fresh machine for a guided walkthrough that runs setup, services, connect-agent, and dashboard in sequence.

Setup & installation

Daemon lifecycle

Services

Agent connection

Agent management

Dashboard & UI

Other

Configuration

Clawvisor loads config.yaml from the working directory (override with CONFIG_FILE env var). Most settings have env var overrides:

See config.example.yaml for the full configuration reference.

How It Works

Agent                    Clawvisor                         External API
  │                         │                                   │
  ├── POST /api/tasks ─────►│  (declare scope, wait for user)   │
  │◄── task approved ───────┤                                   │
  │                         │                                   │
  ├── POST /api/gateway ───►│                                   │
  │   (with task_id)        ├─ Check restrictions               │
  │                         ├─ Check task scope                 │
  │                         ├─ Auto-execute or queue approval   │
  │                         │                                   │
  │                         │  ┌─ On execute: ──────────────┐   │
  │                         │  │  Inject credentials        │   │
  │                         │  │  Call adapter ────────────────►│
  │                         │  │  Format response  ◄────────────┤
  │                         │  │  Intent verification       │   │
  │                         │  │  Audit log                 │   │
  │                         │  └────────────────────────────┘   │
  │◄── Response ────────────┤                                   │

Every gateway request passes through three authorization layers, checked in order:

1. Restrictions — hard blocks you configure on specific service/action pairs. If a restriction matches, the request is denied immediately. Use these for actions you never want any agent to take (e.g. "no agent can delete calendar events").
2. Task scopes — the primary mechanism. When an agent needs to do something, it creates a task declaring the purpose and which service/action pairs it needs. You review and approve the scope once. After that, requests under that task execute without further interruption — you approved the purpose, not each individual call. Tasks can be session-scoped (expire after a TTL) or standing (persist until you revoke them).
3. Per-request approval — the fallback. Any request that isn't covered by a task scope goes to the approval queue, and you're notified via the dashboard, Telegram, or push notification to your phone. This is the default for actions the agent didn't declare upfront, or for task actions marked auto_execute: false (e.g. sending emails).

When a task is created, Clawvisor can optionally run an LLM-powered risk assessment that evaluates the scope breadth, purpose-scope coherence, and internal consistency of the task. The assessment produces a risk level (low, medium, high, critical) shown in the dashboard to help inform your approval decision. High and critical risk tasks require a confirmation step before approval.

For multi-step tasks, chain context verification tracks structural facts (IDs, email addresses, phone numbers) extracted from adapter results and feeds them into subsequent verification prompts. This prevents a compromised agent from reading an inbox and then targeting an entity not present in the results. Chain context is activated by passing a consistent session_id across related gateway requests.

All three LLM subsystems (intent verification, chain context extraction, and task risk assessment) are covered by eval suites totaling 249 cases. See docs/eval-results.md for accuracy breakdowns and failure analysis.

Supported Services