clawmoat 0.7.0 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/CONTRIBUTING.md +4 -2
  2. package/README.md +64 -2
  3. package/SECURITY.md +58 -10
  4. package/clawmoat-0.8.0.tgz +0 -0
  5. package/docs/blog/386-malicious-skills.html +255 -0
  6. package/docs/blog/40000-exposed-openclaw-instances.html +194 -0
  7. package/docs/blog/agent-trust-protocol.html +197 -0
  8. package/docs/blog/clawmoat-vs-llamafirewall-nemo-guardrails.html +223 -0
  9. package/docs/blog/ibm-experts-agent-runtime-protection.html +238 -0
  10. package/docs/blog/index.html +144 -0
  11. package/docs/blog/mcp-30-cves-security-crisis.html +279 -0
  12. package/docs/blog/microsoft-openclaw-workstation-security.html +234 -0
  13. package/docs/blog/nist-ai-agent-standards-clawmoat.html +369 -0
  14. package/docs/blog/oasis-websocket-hijack.html +205 -0
  15. package/docs/blog/ollama-openclaw-security.html +154 -0
  16. package/docs/blog/openclaw-enterprise-readiness-claw10.html +198 -0
  17. package/docs/blog/openclaw-security-reckoning-2026.html +361 -0
  18. package/docs/business/index.html +530 -0
  19. package/docs/business/install.html +247 -0
  20. package/docs/checklist.html +168 -0
  21. package/docs/finance/index.html +217 -0
  22. package/docs/hall-of-fame.html +168 -0
  23. package/docs/index.html +213 -49
  24. package/docs/install.sh +557 -0
  25. package/docs/privacy-policy/index.html +122 -0
  26. package/docs/scan/index.html +214 -0
  27. package/docs/sitemap.xml +132 -2
  28. package/docs/support/index.html +124 -0
  29. package/docs/terms-of-service/index.html +122 -0
  30. package/examples/basic-usage.js +38 -0
  31. package/package.json +1 -1
  32. package/server/index.js +87 -8
  33. package/server/index.js.patch +1 -0
  34. package/src/finance/index.js +585 -0
  35. package/src/finance/mcp-firewall.js +486 -0
  36. package/src/guardian/gateway-monitor.js +590 -0
  37. package/src/index.js +3 -0
package/docs/hall-of-fame.html ADDED
@@ -0,0 +1,168 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <link rel="icon" type="image/png" href="/favicon.png">
5
+ <link rel="apple-touch-icon" href="/apple-touch-icon.png">
6
+ <meta charset="UTF-8">
7
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
8
+ <title>Hall of Fame — ClawMoat Security Researchers</title>
9
+ <meta name="description" content="Recognizing the security researchers who help make ClawMoat stronger. Report vulnerabilities and earn your place in the Hall of Fame.">
10
+ <link rel="canonical" href="https://clawmoat.com/hall-of-fame.html">
11
+ <meta property="og:title" content="Hall of Fame — ClawMoat Security Researchers">
12
+ <meta property="og:description" content="Recognizing the security researchers who help make ClawMoat stronger.">
13
+ <meta property="og:url" content="https://clawmoat.com/hall-of-fame.html">
14
+ <meta property="og:type" content="website">
15
+ <style>
16
+ *{margin:0;padding:0;box-sizing:border-box}
17
+ :root{--navy:#0F172A;--navy-light:#1E293B;--navy-mid:#334155;--blue:#3B82F6;--emerald:#10B981;--white:#F8FAFC;--gray:#94A3B8;--gold:#F59E0B;--red:#EF4444}
18
+ html{scroll-behavior:smooth}
19
+ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:var(--navy);color:var(--white);line-height:1.6;overflow-x:hidden}
20
+ a{color:var(--blue);text-decoration:none}
21
+ a:hover{text-decoration:underline}
22
+ .container{max-width:1140px;margin:0 auto;padding:0 24px}
23
+
24
+ nav{position:fixed;top:0;left:0;right:0;z-index:100;background:rgba(15,23,42,.92);backdrop-filter:blur(12px);border-bottom:1px solid rgba(59,130,246,.15);padding:16px 0}
25
+ nav .container{display:flex;align-items:center;justify-content:space-between}
26
+ .logo{font-size:1.25rem;font-weight:700;display:flex;align-items:center;gap:8px;color:var(--white)}
27
+ .nav-links{display:flex;gap:28px;align-items:center}
28
+ .nav-links a{color:var(--gray);font-size:.9rem;transition:color .2s}
29
+ .nav-links a:hover{color:var(--white);text-decoration:none}
30
+ .nav-links .btn-sm{color:var(--navy);background:var(--emerald);padding:6px 28px;border-radius:20px;font-weight:600;font-size:.85rem;white-space:nowrap}
31
+ .menu-toggle{display:none;background:none;border:none;color:var(--white);font-size:1.5rem;cursor:pointer}
32
+
33
+ .hero{padding:160px 0 80px;text-align:center}
34
+ .hero h1{font-size:3rem;margin-bottom:16px;background:linear-gradient(135deg,var(--gold),var(--emerald));-webkit-background-clip:text;-webkit-text-fill-color:transparent}
35
+ .hero p{font-size:1.2rem;color:var(--gray);max-width:700px;margin:0 auto 40px}
36
+
37
+ .tiers{display:grid;grid-template-columns:repeat(auto-fit,minmax(320px,1fr));gap:32px;margin-bottom:80px}
38
+ .tier{background:var(--navy-light);border-radius:16px;padding:40px;border:1px solid var(--navy-mid);text-align:center}
39
+ .tier h2{font-size:1.5rem;margin-bottom:12px}
40
+ .tier .icon{font-size:3rem;margin-bottom:16px}
41
+ .tier p{color:var(--gray);font-size:.95rem;line-height:1.7}
42
+ .tier.gold{border-color:var(--gold)}
43
+ .tier.gold h2{color:var(--gold)}
44
+
45
+ .researchers{margin-bottom:80px}
46
+ .researchers h2{font-size:2rem;text-align:center;margin-bottom:40px}
47
+ .empty-state{text-align:center;padding:60px 40px;background:var(--navy-light);border-radius:16px;border:1px dashed var(--navy-mid)}
48
+ .empty-state .icon{font-size:4rem;margin-bottom:16px}
49
+ .empty-state p{color:var(--gray);font-size:1.1rem;margin-bottom:24px}
50
+ .cta-btn{display:inline-block;background:var(--emerald);color:var(--navy);padding:12px 32px;border-radius:12px;font-weight:700;font-size:1rem;transition:opacity .2s}
51
+ .cta-btn:hover{opacity:.9;text-decoration:none}
52
+ .cta-btn.gold-btn{background:var(--gold)}
53
+
54
+ .how-it-works{margin-bottom:80px}
55
+ .how-it-works h2{font-size:2rem;text-align:center;margin-bottom:40px}
56
+ .steps{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:24px}
57
+ .step{background:var(--navy-light);border-radius:12px;padding:32px;text-align:center;border:1px solid var(--navy-mid)}
58
+ .step .num{display:inline-block;width:40px;height:40px;line-height:40px;border-radius:50%;background:var(--blue);color:var(--white);font-weight:700;margin-bottom:12px}
59
+ .step h3{margin-bottom:8px}
60
+ .step p{color:var(--gray);font-size:.9rem}
61
+
62
+ footer{border-top:1px solid var(--navy-mid);padding:40px 0;text-align:center;color:var(--gray);font-size:.85rem}
63
+
64
+ @media(max-width:768px){
65
+ .hero h1{font-size:2rem}
66
+ .menu-toggle{display:block}
67
+ .nav-links{display:none}
68
+ .nav-links.open{display:flex;flex-direction:column;position:absolute;top:100%;left:0;right:0;background:var(--navy);padding:20px;gap:16px;border-bottom:1px solid var(--navy-mid)}
69
+ }
70
+ </style>
71
+ </head>
72
+ <body>
73
+
74
+ <nav>
75
+ <div class="container">
76
+ <div class="logo"><a href="/"><img src="/logo.svg" alt="ClawMoat" style="height:44px"></a></div>
77
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
78
+ <div class="nav-links">
79
+ <a href="/">Home</a>
80
+ <a href="/blog/">Blog</a>
81
+ <a href="https://github.com/darfaz/clawmoat">GitHub</a>
82
+ <a href="https://github.com/darfaz/clawmoat/blob/main/SECURITY.md">Report a Bug</a>
83
+ <a href="/" class="btn-sm">Get Started</a>
84
+ </div>
85
+ </div>
86
+ </nav>
87
+
88
+ <section class="hero">
89
+ <div class="container">
90
+ <h1>🏆 Hall of Fame</h1>
91
+ <p>Recognizing the security researchers who help make ClawMoat stronger. Find a vulnerability, earn your place here forever.</p>
92
+ </div>
93
+ </section>
94
+
95
+ <section class="container">
96
+
97
+ <div class="tiers">
98
+ <div class="tier gold">
99
+ <div class="icon">🛡️</div>
100
+ <h2>Founding Security Advisor</h2>
101
+ <p>The highest honor. Reserved for researchers who discover critical vulnerabilities during ClawMoat's early days (pre-v1.0). Founding Advisors get permanent recognition, a profile link on this page, and acknowledgment in every major release. This title can never be earned again after v1.0.</p>
102
+ </div>
103
+ <div class="tier">
104
+ <div class="icon">🏆</div>
105
+ <h2>Hall of Fame</h2>
106
+ <p>For any verified security vulnerability report — scanner bypasses, policy engine escapes, audit log tampering, or any other valid security finding. Your name (or handle) and contribution are listed permanently.</p>
107
+ </div>
108
+ <div class="tier">
109
+ <div class="icon">🙏</div>
110
+ <h2>Honorable Mention</h2>
111
+ <p>For reports that don't qualify as security vulnerabilities but still improve ClawMoat's security posture — edge cases, hardening suggestions, documentation improvements, or defense-in-depth recommendations.</p>
112
+ </div>
113
+ </div>
114
+
115
+ <div class="researchers">
116
+ <h2>Founding Security Advisors</h2>
117
+ <div class="empty-state">
118
+ <div class="icon">🔍</div>
119
+ <p>No Founding Security Advisors yet. Be the first to find a critical vulnerability and claim this title forever.</p>
120
+ <a href="https://github.com/darfaz/clawmoat/blob/main/SECURITY.md" class="cta-btn gold-btn">Read the Security Policy →</a>
121
+ </div>
122
+ </div>
123
+
124
+ <div class="researchers">
125
+ <h2>Hall of Fame Researchers</h2>
126
+ <div class="empty-state">
127
+ <div class="icon">🏰</div>
128
+ <p>The Hall of Fame awaits its first member. Can you bypass ClawMoat's defenses?</p>
129
+ <a href="https://github.com/darfaz/hack-clawmoat" class="cta-btn">Take the Hack Challenge →</a>
130
+ </div>
131
+ </div>
132
+
133
+ <div class="how-it-works">
134
+ <h2>How It Works</h2>
135
+ <div class="steps">
136
+ <div class="step">
137
+ <div class="num">1</div>
138
+ <h3>Find a Bug</h3>
139
+ <p>Test ClawMoat's scanners, policy engine, or any component. Try the <a href="https://github.com/darfaz/hack-clawmoat">Hack Challenge</a> for guided scenarios.</p>
140
+ </div>
141
+ <div class="step">
142
+ <div class="num">2</div>
143
+ <h3>Report It</h3>
144
+ <p>Email <strong>security@clawmoat.com</strong> with details, reproduction steps, and impact assessment. See <a href="https://github.com/darfaz/clawmoat/blob/main/SECURITY.md">SECURITY.md</a>.</p>
145
+ </div>
146
+ <div class="step">
147
+ <div class="num">3</div>
148
+ <h3>Get Verified</h3>
149
+ <p>We'll acknowledge within 48 hours and assess within 7 days. Valid findings get a CVE if applicable.</p>
150
+ </div>
151
+ <div class="step">
152
+ <div class="num">4</div>
153
+ <h3>Get Recognized</h3>
154
+ <p>Your name goes on the Hall of Fame permanently. Critical findings pre-v1.0 earn the Founding Security Advisor title.</p>
155
+ </div>
156
+ </div>
157
+ </div>
158
+
159
+ </section>
160
+
161
+ <footer>
162
+ <div class="container">
163
+ <p>🏰 ClawMoat — The Trust Layer for AI Agents &nbsp;|&nbsp; <a href="https://github.com/darfaz/clawmoat">GitHub</a> &nbsp;|&nbsp; <a href="https://github.com/darfaz/clawmoat/blob/main/SECURITY.md">Security Policy</a></p>
164
+ </div>
165
+ </footer>
166
+
167
+ </body>
168
+ </html>
package/docs/index.html CHANGED
@@ -5,21 +5,21 @@
5
5
  <link rel="apple-touch-icon" href="/apple-touch-icon.png">
6
6
  <meta charset="UTF-8">
7
7
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
8
- <title>ClawMoat — The Trust Layer for AI Agents, Wherever They Run</title>
9
- <meta name="description" content="The trust layer for AI agents — laptop, dedicated machine, or cloud. Runtime security, credential monitoring, skill integrity checking, and full audit trails.">
8
+ <title>ClawMoat — The Security Layer Between AI Agents and Your Machine</title>
9
+ <meta name="description" content="The only open-source tool that protects your SSH keys, credentials, and file system from AI agents. Host-level security with permission tiers, forbidden zones, and full audit trails. Zero dependencies.">
10
10
  <link rel="canonical" href="https://clawmoat.com/">
11
11
 
12
12
  <!-- Open Graph -->
13
- <meta property="og:title" content="ClawMoat — The Trust Layer for AI Agents, Wherever They Run">
14
- <meta property="og:description" content="The trust layer for AI agents — laptop, dedicated machine, or cloud. Runtime security, credential monitoring, skill integrity checking, and full audit trails.">
13
+ <meta property="og:title" content="ClawMoat — They Protect the Model. We Protect Your Machine.">
14
+ <meta property="og:description" content="The only open-source security layer that guards your SSH keys, credentials, and file system from AI agents. Permission tiers, forbidden zones, audit trails. One npm install.">
15
15
  <meta property="og:image" content="https://clawmoat.com/og-image.png">
16
16
  <meta property="og:url" content="https://clawmoat.com">
17
17
  <meta property="og:type" content="website">
18
18
 
19
19
  <!-- Twitter Card -->
20
20
  <meta name="twitter:card" content="summary_large_image">
21
- <meta name="twitter:title" content="ClawMoat — The Trust Layer for AI Agents, Wherever They Run">
22
- <meta name="twitter:description" content="The trust layer for AI agents — laptop, dedicated machine, or cloud. Runtime security, credential monitoring, skill integrity checking, and full audit trails.">
21
+ <meta name="twitter:title" content="ClawMoat — They Protect the Model. We Protect Your Machine.">
22
+ <meta name="twitter:description" content="The only open-source security layer that guards your SSH keys, credentials, and file system from AI agents. Permission tiers, forbidden zones, audit trails.">
23
23
  <meta name="twitter:image" content="https://clawmoat.com/og-image.png">
24
24
 
25
25
  <!-- Structured Data -->
@@ -256,19 +256,15 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
256
256
  <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
257
257
  <div class="nav-links">
258
258
  <a href="#problem">Why</a>
259
- <a href="#deploy">Deploy</a>
260
259
  <a href="#guardian">Guardian</a>
261
260
  <a href="#features">Features</a>
262
- <a href="#demo">Demo</a>
263
- <a href="#badge">Badge</a>
261
+ <a href="#compare">Compare</a>
264
262
  <a href="#pricing">Pricing</a>
265
- <a href="/playground.html">Playground</a>
266
- <a href="/compare.html">Compare</a>
267
- <a href="/integrations/langchain.html">Integrations</a>
268
- <a href="/report-demo.html">Sample Report</a>
269
- <a href="/blog/">Blog</a>
263
+ <a href="/business/" style="color:var(--emerald);font-weight:600">Business</a>
264
+ <a href="/scan/" style="color:#ff6b6b;font-weight:600">Free Scanner</a>
265
+ <a href="/finance/" style="color:#f5c542;font-weight:600">Finance</a>
270
266
  <a href="https://github.com/darfaz/clawmoat">GitHub</a>
271
- <a href="#waitlist" class="btn-sm">Join Waitlist</a>
267
+ <a href="#pricing" class="btn-sm">Get Started Free</a>
272
268
  </div>
273
269
  </div>
274
270
  </nav>
@@ -282,21 +278,57 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
282
278
  <div class="hero-video-overlay"></div>
283
279
  </div>
284
280
  <div class="container">
285
- <h1>The <span class="highlight">Trust Layer</span> for AI Agents,<br>Wherever They Run</h1>
286
- <p>Laptop, dedicated machine, or cloud — ClawMoat secures your AI agents with credential monitoring, skill integrity checking, network egress logging, and inter-agent message scanning.</p>
281
+ <h1><span class="highlight">They protect the model.</span> We protect <em>your machine.</em></h1>
282
+ <p style="font-size:1.3rem;color:var(--white);max-width:720px;margin:0 auto 16px">The only open-source security layer that guards your SSH keys, credentials, and file system from AI agents — not just their prompts.</p>
283
+ <p style="font-size:1.05rem;color:var(--gray);max-width:560px;margin:0 auto 40px">One npm install. Zero dependencies. Sub-millisecond scanning. Free forever.</p>
284
+ <div class="install-cmd" style="margin:0 auto 32px"><span class="dollar">$</span> npm install -g clawmoat</div>
287
285
  <div class="hero-btns">
288
- <a href="#waitlist" class="btn btn-primary">Get Early Access</a>
289
- <a href="https://github.com/darfaz/clawmoat" class="btn btn-outline">⭐ Star on GitHub</a>
286
+ <a href="https://github.com/darfaz/clawmoat" class="btn btn-primary">⭐ Star on GitHub</a>
287
+ <a href="#pricing" class="btn btn-outline">See Plans</a>
290
288
  </div>
291
289
  <div class="hero-badges">
292
290
  <span><a href="https://www.npmjs.com/package/clawmoat"><img src="https://img.shields.io/npm/v/clawmoat?style=flat-square&color=3B82F6" alt="npm" style="height:18px;vertical-align:middle"></a></span>
293
- <span>🛡️ Host Guardian</span>
294
- <span>🔒 4 Permission Tiers</span>
295
- <span>🔍 Inter-Agent Scanning</span>
296
291
  <span>⚡ Zero Dependencies</span>
297
- <span>✅ 128 Tests Passing</span>
298
292
  <span>📦 MIT License</span>
293
+ <span>✅ 142 Tests Passing</span>
299
294
  </div>
295
+ <!-- Live Stats Ticker -->
296
+ <div id="stats-ticker" style="margin-top:32px;display:flex;gap:40px;justify-content:center;flex-wrap:wrap;align-items:center;opacity:0;transition:opacity .5s">
297
+ <div style="text-align:center">
298
+ <div id="stat-total" style="font-size:2.4rem;font-weight:800;background:linear-gradient(135deg,var(--blue),var(--emerald));-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text">—</div>
299
+ <div style="font-size:.8rem;color:var(--gray);text-transform:uppercase;letter-spacing:.05em">Total installs &amp; clones</div>
300
+ </div>
301
+ <div style="width:1px;height:40px;background:var(--navy-light)"></div>
302
+ <div style="text-align:center">
303
+ <div id="stat-stars" style="font-size:1.6rem;font-weight:800;color:var(--orange)">—</div>
304
+ <div style="font-size:.75rem;color:var(--gray);text-transform:uppercase;letter-spacing:.05em">⭐ GitHub stars</div>
305
+ </div>
306
+ <div style="text-align:center">
307
+ <div id="stat-downloads" style="font-size:1.6rem;font-weight:800;color:var(--emerald)">—</div>
308
+ <div style="font-size:.75rem;color:var(--gray);text-transform:uppercase;letter-spacing:.05em">📦 npm downloads</div>
309
+ </div>
310
+ <div style="text-align:center">
311
+ <div id="stat-clones" style="font-size:1.6rem;font-weight:800;color:var(--blue)">—</div>
312
+ <div style="font-size:.75rem;color:var(--gray);text-transform:uppercase;letter-spacing:.05em">🔄 Git clones</div>
313
+ </div>
314
+ </div>
315
+ <script>
316
+ (async function(){
317
+ try {
318
+ const r = await fetch('https://clawmoat-production.up.railway.app/api/stats');
319
+ const s = await r.json();
320
+ if(s.npm_downloads_total){
321
+ const anim=(el,target)=>{let c=0;const step=Math.max(1,Math.ceil(target/40));const t=setInterval(()=>{c=Math.min(c+step,target);el.textContent=c.toLocaleString()+'+';if(c>=target)clearInterval(t)},25)};
322
+ const total = s.npm_downloads_total + (s.github_clones||0) + (s.github_forks||0);
323
+ anim(document.getElementById('stat-total'), total);
324
+ anim(document.getElementById('stat-stars'), s.github_stars);
325
+ anim(document.getElementById('stat-downloads'), s.npm_downloads_total);
326
+ anim(document.getElementById('stat-clones'), s.github_clones||0);
327
+ document.getElementById('stats-ticker').style.opacity='1';
328
+ }
329
+ }catch(e){}
330
+ })();
331
+ </script>
300
332
  </div>
301
333
  </section>
302
334
 
@@ -304,8 +336,8 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
304
336
  <section class="problem" id="problem">
305
337
  <div class="container">
306
338
  <div class="section-label">The Problem</div>
307
- <h2 class="section-title">Your AI agent has the keys to everything</h2>
308
- <p class="section-sub">Shell access. Browser control. Email. Files. One prompt injection in a webpage or email can hijack it all. This isn't theoretical — researchers are proving it every week.</p>
339
+ <h2 class="section-title">You gave your AI agent root access to your life</h2>
340
+ <p class="section-sub">SSH keys. AWS credentials. Browser cookies. Crypto wallets. Your agent can read them all right now. One poisoned email, one malicious skill, and everything leaves through a single curl command. This isn't a hypothetical — it happened last month.</p>
309
341
  <div class="problem-grid">
310
342
  <div class="threat-card">
311
343
  <div class="icon">💉</div>
@@ -325,18 +357,49 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
325
357
  <div class="threat-card">
326
358
  <div class="icon">🌐</div>
327
359
  <h3>Massive Exposure</h3>
328
- <p>SecurityScorecard found 135K exposed OpenClaw instances. RNWY confirmed no agent identity system exists. The attack surface is enormous.</p>
360
+ <p><a href="https://www.oasis.security/blog/openclaw-vulnerability" style="color:var(--blue)">Any website can hijack your agent</a> (Oasis Security). 40,000+ <a href="https://www.infosecurity-magazine.com/news/researchers-40000-exposed-openclaw/" style="color:var(--blue)">exposed instances</a>. <a href="https://www.infosecurity-magazine.com/news/researchers-six-new-openclaw/" style="color:var(--blue)">6 new CVEs this week</a>. <a href="https://www.onyx.app/insights/openclaw-enterprise-evaluation-framework" style="color:var(--blue)">Enterprise readiness: 1.2/5</a>.</p>
329
361
  </div>
330
362
  </div>
331
363
  </div>
332
364
  </section>
333
365
 
366
+ <!-- Social Proof -->
367
+ <section id="proof" style="padding:60px 0">
368
+ <div class="container" style="text-align:center">
369
+ <!-- Live stats from shields.io -->
370
+ <div style="display:flex;gap:12px;justify-content:center;flex-wrap:wrap;margin-bottom:40px">
371
+ <img src="https://img.shields.io/npm/dw/clawmoat?label=npm%20downloads&color=10B981&style=for-the-badge" alt="npm downloads" height="28">
372
+ <img src="https://img.shields.io/github/stars/darfaz/clawmoat?style=for-the-badge&color=3B82F6" alt="GitHub stars" height="28">
373
+ <img src="https://img.shields.io/badge/dependencies-0-10B981?style=for-the-badge" alt="0 dependencies" height="28">
374
+ <img src="https://img.shields.io/badge/scan%20time-%3C1ms-F8FAFC?style=for-the-badge" alt="<1ms scan time" height="28">
375
+ <img src="https://img.shields.io/badge/tests-142%20passing-10B981?style=for-the-badge" alt="142 tests passing" height="28">
376
+ <img src="https://img.shields.io/badge/license-MIT-3B82F6?style=for-the-badge" alt="MIT license" height="28">
377
+ </div>
378
+ <!-- Testimonials -->
379
+ <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;max-width:900px;margin:0 auto">
380
+ <blockquote style="border-left:3px solid var(--emerald);padding:16px 24px;text-align:left;background:var(--navy-light);border-radius:0 10px 10px 0">
381
+ <p style="font-size:1rem;font-style:italic;color:var(--white);margin-bottom:8px">"My OpenClaw bot was a fan of ClawMoat."</p>
382
+ <footer style="color:var(--gray);font-size:.85rem">— Jon, OpenClaw power user &amp; bot operator</footer>
383
+ </blockquote>
384
+ <blockquote style="border-left:3px solid var(--blue);padding:16px 24px;text-align:left;background:var(--navy-light);border-radius:0 10px 10px 0">
385
+ <p style="font-size:1rem;font-style:italic;color:var(--white);margin-bottom:8px">"The only project I've seen that protects the host, not just the prompts. This is what the ecosystem needs."</p>
386
+ <footer style="color:var(--gray);font-size:.85rem">— OpenClaw community member</footer>
387
+ </blockquote>
388
+ </div>
389
+ <div style="margin-top:32px;display:flex;gap:24px;justify-content:center;flex-wrap:wrap;font-size:.9rem;color:var(--gray)">
390
+ <span>🔒 <a href="https://www.microsoft.com/en-us/security/blog/2026/02/19/running-openclaw-safely-identity-isolation-runtime-risk/" style="color:var(--blue)">Microsoft says</a> "don't run on workstations"</span>
391
+ <span>📊 Referenced by <a href="https://genai.owasp.org/" style="color:var(--blue)">OWASP Agentic AI</a> framework</span>
392
+ <span>🔬 Built on <a href="https://arxiv.org/abs/2501.13011" style="color:var(--blue)">Anthropic's agentic misalignment</a> research</span>
393
+ </div>
394
+ </div>
395
+ </section>
396
+
334
397
  <!-- Deployment Models -->
335
398
  <section id="deploy">
336
399
  <div class="container">
337
- <div class="section-label">Deployment Models</div>
338
- <h2 class="section-title">One tool, three ways to deploy</h2>
339
- <p class="section-sub">ClawMoat isn't just laptop security. It protects AI agents wherever they run.</p>
400
+ <div class="section-label">Where You Run Agents</div>
401
+ <h2 class="section-title">Your laptop. A dedicated box. The cloud. All protected.</h2>
402
+ <p class="section-sub">Same npm package, different deployment profiles. Pick the one that matches your setup.</p>
340
403
  <div class="deploy-grid">
341
404
  <div class="deploy-card">
342
405
  <div class="deploy-icon">💻</div>
@@ -381,9 +444,9 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
381
444
  <!-- Host Guardian — THE LEAD STORY -->
382
445
  <section id="guardian">
383
446
  <div class="container">
384
- <div class="section-label">Host Guardian</div>
385
- <h2 class="section-title">The security layer between AI and your laptop</h2>
386
- <p class="section-sub">Permission tiers let you dial up access as trust grows. Start locked down, open up gradually — like hiring a new employee.</p>
447
+ <div class="section-label">Host Guardian — The Mechanism</div>
448
+ <h2 class="section-title">Four permission tiers. Like hiring a new employee.</h2>
449
+ <p class="section-sub">Start at Observer (read-only). Promote to Worker when you trust it. Every action is validated against your tier in real-time — blocked actions get logged, not executed.</p>
387
450
 
388
451
  <div class="tiers-grid">
389
452
  <div class="tier-card">
@@ -482,9 +545,9 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
482
545
  <!-- What We Protect — Forbidden Zones -->
483
546
  <section class="problem" id="protect">
484
547
  <div class="container">
485
- <div class="section-label">What We Protect</div>
486
- <h2 class="section-title">Forbidden zones — auto-protected, always</h2>
487
- <p class="section-sub">These sensitive areas are off-limits by default, regardless of permission tier. Your credentials stay yours.</p>
548
+ <div class="section-label">Forbidden Zones</div>
549
+ <h2 class="section-title">These directories are off-limits. Period.</h2>
550
+ <p class="section-sub">Even at the highest permission tier, ClawMoat blocks access to your most sensitive files. No override. No exceptions. No "are you sure?" — just blocked and logged.</p>
488
551
 
489
552
  <div class="zones-grid">
490
553
  <div class="zone-card">
@@ -575,9 +638,9 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
575
638
  <!-- Features (Scanners — now supporting features) -->
576
639
  <section class="problem" id="features">
577
640
  <div class="container">
578
- <div class="section-label">Scanners &amp; Features</div>
579
- <h2 class="section-title">Comprehensive scanning built in</h2>
580
- <p class="section-sub">Host Guardian is the gatekeeper. Scanners are the intelligence — detecting threats before they reach your machine.</p>
641
+ <div class="section-label">What It Catches</div>
642
+ <h2 class="section-title">8 scanners running on every message, every tool call</h2>
643
+ <p class="section-sub">Your agent processes hundreds of inputs per session. Each one passes through ClawMoat before it can touch your system.</p>
581
644
  <div class="features-grid">
582
645
  <div class="feature-card">
583
646
  <div class="icon">🔑</div>
@@ -738,17 +801,114 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
738
801
  </div>
739
802
  </section>
740
803
 
804
+ <!-- Compare -->
805
+ <section id="compare">
806
+ <div class="container">
807
+ <div class="section-label">How We're Different</div>
808
+ <h2 class="section-title">The only tool protecting the host, not just the prompt</h2>
809
+ <p class="section-sub">Other tools scan prompts. ClawMoat protects your entire machine — credentials, files, network, and skills.</p>
810
+ <div style="overflow-x:auto">
811
+ <table style="width:100%;border-collapse:collapse;font-size:.9rem;margin-top:32px">
812
+ <thead>
813
+ <tr style="border-bottom:2px solid var(--navy-mid)">
814
+ <th style="text-align:left;padding:12px 16px;color:var(--gray)">Capability</th>
815
+ <th style="text-align:center;padding:12px 16px;color:var(--emerald);font-weight:700">ClawMoat</th>
816
+ <th style="text-align:center;padding:12px 16px;color:var(--gray)">LlamaFirewall</th>
817
+ <th style="text-align:center;padding:12px 16px;color:var(--gray)">NeMo Guardrails</th>
818
+ <th style="text-align:center;padding:12px 16px;color:var(--gray)">Lakera Guard</th>
819
+ <th style="text-align:center;padding:12px 16px;color:var(--gray)">SecureClaw</th>
820
+ </tr>
821
+ </thead>
822
+ <tbody>
823
+ <tr style="border-bottom:1px solid rgba(255,255,255,.06)">
824
+ <td style="padding:10px 16px">Prompt injection detection</td>
825
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
826
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
827
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
828
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
829
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
830
+ </tr>
831
+ <tr style="border-bottom:1px solid rgba(255,255,255,.06)">
832
+ <td style="padding:10px 16px"><strong>Host-level protection</strong></td>
833
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
834
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
835
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
836
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
837
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
838
+ </tr>
839
+ <tr style="border-bottom:1px solid rgba(255,255,255,.06)">
840
+ <td style="padding:10px 16px"><strong>Credential monitoring</strong></td>
841
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
842
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
843
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
844
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
845
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
846
+ </tr>
847
+ <tr style="border-bottom:1px solid rgba(255,255,255,.06)">
848
+ <td style="padding:10px 16px"><strong>Skill/plugin auditing</strong></td>
849
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
850
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
851
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
852
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
853
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
854
+ </tr>
855
+ <tr style="border-bottom:1px solid rgba(255,255,255,.06)">
856
+ <td style="padding:10px 16px"><strong>Permission tiers</strong></td>
857
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
858
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
859
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
860
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
861
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
862
+ </tr>
863
+ <tr style="border-bottom:1px solid rgba(255,255,255,.06)">
864
+ <td style="padding:10px 16px">Zero dependencies</td>
865
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
866
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
867
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
868
+ <td style="text-align:center;padding:10px">N/A (SaaS)</td>
869
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td></tr>
870
+ <tr style="border-bottom:1px solid rgba(255,255,255,.06)">
871
+ <td style="padding:10px 16px">Open source</td>
872
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅ MIT</td>
873
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
874
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
875
+ <td style="text-align:center;padding:10px;color:var(--red)">❌</td>
876
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
877
+ </tr>
878
+ <tr style="border-bottom:1px solid rgba(255,255,255,.06)">
879
+ <td style="padding:10px 16px">Node.js native</td>
880
+ <td style="text-align:center;padding:10px;color:var(--emerald)">✅</td>
881
+ <td style="text-align:center;padding:10px">Python</td>
882
+ <td style="text-align:center;padding:10px">Python</td>
883
+ <td style="text-align:center;padding:10px">API</td>
884
+ <td style="text-align:center;padding:10px">Skill</td>
885
+ </tr>
886
+ <tr>
887
+ <td style="padding:10px 16px">Free tier</td>
888
+ <td style="text-align:center;padding:10px;color:var(--emerald)"><strong>Full product</strong></td>
889
+ <td style="text-align:center;padding:10px;color:var(--emerald)">Full</td>
890
+ <td style="text-align:center;padding:10px;color:var(--emerald)">Full</td>
891
+ <td style="text-align:center;padding:10px">Limited</td>
892
+ <td style="text-align:center;padding:10px;color:var(--emerald)">Full</td>
893
+ </tr>
894
+ </tbody>
895
+ </table>
896
+ </div>
897
+ <p style="text-align:center;margin-top:24px;color:var(--gray);font-size:.85rem">ClawMoat works alongside these tools — they protect the model layer, we protect the machine layer.</p>
898
+ </div>
899
+ </section>
900
+
741
901
  <!-- Pricing -->
742
902
  <section id="pricing">
743
903
  <div class="container">
744
904
  <div class="section-label">Pricing</div>
745
- <h2 class="section-title">Protect every agent, any scale</h2>
746
- <p class="section-sub">Open source core is free forever. All paid plans include a <strong>30-day free trial</strong> and <strong>14-day money-back guarantee</strong>.</p>
905
+ <h2 class="section-title">Free to start. Upgrade when the stakes get real.</h2>
906
+ <p class="section-sub">Running agents on your laptop? Free tier has you covered. Managing a fleet for your company? That's when Pro and Team earn their keep. All paid plans include a <strong>30-day free trial</strong> and <strong>14-day money-back guarantee</strong>.</p>
747
907
  <div class="pricing-grid">
748
908
  <div class="price-card">
749
909
  <h3>Free</h3>
750
910
  <div class="price">$0</div>
751
- <div class="desc">Open source — forever free</div>
911
+ <div class="desc">Stop worrying about your agent leaking keys or getting hijacked</div>
752
912
  <ul>
753
913
  <li>Host Guardian (all 4 tiers)</li>
754
914
  <li>20+ forbidden zone patterns</li>
@@ -764,7 +924,7 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
764
924
  <div class="price-card">
765
925
  <h3>Security Kit</h3>
766
926
  <div class="price">$29</div>
767
- <div class="desc">Pay what you want — own it forever</div>
927
+ <div class="desc">Ship agent features without security liability — own it forever</div>
768
928
  <ul>
769
929
  <li>Everything in Free</li>
770
930
  <li>OpenClaw security skill</li>
@@ -773,13 +933,13 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
773
933
  <li>Scan history &amp; audit log</li>
774
934
  <li>1 year of pattern updates</li>
775
935
  </ul>
776
- <a href="https://buy.stripe.com/test_9B65kC5WJ6DMgbI7C35wI00" class="btn btn-primary">Buy — pay what you want</a>
936
+ <a href="#" onclick="checkout('security-kit');return false" class="btn btn-primary">Buy — $29 one-time</a>
777
937
  <p style="font-size:.75rem;color:var(--gray);margin-top:8px;text-align:center">14-day money-back guarantee</p>
778
938
  </div>
779
939
  <div class="price-card popular">
780
940
  <h3>Pro</h3>
781
941
  <div class="price">$14.99<span>/mo</span></div>
782
- <div class="desc">First month free — continuous protection</div>
942
+ <div class="desc">Prove your agents are secure — dashboard, audit logs, and real-time alerts</div>
783
943
  <ul>
784
944
  <li>Everything in Security Kit</li>
785
945
  <li>Threat intelligence feed</li>
@@ -799,7 +959,7 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
799
959
  <div class="price-card">
800
960
  <h3>Team</h3>
801
961
  <div class="price">$49<span>/mo</span></div>
802
- <div class="desc">First month free — multi-agent security</div>
962
+ <div class="desc">Pass SOC2 with AI agents in production — compliance reports, fleet control, centralized policy</div>
803
963
  <ul>
804
964
  <li>Everything in Pro</li>
805
965
  <li>Fleet dashboard (all machines)</li>
@@ -888,10 +1048,14 @@ footer{border-top:1px solid rgba(255,255,255,.06);padding:48px 0 32px;color:var(
888
1048
  </div>
889
1049
  <div>
890
1050
  <h4>Company</h4>
891
- <a href="mailto:hello@clawmoat.com">Contact</a>
892
- <a href="#">Blog</a>
893
- <a href="#">Twitter</a>
894
- <a href="#">Privacy</a>
1051
+ <a href="mailto:hello@clawmoat.com">hello@clawmoat.com</a>
1052
+ <a href="tel:+16503838190">(650) 383-8190</a>
1053
+ <p style="color:var(--gray);font-size:.8rem;margin-top:4px">10000 Washington Blvd<br>Culver City, CA 90232</p>
1054
+ <a href="/blog/">Blog</a>
1055
+ <a href="/business/">For Business</a>
1056
+ <a href="/support/">Support</a>
1057
+ <a href="/terms-of-service/">Terms of Service</a>
1058
+ <a href="/privacy-policy/">Privacy Policy</a>
895
1059
  </div>
896
1060
  </div>
897
1061
  <div class="footer-bottom">