clawmoat 0.7.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (178) hide show
  1. package/.dockerignore +9 -0
  2. package/CHANGELOG.md +18 -0
  3. package/CONTRIBUTING.md +4 -2
  4. package/DEMO.md +87 -0
  5. package/Dockerfile +5 -18
  6. package/README.md +294 -8
  7. package/SECURITY.md +58 -10
  8. package/THREAT_MODEL.md +129 -0
  9. package/agent/README.md +131 -0
  10. package/agent/index.js +471 -0
  11. package/agent/install-service.sh +94 -0
  12. package/agent/openclaw-hook.js +453 -0
  13. package/agent/provider-setup.js +649 -0
  14. package/agent/setup.js +274 -0
  15. package/assets/BADGE-USAGE.md +20 -0
  16. package/assets/clawmoat-badge.svg +21 -0
  17. package/bin/clawmoat.js +468 -111
  18. package/docs/affiliates/dashboard.html +124 -0
  19. package/docs/affiliates/index.html +236 -0
  20. package/docs/agent-install.html +183 -0
  21. package/docs/ai-agent-security-scanner.html +10 -6
  22. package/docs/badge/index.html +149 -0
  23. package/docs/badge/scanning.svg +23 -0
  24. package/docs/blog/386-malicious-skills.html +262 -0
  25. package/docs/blog/40000-exposed-openclaw-instances.html +201 -0
  26. package/docs/blog/agent-trust-protocol.html +198 -0
  27. package/docs/blog/ai-agent-earns-commissions.html +230 -0
  28. package/docs/blog/bugmageddon-agent-firewall.html +174 -0
  29. package/docs/blog/calculator-math.html +180 -0
  30. package/docs/blog/clawmoat-vs-llamafirewall-nemo-guardrails.html +229 -0
  31. package/docs/blog/host-guardian-launch.html +18 -8
  32. package/docs/blog/ibm-experts-agent-runtime-protection.html +247 -0
  33. package/docs/blog/index.html +211 -9
  34. package/docs/blog/langchain-security-tutorial.html +18 -8
  35. package/docs/blog/mcp-30-cves-security-crisis.html +286 -0
  36. package/docs/blog/meta-researcher-rogue-agent.html +201 -0
  37. package/docs/blog/microsoft-openclaw-workstation-security.html +235 -0
  38. package/docs/blog/nist-ai-agent-standards-clawmoat.html +377 -0
  39. package/docs/blog/oasis-websocket-hijack.html +212 -0
  40. package/docs/blog/ollama-openclaw-security.html +160 -0
  41. package/docs/blog/openclaw-enterprise-readiness-claw10.html +199 -0
  42. package/docs/blog/openclaw-security-reckoning-2026.html +368 -0
  43. package/docs/blog/owasp-agentic-ai-top10.html +18 -8
  44. package/docs/blog/securing-ai-agents.html +18 -8
  45. package/docs/blog/supply-chain-agents.html +18 -8
  46. package/docs/business/index.html +525 -0
  47. package/docs/business/install.html +261 -0
  48. package/docs/checklist.html +174 -0
  49. package/docs/compare/index.html +122 -0
  50. package/docs/compare/lakera/index.html +62 -0
  51. package/docs/compare/llm-guard/index.html +49 -0
  52. package/docs/compare/snyk-agent-scan/index.html +63 -0
  53. package/docs/compare.html +10 -6
  54. package/docs/dashboard/index.html +520 -0
  55. package/docs/finance/index.html +220 -0
  56. package/docs/guides/business-deployment.html +770 -0
  57. package/docs/hall-of-fame.html +174 -0
  58. package/docs/index.html +447 -154
  59. package/docs/install.sh +557 -0
  60. package/docs/integrations/langchain.html +14 -6
  61. package/docs/integrations/openai.html +14 -6
  62. package/docs/integrations/openclaw.html +55 -7
  63. package/docs/plans/2026-03-26-threat-intel-api.md +255 -0
  64. package/docs/plans/2026-04-14-bugmageddon-marketing-pack.md +329 -0
  65. package/docs/plans/2026-04-14-clawmoat-v1-bugmageddon.md +248 -0
  66. package/docs/plans/2026-04-14-v1-release-update.md +91 -0
  67. package/docs/plans/2026-04-19-supabase-audit.md +68 -0
  68. package/docs/plans/2026-05-12-sales-push.md +303 -0
  69. package/docs/playground/index.html +893 -0
  70. package/docs/playground.html +4 -7
  71. package/docs/privacy-policy/index.html +122 -0
  72. package/docs/rfcs/defense-in-depth.md +467 -0
  73. package/docs/scan/index.html +358 -0
  74. package/docs/services/case-study.html +255 -0
  75. package/docs/services/downloads/install-openclaw.bat +45 -0
  76. package/docs/services/downloads/install-openclaw.command +38 -0
  77. package/docs/services/downloads/install-openclaw.sh +38 -0
  78. package/docs/services/get-started.html +165 -0
  79. package/docs/services/index.html +598 -0
  80. package/docs/services/multi-agent-security.html +284 -0
  81. package/docs/services/one-pager.html +99 -0
  82. package/docs/services/pitch-deck.html +229 -0
  83. package/docs/services/roi-calculator.html +258 -0
  84. package/docs/sitemap.xml +192 -2
  85. package/docs/support/index.html +135 -0
  86. package/docs/templates/customer-service/HEARTBEAT.md +61 -0
  87. package/docs/templates/customer-service/MEMORY.md +89 -0
  88. package/docs/templates/customer-service/SOUL.md +41 -0
  89. package/docs/templates/customer-service/USER.md +56 -0
  90. package/docs/templates/executive/HEARTBEAT.md +86 -0
  91. package/docs/templates/executive/MEMORY.md +92 -0
  92. package/docs/templates/executive/SOUL.md +44 -0
  93. package/docs/templates/executive/USER.md +62 -0
  94. package/docs/templates/finance/HEARTBEAT.md +58 -0
  95. package/docs/templates/finance/MEMORY.md +87 -0
  96. package/docs/templates/finance/SOUL.md +38 -0
  97. package/docs/templates/finance/USER.md +53 -0
  98. package/docs/templates/index.html +115 -0
  99. package/docs/templates/operations/HEARTBEAT.md +63 -0
  100. package/docs/templates/operations/MEMORY.md +68 -0
  101. package/docs/templates/operations/SOUL.md +38 -0
  102. package/docs/templates/operations/USER.md +49 -0
  103. package/docs/templates/sales/HEARTBEAT.md +55 -0
  104. package/docs/templates/sales/MEMORY.md +89 -0
  105. package/docs/templates/sales/SOUL.md +34 -0
  106. package/docs/templates/sales/USER.md +54 -0
  107. package/docs/terms-of-service/index.html +122 -0
  108. package/eslint.config.js +32 -0
  109. package/evals/README.md +29 -0
  110. package/evals/cases.json +390 -0
  111. package/evals/results.md +68 -0
  112. package/evals/run.js +180 -0
  113. package/examples/basic-usage.js +38 -0
  114. package/examples/demo-attack/demo.js +186 -0
  115. package/examples/python-quickstart/README.md +54 -0
  116. package/examples/python-quickstart/clawmoat_client.py +167 -0
  117. package/examples/video-demo/README.md +14 -0
  118. package/examples/video-demo/scene-a-normal.js +29 -0
  119. package/examples/video-demo/scene-b-attack-arrives.js +31 -0
  120. package/examples/video-demo/scene-c-hijack.js +44 -0
  121. package/examples/video-demo/scene-d-clawmoat.js +46 -0
  122. package/integrations/crewai/README.md +32 -0
  123. package/integrations/crewai/clawmoat_crewai/__init__.py +17 -0
  124. package/integrations/crewai/clawmoat_crewai/guard.py +103 -0
  125. package/integrations/crewai/pyproject.toml +21 -0
  126. package/integrations/langchain/README.md +91 -0
  127. package/integrations/langchain/clawmoat_langchain/__init__.py +17 -0
  128. package/integrations/langchain/clawmoat_langchain/callback.py +489 -0
  129. package/integrations/langchain/pyproject.toml +32 -0
  130. package/integrations/litellm/README.md +324 -0
  131. package/integrations/litellm/clawmoat_litellm/__init__.py +21 -0
  132. package/integrations/litellm/clawmoat_litellm/callback.py +329 -0
  133. package/integrations/litellm/clawmoat_litellm/proxy_middleware.py +224 -0
  134. package/integrations/litellm/pyproject.toml +74 -0
  135. package/integrations/openai-agents/README.md +392 -0
  136. package/integrations/openai-agents/clawmoat_openai_agents/__init__.py +20 -0
  137. package/integrations/openai-agents/clawmoat_openai_agents/guardrail.py +431 -0
  138. package/integrations/openai-agents/clawmoat_openai_agents/middleware.py +311 -0
  139. package/integrations/openai-agents/pyproject.toml +76 -0
  140. package/package.json +6 -5
  141. package/plugins/openclaw-adapter/PHASE1.md +439 -0
  142. package/plugins/openclaw-adapter/README.md +103 -0
  143. package/plugins/openclaw-adapter/SPEC.md +1644 -0
  144. package/plugins/openclaw-adapter/package.json +31 -0
  145. package/plugins/openclaw-adapter/src/index.test.ts +226 -0
  146. package/plugins/openclaw-adapter/src/index.ts +140 -0
  147. package/plugins/openclaw-adapter/tsconfig.json +14 -0
  148. package/server/data/threats.json +290 -0
  149. package/server/index.js +224 -10
  150. package/src/adapters/express.js +161 -0
  151. package/src/adapters/index.js +92 -0
  152. package/src/adapters/langchain.js +185 -0
  153. package/src/approval/index.js +456 -0
  154. package/src/ban-scanner.js +200 -0
  155. package/src/boundary-scanner.js +296 -0
  156. package/src/ci-scanner.js +279 -0
  157. package/src/code-scanner.js +245 -0
  158. package/src/enforce.js +166 -0
  159. package/src/finance/index.js +585 -0
  160. package/src/finance/mcp-firewall.js +486 -0
  161. package/src/formatters/json.js +80 -0
  162. package/src/formatters/sarif.js +388 -0
  163. package/src/guardian/alerts.js +34 -3
  164. package/src/guardian/gateway-monitor.js +590 -0
  165. package/src/guardian/index.js +41 -2
  166. package/src/index.js +105 -0
  167. package/src/integrations/agentmesh.js +501 -0
  168. package/src/language-detector.js +201 -0
  169. package/src/mcp-scanner.js +253 -0
  170. package/src/multimodal/index.js +579 -0
  171. package/src/obfuscation-scanner.js +457 -0
  172. package/src/policy-engine.js +402 -0
  173. package/src/scanners/dependency-attacks.js +128 -0
  174. package/src/scanners/prompt-injection.js +18 -0
  175. package/src/scanners/supply-chain.js +14 -0
  176. package/src/templates/default-config.yml +90 -0
  177. package/src/vuln-ops/exploitability.js +46 -0
  178. package/src/watch/live-monitor.js +720 -0
package/docs/business/install.html ADDED
@@ -0,0 +1,261 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Install ClawMoat — One Command, Enterprise-Grade Agent Security</title>
7
+ <meta name="description" content="Install ClawMoat in 60 seconds. One command sets up permission tiers, credential protection, audit trails, and secret scanning for your AI agents.">
8
+ <link rel="canonical" href="https://clawmoat.com/business/install.html">
9
+ <link rel="icon" type="image/png" href="/favicon.png">
10
+ <link rel="apple-touch-icon" href="/apple-touch-icon.png">
11
+
12
+ <meta property="og:title" content="One Command. Enterprise-Grade Agent Security.">
13
+ <meta property="og:description" content="Install ClawMoat in 60 seconds — permission tiers, credential protection, audit trails for AI agents.">
14
+ <meta property="og:image" content="https://clawmoat.com/og-image.png">
15
+ <meta property="og:url" content="https://clawmoat.com/business/install.html">
16
+ <meta property="og:type" content="website">
17
+
18
+ <style>
19
+ *{margin:0;padding:0;box-sizing:border-box}
20
+ :root{--navy:#0F172A;--navy-light:#1E293B;--navy-mid:#334155;--blue:#3B82F6;--emerald:#10B981;--white:#F8FAFC;--gray:#94A3B8;--red:#EF4444;--amber:#F59E0B;--cyan:#06B6D4}
21
+ html{scroll-behavior:smooth}
22
+ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:var(--navy);color:var(--white);line-height:1.7}
23
+ a{color:var(--blue);text-decoration:none}
24
+ a:hover{text-decoration:underline}
25
+
26
+ /* Nav */
27
+ .nav{padding:1rem 2rem;display:flex;align-items:center;gap:1rem;border-bottom:1px solid rgba(255,255,255,.06)}
28
+ .nav-logo{font-size:1.3rem;font-weight:700;color:var(--white)}
29
+ .nav a{color:var(--gray);font-size:.9rem}
30
+ .nav a:hover{color:var(--white)}
31
+
32
+ /* Hero */
33
+ .hero{text-align:center;padding:5rem 2rem 4rem;max-width:800px;margin:0 auto}
34
+ .hero h1{font-size:clamp(2rem,5vw,3.2rem);line-height:1.2;margin-bottom:1rem}
35
+ .hero h1 span{color:var(--emerald)}
36
+ .hero p{color:var(--gray);font-size:1.15rem;margin-bottom:2.5rem;max-width:600px;margin-left:auto;margin-right:auto}
37
+
38
+ /* Install box */
39
+ .install-box{background:var(--navy-light);border:1px solid var(--navy-mid);border-radius:12px;padding:2rem;max-width:700px;margin:0 auto 1.5rem;position:relative}
40
+ .install-box code{font-family:'SF Mono',Monaco,'Cascadia Code',monospace;font-size:1.1rem;color:var(--emerald);display:block;padding:.8rem;background:rgba(0,0,0,.3);border-radius:8px;cursor:pointer;transition:background .2s}
41
+ .install-box code:hover{background:rgba(0,0,0,.5)}
42
+ .install-box .label{color:var(--gray);font-size:.85rem;margin-bottom:.5rem}
43
+ .install-box .enterprise{margin-top:1rem;padding-top:1rem;border-top:1px solid var(--navy-mid)}
44
+ .install-box .enterprise code{color:var(--amber);font-size:.95rem}
45
+ .copy-hint{color:var(--gray);font-size:.8rem;text-align:center;margin-bottom:3rem}
46
+ .copied{color:var(--emerald) !important}
47
+
48
+ /* Sections */
49
+ .section{max-width:900px;margin:0 auto;padding:3rem 2rem}
50
+ .section h2{font-size:1.8rem;margin-bottom:1.5rem;text-align:center}
51
+ .section h2 span{color:var(--emerald)}
52
+
53
+ /* Steps */
54
+ .steps{display:grid;gap:1.5rem}
55
+ .step{display:flex;gap:1.2rem;align-items:flex-start;background:var(--navy-light);padding:1.5rem;border-radius:10px;border:1px solid var(--navy-mid)}
56
+ .step-num{background:var(--emerald);color:var(--navy);font-weight:700;width:36px;height:36px;border-radius:50%;display:flex;align-items:center;justify-content:center;flex-shrink:0;font-size:.9rem}
57
+ .step h3{font-size:1.05rem;margin-bottom:.3rem}
58
+ .step p{color:var(--gray);font-size:.9rem}
59
+
60
+ /* Comparison table */
61
+ .compare{display:grid;grid-template-columns:1fr 1fr;gap:2rem;margin-top:1.5rem}
62
+ @media(max-width:600px){.compare{grid-template-columns:1fr}}
63
+ .compare-col{background:var(--navy-light);border-radius:10px;padding:1.5rem;border:1px solid var(--navy-mid)}
64
+ .compare-col.bad{border-color:rgba(239,68,68,.3)}
65
+ .compare-col.good{border-color:rgba(16,185,129,.3)}
66
+ .compare-col h3{font-size:1.1rem;margin-bottom:1rem;display:flex;align-items:center;gap:.5rem}
67
+ .compare-col ul{list-style:none;display:flex;flex-direction:column;gap:.6rem}
68
+ .compare-col.bad li::before{content:'❌ '}
69
+ .compare-col.good li::before{content:'✅ '}
70
+ .compare-col li{color:var(--gray);font-size:.9rem}
71
+
72
+ /* FAQ */
73
+ .faq{display:grid;gap:1rem;margin-top:1.5rem}
74
+ .faq-item{background:var(--navy-light);border-radius:10px;padding:1.5rem;border:1px solid var(--navy-mid)}
75
+ .faq-item h3{font-size:1rem;margin-bottom:.5rem;color:var(--white)}
76
+ .faq-item p{color:var(--gray);font-size:.9rem}
77
+
78
+ /* CTA */
79
+ .cta{text-align:center;padding:4rem 2rem;border-top:1px solid var(--navy-mid)}
80
+ .cta h2{font-size:1.8rem;margin-bottom:1rem}
81
+ .cta p{color:var(--gray);margin-bottom:2rem}
82
+ .cta-buttons{display:flex;gap:1rem;justify-content:center;flex-wrap:wrap}
83
+ .btn{display:inline-flex;align-items:center;gap:.5rem;padding:.8rem 1.5rem;border-radius:8px;font-weight:600;font-size:.95rem;transition:transform .2s,opacity .2s}
84
+ .btn:hover{transform:translateY(-1px);text-decoration:none;opacity:.9}
85
+ .btn-primary{background:var(--emerald);color:var(--navy)}
86
+ .btn-secondary{background:var(--navy-light);color:var(--white);border:1px solid var(--navy-mid)}
87
+
88
+ /* Footer */
89
+ .footer{text-align:center;padding:2rem;color:var(--gray);font-size:.85rem;border-top:1px solid rgba(255,255,255,.06)}
90
+ </style>
91
+ </head>
92
+ <body>
93
+
94
+ <nav>
95
+ <div class="container">
96
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
97
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
98
+ <div class="nav-links">
99
+ <a href="/">Security</a>
100
+ <a href="/services/">AI Agents</a>
101
+ <a href="/blog/">Blog</a>
102
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
103
+ </div>
104
+ </div>
105
+ </nav>
106
+
107
+ <!-- Hero -->
108
+ <section class="hero">
109
+ <h1>One Command.<br><span>Enterprise-Grade Agent Security.</span></h1>
110
+ <p>Install ClawMoat in 60 seconds. Hardened config, credential protection, audit trails — all running locally on your machine.</p>
111
+
112
+ <div class="install-box">
113
+ <div class="label">Run this in your terminal:</div>
114
+ <code onclick="copyCmd(this, 'curl -fsSL https://clawmoat.com/install.sh | bash')">curl -fsSL https://clawmoat.com/install.sh | bash</code>
115
+ <div class="enterprise">
116
+ <div class="label">Enterprise (adds FinanceGuard, MCP Firewall, SOX templates):</div>
117
+ <code onclick="copyCmd(this, 'curl -fsSL https://clawmoat.com/install.sh | bash -s -- --enterprise')">curl -fsSL https://clawmoat.com/install.sh | bash -s -- --enterprise</code>
118
+ </div>
119
+ </div>
120
+ <div class="copy-hint">Click to copy • Works on Linux, macOS, and WSL</div>
121
+ </section>
122
+
123
+ <!-- What it does -->
124
+ <section class="section">
125
+ <h2>What <span>It Does</span></h2>
126
+ <div class="steps">
127
+ <div class="step">
128
+ <div class="step-num">1</div>
129
+ <div>
130
+ <h3>Detects Your OS</h3>
131
+ <p>Identifies Linux, macOS, or WSL and adapts accordingly. No sudo required.</p>
132
+ </div>
133
+ </div>
134
+ <div class="step">
135
+ <div class="step-num">2</div>
136
+ <div>
137
+ <h3>Checks Node.js</h3>
138
+ <p>Verifies Node.js v18+ is installed. Offers to install via nvm if missing — no system packages modified.</p>
139
+ </div>
140
+ </div>
141
+ <div class="step">
142
+ <div class="step-num">3</div>
143
+ <div>
144
+ <h3>Installs ClawMoat</h3>
145
+ <p><code style="background:none;padding:0;color:var(--cyan);font-size:.85rem">npm install -g clawmoat</code> — the open-source AI agent security toolkit.</p>
146
+ </div>
147
+ </div>
148
+ <div class="step">
149
+ <div class="step-num">4</div>
150
+ <div>
151
+ <h3>Generates Hardened Config</h3>
152
+ <p>Creates <code style="background:none;padding:0;color:var(--cyan);font-size:.85rem">~/.clawmoat/config.json</code> with worker-tier permissions, 17+ forbidden credential zones, secret scanning, network logging, and full audit trails.</p>
153
+ </div>
154
+ </div>
155
+ <div class="step">
156
+ <div class="step-num">5</div>
157
+ <div>
158
+ <h3>Runs Security Scan</h3>
159
+ <p>Scans your machine for exposed credentials, insecure permissions, and .env files. Generates a report showing what it found and what's now protected.</p>
160
+ </div>
161
+ </div>
162
+ <div class="step">
163
+ <div class="step-num">6</div>
164
+ <div>
165
+ <h3>Prints Next Steps</h3>
166
+ <p>Configure alert webhooks, run your first scan, connect to your team dashboard.</p>
167
+ </div>
168
+ </div>
169
+ </div>
170
+ </section>
171
+
172
+ <!-- Comparison -->
173
+ <section class="section">
174
+ <h2>Without vs. <span>With ClawMoat</span></h2>
175
+ <div class="compare">
176
+ <div class="compare-col bad">
177
+ <h3>🚫 Without ClawMoat</h3>
178
+ <ul>
179
+ <li>Agents can read ~/.ssh, ~/.aws, any credential file</li>
180
+ <li>No record of what agents accessed or modified</li>
181
+ <li>Secrets leak silently in agent output</li>
182
+ <li>Network requests go unmonitored</li>
183
+ <li>No compliance evidence for auditors</li>
184
+ <li>One compromised agent = full system access</li>
185
+ </ul>
186
+ </div>
187
+ <div class="compare-col good">
188
+ <h3>🏰 With ClawMoat</h3>
189
+ <ul>
190
+ <li>17+ credential zones blocked by default</li>
191
+ <li>Tamper-protected audit trail of every action</li>
192
+ <li>Real-time secret detection with alerts</li>
193
+ <li>Full network egress logging</li>
194
+ <li>SOX-ready compliance templates (Enterprise)</li>
195
+ <li>Least-privilege tiers contain blast radius</li>
196
+ </ul>
197
+ </div>
198
+ </div>
199
+ </section>
200
+
201
+ <!-- FAQ -->
202
+ <section class="section">
203
+ <h2>Frequently Asked <span>Questions</span></h2>
204
+ <div class="faq">
205
+ <div class="faq-item">
206
+ <h3>🔒 Is it safe to run?</h3>
207
+ <p>Yes. The script runs entirely locally — no data is sent anywhere. It installs an npm package, creates a config file in ~/.clawmoat/, and scans for existing credential exposure. No files are modified or deleted. The script is open-source and auditable on <a href="https://github.com/ClawMoat/clawmoat">GitHub</a>.</p>
208
+ </div>
209
+ <div class="faq-item">
210
+ <h3>📁 What does it change on my system?</h3>
211
+ <p>It installs the <code>clawmoat</code> npm package globally, creates the <code>~/.clawmoat/</code> directory with a config and audit logs, and optionally installs nvm if Node.js is missing. No system files are modified. No sudo required.</p>
212
+ </div>
213
+ <div class="faq-item">
214
+ <h3>🔄 Can I run it multiple times?</h3>
215
+ <p>Yes, the script is idempotent. Running it again updates ClawMoat and backs up your existing config before generating a new one.</p>
216
+ </div>
217
+ <div class="faq-item">
218
+ <h3>🗑️ Can I uninstall?</h3>
219
+ <p>Completely. Run <code>npm uninstall -g clawmoat</code> and <code>rm -rf ~/.clawmoat</code>. That's it — nothing else to clean up.</p>
220
+ </div>
221
+ <div class="faq-item">
222
+ <h3>💼 What does --enterprise add?</h3>
223
+ <p>FinanceGuard for monitoring high-value operations, MCP Firewall in read-only mode for tool-call governance, and SOX compliance audit templates with controls mapping.</p>
224
+ </div>
225
+ </div>
226
+ </section>
227
+
228
+ <!-- CTA -->
229
+ <section class="cta">
230
+ <h2>Secure Your AI Agents Today</h2>
231
+ <p>Open-source core. Enterprise features for teams that need compliance.</p>
232
+ <div class="cta-buttons">
233
+ <a href="https://github.com/ClawMoat/clawmoat" class="btn btn-secondary">⭐ Star on GitHub</a>
234
+ <a href="/business/" class="btn btn-primary">Get ClawMoat Pro →</a>
235
+ </div>
236
+ </section>
237
+
238
+ <footer>
239
+ <div class="container">
240
+ <div style="display:flex;gap:24px;justify-content:center;flex-wrap:wrap;margin-bottom:16px">
241
+ <a href="https://github.com/darfaz/clawmoat" style="color:var(--gray)">GitHub</a>
242
+ <a href="https://www.npmjs.com/package/clawmoat" style="color:var(--gray)">npm</a>
243
+ <a href="/blog/" style="color:var(--gray)">Blog</a>
244
+ <a href="mailto:hello@clawmoat.com" style="color:var(--gray)">hello@clawmoat.com</a>
245
+ </div>
246
+ <p style="text-align:center;color:var(--gray);font-size:.85rem">© 2026 ClawMoat</p>
247
+ </div>
248
+ </footer>
249
+
250
+ <script>
251
+ function copyCmd(el, text) {
252
+ navigator.clipboard.writeText(text).then(() => {
253
+ const orig = el.textContent;
254
+ el.textContent = '✅ Copied!';
255
+ el.classList.add('copied');
256
+ setTimeout(() => { el.textContent = orig; el.classList.remove('copied'); }, 1500);
257
+ });
258
+ }
259
+ </script>
260
+ </body>
261
+ </html>
package/docs/checklist.html ADDED
@@ -0,0 +1,174 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>AI Agent Security Checklist (2026) — ClawMoat</title>
7
+ <meta name="description" content="Free security checklist for AI agent operators. 20 actionable steps to protect your machine, credentials, and data from autonomous AI agents.">
8
+ <meta property="og:title" content="AI Agent Security Checklist (2026)">
9
+ <meta property="og:description" content="20 actionable security steps for AI agent operators. Free, open-source.">
10
+ <link rel="canonical" href="https://clawmoat.com/checklist">
11
+ <style>
12
+ *{margin:0;padding:0;box-sizing:border-box}
13
+ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:#0F172A;color:#F8FAFC;line-height:1.8}
14
+ a{color:#3B82F6}
15
+ .container{max-width:760px;margin:0 auto;padding:40px 24px}
16
+ nav{background:rgba(15,23,42,.95);padding:16px 24px;position:fixed;top:0;left:0;right:0;z-index:100;border-bottom:1px solid rgba(59,130,246,.15)}
17
+ nav a{color:#94A3B8;text-decoration:none;margin-right:24px;font-size:.9rem}
18
+ nav a:first-child{color:#F8FAFC;font-weight:700;font-size:1.1rem}
19
+ h1{font-size:2.2rem;font-weight:800;line-height:1.2;margin-bottom:8px;padding-top:80px}
20
+ h2{font-size:1.4rem;font-weight:700;margin:40px 0 16px;color:#10B981}
21
+ p{margin-bottom:16px;color:#CBD5E1}
22
+ .subtitle{color:#94A3B8;font-size:1.1rem;margin-bottom:40px}
23
+ .check-group{background:#1E293B;border:1px solid rgba(255,255,255,.06);border-radius:12px;padding:24px;margin:16px 0}
24
+ .check-item{display:flex;gap:12px;padding:10px 0;border-bottom:1px solid rgba(255,255,255,.04)}
25
+ .check-item:last-child{border-bottom:none}
26
+ .check-box{width:24px;height:24px;border:2px solid #334155;border-radius:6px;flex-shrink:0;margin-top:2px;cursor:pointer}
27
+ .check-item strong{color:#F8FAFC}
28
+ .check-item p{color:#94A3B8;font-size:.9rem;margin:4px 0 0}
29
+ .priority-high{border-left:3px solid #EF4444;padding-left:12px}
30
+ .priority-med{border-left:3px solid #F59E0B;padding-left:12px}
31
+ .priority-low{border-left:3px solid #10B981;padding-left:12px}
32
+ code{background:#0a0e17;padding:2px 8px;border-radius:4px;font-size:.85rem}
33
+ .cta{background:#1E293B;border:1px solid rgba(59,130,246,.3);border-radius:14px;padding:32px;text-align:center;margin:48px 0}
34
+ .btn{display:inline-block;padding:12px 28px;background:#3B82F6;color:#fff;border-radius:8px;text-decoration:none;font-weight:600;margin:8px}
35
+ .legend{display:flex;gap:24px;margin:24px 0;font-size:.85rem;color:#94A3B8}
36
+ .legend span{display:flex;align-items:center;gap:6px}
37
+ .dot{width:12px;height:12px;border-radius:3px;display:inline-block}
38
+ .dot-high{background:#EF4444}
39
+ .dot-med{background:#F59E0B}
40
+ .dot-low{background:#10B981}
41
+ </style>
42
+ </head>
43
+ <body>
44
+ <nav>
45
+ <div class="container">
46
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
47
+ <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
48
+ <div class="nav-links">
49
+ <a href="/">Security</a>
50
+ <a href="/services/">AI Agents</a>
51
+ <a href="/blog/">Blog</a>
52
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
53
+ </div>
54
+ </div>
55
+ </nav>
56
+ <div class="container">
57
+ <h1>AI Agent Security Checklist</h1>
58
+ <p class="subtitle">20 actionable steps to protect your machine from autonomous AI agents. Updated February 2026.</p>
59
+
60
+ <div class="legend">
61
+ <span><span class="dot dot-high"></span> Critical</span>
62
+ <span><span class="dot dot-med"></span> Important</span>
63
+ <span><span class="dot dot-low"></span> Recommended</span>
64
+ </div>
65
+
66
+ <h2>🔐 Credential Protection</h2>
67
+ <div class="check-group">
68
+ <div class="check-item priority-high">
69
+ <div class="check-box"></div>
70
+ <div><strong>Move SSH keys out of agent's reach</strong><p>Use a separate user account or forbidden zone to protect <code>~/.ssh/</code></p></div>
71
+ </div>
72
+ <div class="check-item priority-high">
73
+ <div class="check-box"></div>
74
+ <div><strong>Protect cloud credentials</strong><p>Lock down <code>~/.aws/</code>, <code>~/.gcloud/</code>, <code>~/.azure/</code>, <code>~/.kube/</code></p></div>
75
+ </div>
76
+ <div class="check-item priority-high">
77
+ <div class="check-box"></div>
78
+ <div><strong>Secure browser data</strong><p>Prevent access to browser profile directories (cookies, saved passwords, sessions)</p></div>
79
+ </div>
80
+ <div class="check-item priority-med">
81
+ <div class="check-box"></div>
82
+ <div><strong>Protect GPG/PGP keys</strong><p>Lock down <code>~/.gnupg/</code></p></div>
83
+ </div>
84
+ <div class="check-item priority-med">
85
+ <div class="check-box"></div>
86
+ <div><strong>Protect crypto wallets</strong><p>Lock down wallet files, seed phrases, and key stores</p></div>
87
+ </div>
88
+ </div>
89
+
90
+ <h2>🛡️ Permission Controls</h2>
91
+ <div class="check-group">
92
+ <div class="check-item priority-high">
93
+ <div class="check-box"></div>
94
+ <div><strong>Set a permission tier</strong><p>Start with <code>observer</code> or <code>worker</code> and escalate only as needed</p></div>
95
+ </div>
96
+ <div class="check-item priority-high">
97
+ <div class="check-box"></div>
98
+ <div><strong>Block dangerous shell commands</strong><p>Prevent <code>rm -rf</code>, <code>chmod 777</code>, <code>curl | bash</code>, <code>dd</code></p></div>
99
+ </div>
100
+ <div class="check-item priority-med">
101
+ <div class="check-box"></div>
102
+ <div><strong>Restrict network access</strong><p>Use domain allow/blocklists to control where the agent can connect</p></div>
103
+ </div>
104
+ <div class="check-item priority-med">
105
+ <div class="check-box"></div>
106
+ <div><strong>Limit file system scope</strong><p>Restrict the agent to a workspace directory; block access to system files</p></div>
107
+ </div>
108
+ </div>
109
+
110
+ <h2>🔍 Monitoring & Auditing</h2>
111
+ <div class="check-group">
112
+ <div class="check-item priority-high">
113
+ <div class="check-box"></div>
114
+ <div><strong>Enable audit logging</strong><p>Log every tool call, file access, and shell command</p></div>
115
+ </div>
116
+ <div class="check-item priority-med">
117
+ <div class="check-box"></div>
118
+ <div><strong>Monitor credential directories</strong><p>Set up alerts for any access attempts to sensitive directories</p></div>
119
+ </div>
120
+ <div class="check-item priority-med">
121
+ <div class="check-box"></div>
122
+ <div><strong>Log network egress</strong><p>Track all outbound URLs and connections</p></div>
123
+ </div>
124
+ <div class="check-item priority-low">
125
+ <div class="check-box"></div>
126
+ <div><strong>Set up webhook alerts</strong><p>Send security events to Slack, Discord, Telegram, or email</p></div>
127
+ </div>
128
+ </div>
129
+
130
+ <h2>📦 Supply Chain</h2>
131
+ <div class="check-group">
132
+ <div class="check-item priority-high">
133
+ <div class="check-box"></div>
134
+ <div><strong>Audit installed skills/plugins</strong><p>Run integrity checks on all installed agent skills. 13.4% of ClawHub skills have critical issues (Snyk).</p></div>
135
+ </div>
136
+ <div class="check-item priority-med">
137
+ <div class="check-box"></div>
138
+ <div><strong>Verify skill hashes after updates</strong><p>Re-check integrity after any skill update or installation</p></div>
139
+ </div>
140
+ <div class="check-item priority-med">
141
+ <div class="check-box"></div>
142
+ <div><strong>Scan for suspicious patterns</strong><p>Look for base64-encoded URLs, credential access patterns, obfuscated code</p></div>
143
+ </div>
144
+ </div>
145
+
146
+ <h2>💬 Input/Output Security</h2>
147
+ <div class="check-group">
148
+ <div class="check-item priority-high">
149
+ <div class="check-box"></div>
150
+ <div><strong>Scan inbound content for prompt injection</strong><p>Emails, web pages, and documents can contain hidden instructions</p></div>
151
+ </div>
152
+ <div class="check-item priority-med">
153
+ <div class="check-box"></div>
154
+ <div><strong>Scan outbound content for secrets</strong><p>Catch API keys, tokens, and credentials before they leave the machine</p></div>
155
+ </div>
156
+ <div class="check-item priority-low">
157
+ <div class="check-box"></div>
158
+ <div><strong>Scan inter-agent messages</strong><p>If running multi-agent systems, scan messages between agents for attack patterns</p></div>
159
+ </div>
160
+ </div>
161
+
162
+ <div class="cta">
163
+ <h3 style="color:#F8FAFC;margin-bottom:8px">Automate this checklist</h3>
164
+ <p style="color:#94A3B8;margin-bottom:16px">ClawMoat implements all 20 checks. Zero dependencies. MIT licensed.</p>
165
+ <code style="font-size:1rem;background:#0a0e17;padding:8px 16px">npm install -g clawmoat</code>
166
+ <br><br>
167
+ <a href="https://github.com/darfaz/clawmoat" class="btn">⭐ Star on GitHub</a>
168
+ <a href="/#pricing" class="btn" style="background:#10B981">See Plans</a>
169
+ </div>
170
+
171
+ <p style="font-size:.85rem;color:#64748B;margin-top:40px">Based on OWASP Top 10 for Agentic AI (2026), Cisco AI Defense research, SecurityScorecard STRIKE findings, and Snyk ClawHub analysis.</p>
172
+ </div>
173
+ </body>
174
+ </html>
package/docs/compare/index.html ADDED
@@ -0,0 +1,122 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>ClawMoat vs Competitors — AI Agent Security Comparison</title>
7
+ <meta name="description" content="Compare ClawMoat to Lakera, LLM Guard, Snyk agent-scan, and other AI agent security tools. Feature, pricing, and architecture comparison.">
8
+ <style>
9
+ :root{--bg:#0a0a0f;--fg:#e0e0e8;--accent:#00d4aa;--muted:#888;--card:#14141f;--blue:#3B82F6;--red:#ff4444}
10
+ *{margin:0;padding:0;box-sizing:border-box}
11
+ body{background:var(--bg);color:var(--fg);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;line-height:1.7}
12
+ .container{max-width:900px;margin:0 auto;padding:2rem 1.5rem}
13
+ nav{padding:1rem 0;border-bottom:1px solid #2a2a3a;margin-bottom:2rem;display:flex;justify-content:space-between;align-items:center}
14
+ nav a{color:var(--fg);text-decoration:none;margin-right:1.5rem}
15
+ nav a:hover{color:var(--accent)}
16
+ .logo span{color:var(--accent)}
17
+ h1{font-size:2.5rem;margin-bottom:1rem;letter-spacing:-.02em}
18
+ h2{color:var(--accent);margin:2rem 0 1rem;font-size:1.4rem}
19
+ p{color:var(--muted);margin-bottom:1rem}
20
+ .compare-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(250px,1fr));gap:1.5rem;margin:2rem 0}
21
+ .compare-card{background:var(--card);border:2px solid #2a2a3a;border-radius:12px;padding:1.5rem;transition:border-color .2s}
22
+ .compare-card:hover{border-color:var(--accent)}
23
+ .compare-card h3{margin-bottom:.5rem}
24
+ .compare-card .vs{color:var(--accent);font-size:.85rem;text-transform:uppercase;letter-spacing:.1em;margin-bottom:.5rem}
25
+ .compare-card p{font-size:.9rem}
26
+ .compare-card a{color:var(--accent);text-decoration:none;font-weight:700;font-size:.9rem}
27
+ table{width:100%;border-collapse:collapse;margin:1.5rem 0}
28
+ th,td{padding:.75rem;text-align:left;border-bottom:1px solid #2a2a3a;font-size:.9rem}
29
+ th{color:var(--accent);font-size:.8rem;text-transform:uppercase;letter-spacing:.05em}
30
+ .yes{color:var(--accent)}
31
+ .no{color:var(--red)}
32
+ .partial{color:#f5c542}
33
+ .btn{background:var(--accent);color:#000;padding:.75rem 2rem;border:none;border-radius:8px;font-weight:700;cursor:pointer;display:inline-block;text-decoration:none;margin:.5rem}
34
+ footer{text-align:center;color:var(--muted);font-size:.8rem;padding:2rem 0;border-top:1px solid #2a2a3a;margin-top:3rem}
35
+ </style>
36
+ </head>
37
+ <body>
38
+ <div class="container">
39
+ <nav>
40
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
41
+ <div>
42
+ <a href="/scan/">Scanner</a>
43
+ <a href="/affiliates/">Affiliates</a>
44
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
45
+ </div>
46
+ </nav>
47
+
48
+ <h1>How ClawMoat Compares</h1>
49
+ <p style="font-size:1.1rem;color:var(--fg);max-width:700px">There are many AI security tools now. Here's how we're different: open source, self-hosted, zero dependencies, transparent pricing, and focused on runtime protection for developers — not enterprise sales cycles.</p>
50
+
51
+ <div class="compare-grid">
52
+ <div class="compare-card">
53
+ <div class="vs">Agent Firewall vs API Guard</div>
54
+ <h3>ClawMoat vs Lakera</h3>
55
+ <p>Lakera is a hosted API ($0 → enterprise). ClawMoat runs locally with zero deps. No API calls, no vendor lock-in, no token limits.</p>
56
+ <a href="/compare/lakera/">Full comparison →</a>
57
+ </div>
58
+ <div class="compare-card">
59
+ <div class="vs">Node.js vs Python</div>
60
+ <h3>ClawMoat vs LLM Guard</h3>
61
+ <p>LLM Guard is Python-only with heavy deps. ClawMoat is JS-native for the OpenClaw/Claude Code ecosystem. Plus host protection and supply chain detection.</p>
62
+ <a href="/compare/llm-guard/">Full comparison →</a>
63
+ </div>
64
+ <div class="compare-card">
65
+ <div class="vs">Independent vs Platform Lock-in</div>
66
+ <h3>ClawMoat vs Snyk agent-scan</h3>
67
+ <p>Snyk requires an API token and account. ClawMoat needs nothing — npm install and go. Different philosophy: developer-first vs enterprise-first.</p>
68
+ <a href="/compare/snyk-agent-scan/">Full comparison →</a>
69
+ </div>
70
+ </div>
71
+
72
+ <h2>Feature Comparison Matrix</h2>
73
+ <table>
74
+ <thead>
75
+ <tr><th>Feature</th><th>ClawMoat</th><th>Lakera Guard</th><th>LLM Guard</th><th>Snyk agent-scan</th><th>NeMo Guardrails</th></tr>
76
+ </thead>
77
+ <tbody>
78
+ <tr><td>Open Source</td><td class="yes">✓ MIT</td><td class="no">✗ Proprietary</td><td class="yes">✓ MIT</td><td class="yes">✓ Apache 2.0</td><td class="yes">✓ Apache 2.0</td></tr>
79
+ <tr><td>Self-Hosted</td><td class="yes">✓ Local only</td><td class="partial">Enterprise only</td><td class="yes">✓</td><td class="yes">✓</td><td class="yes">✓</td></tr>
80
+ <tr><td>Zero Dependencies</td><td class="yes">✓</td><td class="no">N/A (API)</td><td class="no">✗ Heavy</td><td class="no">✗ Python</td><td class="no">✗ Heavy</td></tr>
81
+ <tr><td>Prompt Injection</td><td class="yes">✓ 13 patterns</td><td class="yes">✓ ML-based</td><td class="yes">✓</td><td class="yes">✓</td><td class="partial">Via config</td></tr>
82
+ <tr><td>Supply Chain Detection</td><td class="yes">✓ TeamPCP + more</td><td class="no">✗</td><td class="no">✗</td><td class="partial">MCP focus</td><td class="no">✗</td></tr>
83
+ <tr><td>Host Protection</td><td class="yes">✓ 4 tiers</td><td class="no">✗</td><td class="no">✗</td><td class="no">✗</td><td class="no">✗</td></tr>
84
+ <tr><td>MCP Server Scanning</td><td class="partial">🔜 Coming</td><td class="no">✗</td><td class="no">✗</td><td class="yes">✓</td><td class="no">✗</td></tr>
85
+ <tr><td>Secret Scanning</td><td class="yes">✓</td><td class="partial">PII only</td><td class="yes">✓</td><td class="partial">Skills only</td><td class="no">✗</td></tr>
86
+ <tr><td>Insider Threat Detection</td><td class="yes">✓ 6 detectors</td><td class="no">✗</td><td class="no">✗</td><td class="no">✗</td><td class="no">✗</td></tr>
87
+ <tr><td>Node.js Native</td><td class="yes">✓</td><td class="partial">API client</td><td class="no">✗ Python</td><td class="no">✗ Python</td><td class="no">✗ Python</td></tr>
88
+ <tr><td>Auth Required</td><td class="yes">None</td><td class="no">API key</td><td class="yes">None</td><td class="no">Snyk token</td><td class="yes">None</td></tr>
89
+ <tr><td>Transparent Pricing</td><td class="yes">✓ On website</td><td class="no">"Let's chat"</td><td class="yes">Free</td><td class="partial">Via Snyk plans</td><td class="yes">Free</td></tr>
90
+ <tr><td>Free Tier</td><td class="yes">✓ Unlimited</td><td class="yes">10K req/mo</td><td class="yes">✓ Unlimited</td><td class="yes">Open preview</td><td class="yes">✓ Unlimited</td></tr>
91
+ </tbody>
92
+ </table>
93
+
94
+ <h2>Pricing Comparison</h2>
95
+ <table>
96
+ <thead>
97
+ <tr><th>Tool</th><th>Free</th><th>Developer</th><th>Team</th><th>Enterprise</th></tr>
98
+ </thead>
99
+ <tbody>
100
+ <tr><td><strong>ClawMoat</strong></td><td>$0 (unlimited)</td><td>$9/mo</td><td>$49/mo</td><td>Custom</td></tr>
101
+ <tr><td>Lakera</td><td>$0 (10K req)</td><td>—</td><td>—</td><td>"Let's chat"</td></tr>
102
+ <tr><td>LLM Guard</td><td>Free (MIT)</td><td>—</td><td>—</td><td>Coming soon</td></tr>
103
+ <tr><td>Snyk</td><td>Free tier</td><td>~$45/dev/mo</td><td>—</td><td>Custom</td></tr>
104
+ <tr><td>Zenity</td><td>—</td><td>—</td><td>—</td><td>Quote only</td></tr>
105
+ <tr><td>Noma</td><td>—</td><td>—</td><td>—</td><td>Quote only ($139M raised)</td></tr>
106
+ </tbody>
107
+ </table>
108
+
109
+ <p style="margin-top:2rem;text-align:center;font-size:1rem;color:var(--fg)"><strong>ClawMoat is the only tool that combines host-level protection, supply chain detection, insider threat analysis, AND transparent pricing in a zero-dependency Node.js package.</strong></p>
110
+
111
+ <div style="text-align:center;margin:2rem 0">
112
+ <a href="https://github.com/darfaz/clawmoat" class="btn">⭐ Star on GitHub</a>
113
+ <a href="/scan/" class="btn" style="background:transparent;border:2px solid var(--accent);color:var(--accent)">Try the Scanner</a>
114
+ </div>
115
+
116
+ <footer>
117
+ <p>🏰 ClawMoat — The Open-Source Agent Firewall</p>
118
+ <p><a href="/" style="color:var(--muted)">Home</a> · <a href="/scan/" style="color:var(--muted)">Scanner</a> · <a href="/affiliates/" style="color:var(--muted)">Affiliates</a> · <a href="https://github.com/darfaz/clawmoat" style="color:var(--muted)">GitHub</a></p>
119
+ </footer>
120
+ </div>
121
+ </body>
122
+ </html>
package/docs/compare/lakera/index.html ADDED
@@ -0,0 +1,62 @@
1
+ <!DOCTYPE html><html lang="en"><head>
2
+ <meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0">
3
+ <title>ClawMoat vs Lakera Guard — AI Agent Security Comparison</title>
4
+ <meta name="description" content="Compare ClawMoat and Lakera Guard for AI agent security. Self-hosted vs API, transparent pricing vs sales calls, zero dependencies vs vendor lock-in.">
5
+ <style>:root{--bg:#0a0a0f;--fg:#e0e0e8;--accent:#00d4aa;--muted:#888;--card:#14141f;--blue:#3B82F6;--red:#ff4444}*{margin:0;padding:0;box-sizing:border-box}body{background:var(--bg);color:var(--fg);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;line-height:1.7}.container{max-width:800px;margin:0 auto;padding:2rem 1.5rem}nav{padding:1rem 0;border-bottom:1px solid #2a2a3a;margin-bottom:2rem;display:flex;justify-content:space-between;align-items:center}nav a{color:var(--fg);text-decoration:none;margin-right:1.5rem}nav a:hover{color:var(--accent)}.logo span{color:var(--accent)}h1{font-size:2.2rem;margin-bottom:1rem}h2{color:var(--accent);margin:2rem 0 .75rem;font-size:1.3rem}p,li{color:var(--muted)}ul{margin:0 0 1rem 1.5rem}.highlight-box{background:var(--card);border:2px solid var(--accent);border-radius:12px;padding:1.5rem;margin:1.5rem 0}table{width:100%;border-collapse:collapse;margin:1rem 0}th,td{padding:.6rem;text-align:left;border-bottom:1px solid #2a2a3a;font-size:.9rem}th{color:var(--accent);font-size:.8rem;text-transform:uppercase}.yes{color:var(--accent)}.no{color:var(--red)}.btn{background:var(--accent);color:#000;padding:.75rem 2rem;border:none;border-radius:8px;font-weight:700;cursor:pointer;display:inline-block;text-decoration:none;margin:.5rem}footer{text-align:center;color:var(--muted);font-size:.8rem;padding:2rem 0;border-top:1px solid #2a2a3a;margin-top:3rem}</style>
6
+ </head><body><div class="container">
7
+ <nav><a href="/" class="logo">🏰 Claw<span>Moat</span></a><div><a href="/compare/">All Comparisons</a><a href="/scan/">Scanner</a><a href="https://github.com/darfaz/clawmoat">GitHub ↗</a></div></nav>
8
+
9
+ <h1>ClawMoat vs Lakera Guard</h1>
10
+ <p style="font-size:1.1rem;color:var(--fg)">Lakera Guard is a hosted API for LLM runtime security. ClawMoat is a self-hosted, zero-dependency agent firewall. Different architectures, different trade-offs.</p>
11
+
12
+ <div class="highlight-box">
13
+ <p style="color:var(--fg);margin:0"><strong>TL;DR:</strong> Choose Lakera if you want ML-powered detection via an API and have budget for enterprise sales. Choose ClawMoat if you want self-hosted, transparent pricing, supply chain protection, and zero vendor lock-in.</p>
14
+ </div>
15
+
16
+ <h2>Architecture</h2>
17
+ <p><strong>Lakera</strong> is a cloud API. You send prompts to their endpoint, they return a risk score. Your data leaves your machine. Latency depends on network. Requires an API key and account.</p>
18
+ <p><strong>ClawMoat</strong> runs entirely local. npm install, import, done. Nothing leaves your machine. Zero network calls. Zero auth. Zero dependencies.</p>
19
+
20
+ <h2>Detection Approach</h2>
21
+ <p>Lakera uses ML models trained on their proprietary dataset. This means better generalization for novel attacks, but it's a black box — you can't inspect or customize the detection logic.</p>
22
+ <p>ClawMoat uses pattern-based detection with 13 prompt injection patterns, 15+ supply chain indicators, and 6 insider threat detectors. It's transparent — you can read every pattern, add your own, and understand exactly why something was flagged.</p>
23
+
24
+ <h2>What ClawMoat Has That Lakera Doesn't</h2>
25
+ <ul>
26
+ <li><strong>Host-level protection</strong> — forbidden zones, dangerous command blocking, 4 permission tiers</li>
27
+ <li><strong>Supply chain detection</strong> — real-time indicators for TeamPCP, CanisterWorm, compromised packages</li>
28
+ <li><strong>Insider threat detection</strong> — 6 behavioral detectors based on Anthropic's agentic misalignment research</li>
29
+ <li><strong>Network egress logging</strong> — tracks outbound connections from agents</li>
30
+ <li><strong>Inter-agent message scanning</strong> — detects attacks between cooperating agents</li>
31
+ <li><strong>Zero dependencies</strong> — no supply chain risk from the security tool itself</li>
32
+ <li><strong>Transparent pricing</strong> — $0 / $29 / $149 on the website vs "Let's chat"</li>
33
+ </ul>
34
+
35
+ <h2>What Lakera Has That ClawMoat Doesn't</h2>
36
+ <ul>
37
+ <li><strong>ML-powered detection</strong> — better at catching novel/creative prompt injections</li>
38
+ <li><strong>PII detection and redaction</strong> — dedicated PII scanner with entity recognition</li>
39
+ <li><strong>Enterprise SSO/RBAC</strong> — built for large orgs</li>
40
+ <li><strong>Managed infrastructure</strong> — no self-hosting needed</li>
41
+ <li><strong>Proven at scale</strong> — used by Dropbox and other large companies</li>
42
+ </ul>
43
+
44
+ <h2>Pricing</h2>
45
+ <table>
46
+ <tr><th></th><th>ClawMoat</th><th>Lakera</th></tr>
47
+ <tr><td>Free</td><td class="yes">Unlimited, self-hosted</td><td>10,000 req/month</td></tr>
48
+ <tr><td>Developer</td><td>$9/mo</td><td class="no">—</td></tr>
49
+ <tr><td>Team</td><td>$49/mo</td><td class="no">—</td></tr>
50
+ <tr><td>Enterprise</td><td>Custom</td><td>"Let's chat" (sales call required)</td></tr>
51
+ </table>
52
+
53
+ <h2>Who Should Use What</h2>
54
+ <p><strong>Use Lakera if:</strong> You're an enterprise with budget, need ML-powered detection, want managed infrastructure, and can wait for a sales process.</p>
55
+ <p><strong>Use ClawMoat if:</strong> You're a developer or small team, want self-hosted security, need supply chain protection, care about transparent pricing, and want to be running in 5 minutes.</p>
56
+
57
+ <div style="text-align:center;margin:2rem 0">
58
+ <a href="https://github.com/darfaz/clawmoat" class="btn">Try ClawMoat Free →</a>
59
+ <a href="/compare/" class="btn" style="background:transparent;border:2px solid var(--accent);color:var(--accent)">All Comparisons</a>
60
+ </div>
61
+ <footer><p>🏰 ClawMoat — The Open-Source Agent Firewall</p></footer>
62
+ </div></body></html>