clawmoat 0.7.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (178) hide show
  1. package/.dockerignore +9 -0
  2. package/CHANGELOG.md +18 -0
  3. package/CONTRIBUTING.md +4 -2
  4. package/DEMO.md +87 -0
  5. package/Dockerfile +5 -18
  6. package/README.md +294 -8
  7. package/SECURITY.md +58 -10
  8. package/THREAT_MODEL.md +129 -0
  9. package/agent/README.md +131 -0
  10. package/agent/index.js +471 -0
  11. package/agent/install-service.sh +94 -0
  12. package/agent/openclaw-hook.js +453 -0
  13. package/agent/provider-setup.js +649 -0
  14. package/agent/setup.js +274 -0
  15. package/assets/BADGE-USAGE.md +20 -0
  16. package/assets/clawmoat-badge.svg +21 -0
  17. package/bin/clawmoat.js +468 -111
  18. package/docs/affiliates/dashboard.html +124 -0
  19. package/docs/affiliates/index.html +236 -0
  20. package/docs/agent-install.html +183 -0
  21. package/docs/ai-agent-security-scanner.html +10 -6
  22. package/docs/badge/index.html +149 -0
  23. package/docs/badge/scanning.svg +23 -0
  24. package/docs/blog/386-malicious-skills.html +262 -0
  25. package/docs/blog/40000-exposed-openclaw-instances.html +201 -0
  26. package/docs/blog/agent-trust-protocol.html +198 -0
  27. package/docs/blog/ai-agent-earns-commissions.html +230 -0
  28. package/docs/blog/bugmageddon-agent-firewall.html +174 -0
  29. package/docs/blog/calculator-math.html +180 -0
  30. package/docs/blog/clawmoat-vs-llamafirewall-nemo-guardrails.html +229 -0
  31. package/docs/blog/host-guardian-launch.html +18 -8
  32. package/docs/blog/ibm-experts-agent-runtime-protection.html +247 -0
  33. package/docs/blog/index.html +211 -9
  34. package/docs/blog/langchain-security-tutorial.html +18 -8
  35. package/docs/blog/mcp-30-cves-security-crisis.html +286 -0
  36. package/docs/blog/meta-researcher-rogue-agent.html +201 -0
  37. package/docs/blog/microsoft-openclaw-workstation-security.html +235 -0
  38. package/docs/blog/nist-ai-agent-standards-clawmoat.html +377 -0
  39. package/docs/blog/oasis-websocket-hijack.html +212 -0
  40. package/docs/blog/ollama-openclaw-security.html +160 -0
  41. package/docs/blog/openclaw-enterprise-readiness-claw10.html +199 -0
  42. package/docs/blog/openclaw-security-reckoning-2026.html +368 -0
  43. package/docs/blog/owasp-agentic-ai-top10.html +18 -8
  44. package/docs/blog/securing-ai-agents.html +18 -8
  45. package/docs/blog/supply-chain-agents.html +18 -8
  46. package/docs/business/index.html +525 -0
  47. package/docs/business/install.html +261 -0
  48. package/docs/checklist.html +174 -0
  49. package/docs/compare/index.html +122 -0
  50. package/docs/compare/lakera/index.html +62 -0
  51. package/docs/compare/llm-guard/index.html +49 -0
  52. package/docs/compare/snyk-agent-scan/index.html +63 -0
  53. package/docs/compare.html +10 -6
  54. package/docs/dashboard/index.html +520 -0
  55. package/docs/finance/index.html +220 -0
  56. package/docs/guides/business-deployment.html +770 -0
  57. package/docs/hall-of-fame.html +174 -0
  58. package/docs/index.html +447 -154
  59. package/docs/install.sh +557 -0
  60. package/docs/integrations/langchain.html +14 -6
  61. package/docs/integrations/openai.html +14 -6
  62. package/docs/integrations/openclaw.html +55 -7
  63. package/docs/plans/2026-03-26-threat-intel-api.md +255 -0
  64. package/docs/plans/2026-04-14-bugmageddon-marketing-pack.md +329 -0
  65. package/docs/plans/2026-04-14-clawmoat-v1-bugmageddon.md +248 -0
  66. package/docs/plans/2026-04-14-v1-release-update.md +91 -0
  67. package/docs/plans/2026-04-19-supabase-audit.md +68 -0
  68. package/docs/plans/2026-05-12-sales-push.md +303 -0
  69. package/docs/playground/index.html +893 -0
  70. package/docs/playground.html +4 -7
  71. package/docs/privacy-policy/index.html +122 -0
  72. package/docs/rfcs/defense-in-depth.md +467 -0
  73. package/docs/scan/index.html +358 -0
  74. package/docs/services/case-study.html +255 -0
  75. package/docs/services/downloads/install-openclaw.bat +45 -0
  76. package/docs/services/downloads/install-openclaw.command +38 -0
  77. package/docs/services/downloads/install-openclaw.sh +38 -0
  78. package/docs/services/get-started.html +165 -0
  79. package/docs/services/index.html +598 -0
  80. package/docs/services/multi-agent-security.html +284 -0
  81. package/docs/services/one-pager.html +99 -0
  82. package/docs/services/pitch-deck.html +229 -0
  83. package/docs/services/roi-calculator.html +258 -0
  84. package/docs/sitemap.xml +192 -2
  85. package/docs/support/index.html +135 -0
  86. package/docs/templates/customer-service/HEARTBEAT.md +61 -0
  87. package/docs/templates/customer-service/MEMORY.md +89 -0
  88. package/docs/templates/customer-service/SOUL.md +41 -0
  89. package/docs/templates/customer-service/USER.md +56 -0
  90. package/docs/templates/executive/HEARTBEAT.md +86 -0
  91. package/docs/templates/executive/MEMORY.md +92 -0
  92. package/docs/templates/executive/SOUL.md +44 -0
  93. package/docs/templates/executive/USER.md +62 -0
  94. package/docs/templates/finance/HEARTBEAT.md +58 -0
  95. package/docs/templates/finance/MEMORY.md +87 -0
  96. package/docs/templates/finance/SOUL.md +38 -0
  97. package/docs/templates/finance/USER.md +53 -0
  98. package/docs/templates/index.html +115 -0
  99. package/docs/templates/operations/HEARTBEAT.md +63 -0
  100. package/docs/templates/operations/MEMORY.md +68 -0
  101. package/docs/templates/operations/SOUL.md +38 -0
  102. package/docs/templates/operations/USER.md +49 -0
  103. package/docs/templates/sales/HEARTBEAT.md +55 -0
  104. package/docs/templates/sales/MEMORY.md +89 -0
  105. package/docs/templates/sales/SOUL.md +34 -0
  106. package/docs/templates/sales/USER.md +54 -0
  107. package/docs/terms-of-service/index.html +122 -0
  108. package/eslint.config.js +32 -0
  109. package/evals/README.md +29 -0
  110. package/evals/cases.json +390 -0
  111. package/evals/results.md +68 -0
  112. package/evals/run.js +180 -0
  113. package/examples/basic-usage.js +38 -0
  114. package/examples/demo-attack/demo.js +186 -0
  115. package/examples/python-quickstart/README.md +54 -0
  116. package/examples/python-quickstart/clawmoat_client.py +167 -0
  117. package/examples/video-demo/README.md +14 -0
  118. package/examples/video-demo/scene-a-normal.js +29 -0
  119. package/examples/video-demo/scene-b-attack-arrives.js +31 -0
  120. package/examples/video-demo/scene-c-hijack.js +44 -0
  121. package/examples/video-demo/scene-d-clawmoat.js +46 -0
  122. package/integrations/crewai/README.md +32 -0
  123. package/integrations/crewai/clawmoat_crewai/__init__.py +17 -0
  124. package/integrations/crewai/clawmoat_crewai/guard.py +103 -0
  125. package/integrations/crewai/pyproject.toml +21 -0
  126. package/integrations/langchain/README.md +91 -0
  127. package/integrations/langchain/clawmoat_langchain/__init__.py +17 -0
  128. package/integrations/langchain/clawmoat_langchain/callback.py +489 -0
  129. package/integrations/langchain/pyproject.toml +32 -0
  130. package/integrations/litellm/README.md +324 -0
  131. package/integrations/litellm/clawmoat_litellm/__init__.py +21 -0
  132. package/integrations/litellm/clawmoat_litellm/callback.py +329 -0
  133. package/integrations/litellm/clawmoat_litellm/proxy_middleware.py +224 -0
  134. package/integrations/litellm/pyproject.toml +74 -0
  135. package/integrations/openai-agents/README.md +392 -0
  136. package/integrations/openai-agents/clawmoat_openai_agents/__init__.py +20 -0
  137. package/integrations/openai-agents/clawmoat_openai_agents/guardrail.py +431 -0
  138. package/integrations/openai-agents/clawmoat_openai_agents/middleware.py +311 -0
  139. package/integrations/openai-agents/pyproject.toml +76 -0
  140. package/package.json +6 -5
  141. package/plugins/openclaw-adapter/PHASE1.md +439 -0
  142. package/plugins/openclaw-adapter/README.md +103 -0
  143. package/plugins/openclaw-adapter/SPEC.md +1644 -0
  144. package/plugins/openclaw-adapter/package.json +31 -0
  145. package/plugins/openclaw-adapter/src/index.test.ts +226 -0
  146. package/plugins/openclaw-adapter/src/index.ts +140 -0
  147. package/plugins/openclaw-adapter/tsconfig.json +14 -0
  148. package/server/data/threats.json +290 -0
  149. package/server/index.js +224 -10
  150. package/src/adapters/express.js +161 -0
  151. package/src/adapters/index.js +92 -0
  152. package/src/adapters/langchain.js +185 -0
  153. package/src/approval/index.js +456 -0
  154. package/src/ban-scanner.js +200 -0
  155. package/src/boundary-scanner.js +296 -0
  156. package/src/ci-scanner.js +279 -0
  157. package/src/code-scanner.js +245 -0
  158. package/src/enforce.js +166 -0
  159. package/src/finance/index.js +585 -0
  160. package/src/finance/mcp-firewall.js +486 -0
  161. package/src/formatters/json.js +80 -0
  162. package/src/formatters/sarif.js +388 -0
  163. package/src/guardian/alerts.js +34 -3
  164. package/src/guardian/gateway-monitor.js +590 -0
  165. package/src/guardian/index.js +41 -2
  166. package/src/index.js +105 -0
  167. package/src/integrations/agentmesh.js +501 -0
  168. package/src/language-detector.js +201 -0
  169. package/src/mcp-scanner.js +253 -0
  170. package/src/multimodal/index.js +579 -0
  171. package/src/obfuscation-scanner.js +457 -0
  172. package/src/policy-engine.js +402 -0
  173. package/src/scanners/dependency-attacks.js +128 -0
  174. package/src/scanners/prompt-injection.js +18 -0
  175. package/src/scanners/supply-chain.js +14 -0
  176. package/src/templates/default-config.yml +90 -0
  177. package/src/vuln-ops/exploitability.js +46 -0
  178. package/src/watch/live-monitor.js +720 -0
package/docs/playground.html CHANGED
@@ -129,16 +129,13 @@ nav .container{display:flex;align-items:center;justify-content:space-between}
129
129
 
130
130
  <nav>
131
131
  <div class="container">
132
- <a href="/" class="logo" style="text-decoration:none">🏰 Claw<span>Moat</span></a>
132
+ <a href="/" class="logo">🏰 Claw<span>Moat</span></a>
133
133
  <button class="menu-toggle" onclick="document.querySelector('.nav-links').classList.toggle('open')" aria-label="Menu">☰</button>
134
134
  <div class="nav-links">
135
- <a href="/#features">Features</a>
136
- <a href="/#demo">Demo</a>
137
- <a href="/playground.html" class="active">Playground</a>
138
- <a href="/#pricing">Pricing</a>
135
+ <a href="/">Security</a>
136
+ <a href="/services/">AI Agents</a>
139
137
  <a href="/blog/">Blog</a>
140
- <a href="https://github.com/darfaz/clawmoat">GitHub</a>
141
- <a href="/#waitlist" class="btn-sm">Get Early Access</a>
138
+ <a href="https://github.com/darfaz/clawmoat">GitHub ↗</a>
142
139
  </div>
143
140
  </div>
144
141
  </nav>
package/docs/privacy-policy/index.html ADDED
@@ -0,0 +1,122 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Privacy Policy — ClawMoat</title>
7
+ <meta name="description" content="ClawMoat Privacy Policy. How we collect, use, and protect your information.">
8
+ <link rel="canonical" href="https://clawmoat.com/privacy-policy/">
9
+ <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🏰</text></svg>">
10
+ <style>
11
+ *{margin:0;padding:0;box-sizing:border-box}
12
+ :root{--navy:#0F172A;--navy-light:#1E293B;--navy-mid:#334155;--blue:#3B82F6;--emerald:#10B981;--white:#F8FAFC;--gray:#94A3B8}
13
+ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:var(--navy);color:var(--white);line-height:1.8}
14
+ a{color:var(--blue)}
15
+ .container{max-width:740px;margin:0 auto;padding:0 24px}
16
+ nav{background:rgba(15,23,42,.95);backdrop-filter:blur(12px);border-bottom:1px solid rgba(59,130,246,.15);padding:16px 0;position:fixed;top:0;left:0;right:0;z-index:100}
17
+ nav .container{display:flex;align-items:center;justify-content:space-between}
18
+ .logo{font-size:1.1rem;font-weight:700;color:var(--white);text-decoration:none}
19
+ .logo span{color:var(--emerald)}
20
+ nav a{color:var(--gray);font-size:.85rem;text-decoration:none}
21
+ nav a:hover{color:var(--white)}
22
+ article{padding:120px 0 80px}
23
+ h1{font-size:2rem;font-weight:800;margin-bottom:8px}
24
+ .updated{color:var(--gray);font-size:.85rem;margin-bottom:40px}
25
+ h2{font-size:1.2rem;font-weight:700;margin:36px 0 12px;color:var(--white)}
26
+ p{color:var(--gray);margin-bottom:16px;font-size:.95rem}
27
+ ul{color:var(--gray);margin:0 0 16px 24px;font-size:.95rem}
28
+ li{margin-bottom:6px}
29
+ </style>
30
+ </head>
31
+ <body>
32
+ <nav><div class="container"><a href="/" class="logo">🏰 Claw<span>Moat</span></a><div style="display:flex;gap:20px"><a href="/">Home</a><a href="/terms-of-service/">Terms</a><a href="/privacy-policy/">Privacy</a></div></div></nav>
33
+ <article><div class="container">
34
+ <h1>Privacy Policy</h1>
35
+ <p class="updated">Last Updated: February 26, 2026</p>
36
+
37
+ <p>This Privacy Policy describes how Leopold Care, LLC dba ClawMoat ("we", "us", "our") collects, uses, and discloses information about you when you use our website (clawmoat.com), open-source software, paid services, and related tools (collectively, the "Services").</p>
38
+
39
+ <p>By using our Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use the Services.</p>
40
+
41
+ <h2>1. Information We Collect</h2>
42
+
43
+ <p><strong>Information You Provide:</strong></p>
44
+ <ul>
45
+ <li><strong>Account information</strong> — name, email address, and password when you create an account or subscribe to a paid plan.</li>
46
+ <li><strong>Payment information</strong> — credit card or billing information processed securely through Stripe. We do not store your full payment card details.</li>
47
+ <li><strong>Contact form submissions</strong> — name, email, company, and any details you provide through our inquiry forms.</li>
48
+ <li><strong>Communications</strong> — information you provide when contacting us via email at hello@clawmoat.com.</li>
49
+ </ul>
50
+
51
+ <p><strong>Information Collected Automatically:</strong></p>
52
+ <ul>
53
+ <li><strong>Usage data</strong> — pages visited, time on site, referral source, browser type, device type, and IP address.</li>
54
+ <li><strong>Cookies</strong> — we use essential cookies for site functionality. We do not use tracking cookies or third-party advertising cookies.</li>
55
+ </ul>
56
+
57
+ <p><strong>Open-Source Software (npm package):</strong></p>
58
+ <ul>
59
+ <li>The ClawMoat open-source npm package does <strong>not</strong> collect any telemetry, usage data, or personal information by default.</li>
60
+ <li>The software runs entirely on your machine. No data is sent to our servers unless you explicitly configure webhook alerts or opt into telemetry.</li>
61
+ <li>If you opt into telemetry, only anonymized usage statistics are collected (e.g., feature usage counts). No personal data, file contents, or credentials are ever transmitted.</li>
62
+ </ul>
63
+
64
+ <h2>2. How We Use Your Information</h2>
65
+ <ul>
66
+ <li>To provide, maintain, and improve the Services</li>
67
+ <li>To process payments and manage subscriptions</li>
68
+ <li>To respond to your inquiries and provide customer support</li>
69
+ <li>To send service-related communications (not marketing, unless you opt in)</li>
70
+ <li>To comply with legal obligations</li>
71
+ <li>To detect and prevent fraud or security incidents</li>
72
+ </ul>
73
+
74
+ <h2>3. How We Share Your Information</h2>
75
+ <p>We do not sell your personal information. We may share information with:</p>
76
+ <ul>
77
+ <li><strong>Service providers</strong> — Stripe (payments), GitHub Pages (hosting), and email providers, solely to deliver the Services.</li>
78
+ <li><strong>Legal requirements</strong> — if required by law, court order, or governmental authority.</li>
79
+ <li><strong>Business transfers</strong> — in connection with a merger, acquisition, or sale of assets, with notice to you.</li>
80
+ </ul>
81
+
82
+ <h2>4. Data Security</h2>
83
+ <p>We implement reasonable technical and organizational measures to protect your information. However, no method of transmission over the Internet is 100% secure.</p>
84
+
85
+ <h2>5. Data Retention</h2>
86
+ <p>We retain your information for as long as your account is active or as needed to provide Services. You may request deletion of your account and associated data at any time by contacting us.</p>
87
+
88
+ <h2>6. Your Rights</h2>
89
+ <p>Depending on your location, you may have the right to:</p>
90
+ <ul>
91
+ <li>Access, correct, or delete your personal information</li>
92
+ <li>Object to or restrict processing of your information</li>
93
+ <li>Data portability</li>
94
+ <li>Withdraw consent at any time</li>
95
+ </ul>
96
+ <p>To exercise these rights, contact us at <a href="mailto:hello@clawmoat.com">hello@clawmoat.com</a>.</p>
97
+
98
+ <h2>7. California Residents (CCPA)</h2>
99
+ <p>If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.</p>
100
+
101
+ <h2>8. Children's Privacy</h2>
102
+ <p>Our Services are not directed to children under 13. We do not knowingly collect personal information from children under 13.</p>
103
+
104
+ <h2>9. Third-Party Links</h2>
105
+ <p>Our Services may contain links to third-party websites. We are not responsible for their privacy practices.</p>
106
+
107
+ <h2>10. Changes to This Policy</h2>
108
+ <p>We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last Updated" date.</p>
109
+
110
+ <h2>11. Contact Us</h2>
111
+ <p>If you have questions about this Privacy Policy, contact us at:</p>
112
+ <p>
113
+ Leopold Care, LLC dba ClawMoat<br>
114
+ 10000 Washington Blvd<br>
115
+ Culver City, CA 90232<br>
116
+ Email: <a href="mailto:hello@clawmoat.com">hello@clawmoat.com</a><br>
117
+ Phone: <a href="tel:+16503838190">(650) 383-8190</a>
118
+ </p>
119
+
120
+ </div></article>
121
+ </body>
122
+ </html>
package/docs/rfcs/defense-in-depth.md ADDED
@@ -0,0 +1,467 @@
1
+ # RFC: Defense-in-Depth for AI Agents — ClawMoat × Agent-OS Collaboration
2
+
3
+ **Status:** Draft
4
+ **Author(s):** ClawMoat Team, Agent-OS/AgentMesh Team
5
+ **Date:** March 2026
6
+ **Version:** 1.0
7
+
8
+ ## Abstract
9
+
10
+ AI agents operate with real-world tool access (shell, files, APIs, browsers) and require robust security architecture. This RFC proposes a **defense-in-depth** approach combining ClawMoat's reactive security scanning with Agent-OS's proactive governance layer. Together, they provide comprehensive protection against the OWASP Agentic Top 10 threats while maintaining agent functionality and developer experience.
11
+
12
+ ---
13
+
14
+ ## 1. Problem Statement
15
+
16
+ ### Current Landscape Fragmentation
17
+
18
+ The AI agent security landscape is fragmented with each framework implementing their own (or no) security model:
19
+
20
+ - **LangChain:** Basic output parsers, limited input validation
21
+ - **CrewAI:** Framework-level role restrictions, no runtime scanning
22
+ - **AutoGen:** Conversation-level safety filters, limited tool governance
23
+ - **OpenAI Agents SDK:** Output-focused guardrails, minimal input protection
24
+ - **Google Agent Development Kit:** Enterprise features, vendor lock-in
25
+ - **PydanticAI:** Type safety focus, limited security scanning
26
+
27
+ ### Security Gaps
28
+
29
+ **Single-layer approaches fail:**
30
+ - Input-only filtering misses dynamic threats
31
+ - Output-only scanning allows malicious tool execution
32
+ - Framework-specific security doesn't protect cross-framework deployments
33
+ - Policy engines without scanning miss sophisticated attacks
34
+
35
+ **No single security layer is sufficient** — sophisticated threats require multiple coordinated defenses.
36
+
37
+ ---
38
+
39
+ ## 2. Defense-in-Depth Architecture
40
+
41
+ ### Layer 1: Perimeter (ClawMoat)
42
+
43
+ **Role:** Reactive threat detection and content scanning
44
+ **Scope:** Input/output analysis, prompt injection detection, data exfiltration prevention
45
+
46
+ **Components:**
47
+ - **Input Scanners:** Prompt injection, jailbreak attempts, excessive agency requests
48
+ - **Output Scanners:** PII/secrets leakage, unauthorized data sharing, policy violations
49
+ - **Tool Scanners:** Command validation, file access monitoring, network egress logging
50
+ - **Behavioral Analysis:** Insider threat patterns, anomaly detection
51
+
52
+ **Coverage:**
53
+ - OWASP Agentic A01: Prompt Injection
54
+ - OWASP Agentic A02: Insecure Output Handling
55
+ - OWASP Agentic A03: Training Data Poisoning (detection)
56
+ - OWASP Agentic A06: Excessive Agency
57
+ - OWASP Agentic A09: Misinformation (patterns)
58
+ - OWASP Agentic A10: Unbounded Consumption
59
+
60
+ ### Layer 2: Governance (Agent-OS)
61
+
62
+ **Role:** Proactive policy enforcement and action interception
63
+ **Scope:** Permission models, approval workflows, action authorization
64
+
65
+ **Components:**
66
+ - **Policy Engine:** YAML-based rules, role-based permissions, conditional access
67
+ - **Action Interceptor:** Pre-execution validation, approval workflows, audit trails
68
+ - **Trust System:** 5-dimension scoring, behavior-based reputation, temporal decay
69
+ - **Audit Chain:** Tamper-evident Merkle tree, compliance reporting, forensics
70
+
71
+ **Coverage:**
72
+ - OWASP Agentic A04: Model Denial of Service (rate limiting)
73
+ - OWASP Agentic A05: Supply Chain Vulnerabilities (tool validation)
74
+ - OWASP Agentic A06: Excessive Agency (authorization)
75
+ - OWASP Agentic A07: System Prompt Leakage (access control)
76
+ - OWASP Agentic A08: Vector and Embeddings Weaknesses (data governance)
77
+
78
+ ### Layer 3: Runtime (Framework)
79
+
80
+ **Role:** Framework-specific guardrails and tool-level access control
81
+ **Scope:** Native integrations, performance optimization, developer experience
82
+
83
+ **Components:**
84
+ - **LangChain:** Custom callback handlers, memory protection, chain validation
85
+ - **CrewAI:** Role-based tool restrictions, task validation, crew permissions
86
+ - **OpenAI Agents SDK:** Guardrail protocol implementation, handoff security
87
+ - **AutoGen:** Conversation filtering, agent isolation, group chat moderation
88
+
89
+ ### Layer 4: Audit
90
+
91
+ **Role:** Comprehensive logging, alerting, and compliance reporting
92
+ **Scope:** Cross-layer visibility, threat intelligence, regulatory compliance
93
+
94
+ **Components:**
95
+ - **Unified Logging:** JSONL format, structured events, searchable metadata
96
+ - **Threat Intelligence:** IOCs, attack patterns, behavioral baselines
97
+ - **Compliance Engine:** SOX, PCI-DSS, HIPAA reporting, audit trails
98
+ - **Alerting:** Real-time notifications, escalation workflows, incident response
99
+
100
+ ---
101
+
102
+ ## 3. Integration Points
103
+
104
+ ### 3.1 Pre-Execution Pipeline
105
+
106
+ ```
107
+ User Input → ClawMoat Scan → Agent-OS Policy → Framework Guards → Tool Execution
108
+ ```
109
+
110
+ **Flow:**
111
+ 1. **ClawMoat** scans input for prompt injection, malicious content
112
+ 2. **Agent-OS** evaluates against governance policies, role permissions
113
+ 3. **Framework** applies native guardrails, tool restrictions
114
+ 4. **Tool** executes with monitoring and logging
115
+
116
+ **Benefits:**
117
+ - Threats caught at perimeter before reaching agent
118
+ - Policy violations blocked before execution
119
+ - Multiple validation layers prevent bypass
120
+
121
+ ### 3.2 Post-Execution Pipeline
122
+
123
+ ```
124
+ Tool Output → ClawMoat Scan → Agent-OS Audit → Framework Response → User
125
+ ```
126
+
127
+ **Flow:**
128
+ 1. **Tool** generates output, ClawMoat scans for PII/secrets
129
+ 2. **Agent-OS** records action outcome, updates trust score
130
+ 3. **Framework** applies output formatting, response validation
131
+ 4. **User** receives sanitized, policy-compliant response
132
+
133
+ **Benefits:**
134
+ - Data exfiltration prevented at multiple checkpoints
135
+ - Behavioral patterns recorded for anomaly detection
136
+ - Compliance requirements automatically enforced
137
+
138
+ ### 3.3 Shared Policy Format
139
+
140
+ **Unified YAML schema** for cross-platform compatibility:
141
+
142
+ ```yaml
143
+ # clawmoat-agentmesh-policy.yml
144
+ metadata:
145
+ version: "1.0"
146
+ frameworks: ["langchain", "crewai", "openai-agents"]
147
+
148
+ clawmoat:
149
+ scanners:
150
+ prompt_injection: { enabled: true, threshold: 0.8 }
151
+ secrets: { enabled: true, redact: true }
152
+ pii: { enabled: true, anonymize: ["ssn", "credit_card"] }
153
+
154
+ agentmesh:
155
+ permissions:
156
+ tools:
157
+ - name: "web_search"
158
+ allow: ["research_agent"]
159
+ rate_limit: { calls: 10, window: "1m" }
160
+ - name: "file_write"
161
+ allow: ["admin_agent"]
162
+ approval_required: true
163
+ trust:
164
+ min_score: 0.7
165
+ factors: ["tool_success", "policy_compliance", "user_feedback"]
166
+
167
+ frameworks:
168
+ langchain:
169
+ callbacks: ["clawmoat_scanner", "agentmesh_governor"]
170
+ memory_protection: true
171
+ crewai:
172
+ middleware: ["security_layer"]
173
+ role_inheritance: false
174
+ ```
175
+
176
+ ### 3.4 Common Threat Taxonomy
177
+
178
+ **Mapped to OWASP Agentic Top 10** for consistent threat classification:
179
+
180
+ | OWASP ID | Threat | ClawMoat Detection | Agent-OS Mitigation | Framework Guard |
181
+ |----------|--------|-------------------|-------------------|-----------------|
182
+ | A01 | Prompt Injection | Input scanning, pattern matching | Policy validation, role checks | Conversation filtering |
183
+ | A02 | Insecure Output | PII/secret detection, data classification | Output approval, redaction policies | Response validation |
184
+ | A06 | Excessive Agency | Privilege escalation detection | Permission enforcement, approval | Tool restrictions |
185
+ | A09 | Misinformation | Content validation, fact-checking | Source verification, trust scoring | Output disclaimers |
186
+
187
+ ---
188
+
189
+ ## 4. Framework Support Matrix
190
+
191
+ ### 4.1 LangChain Integration
192
+
193
+ **ClawMoat Integration:**
194
+ ```python
195
+ from clawmoat.integrations.langchain import ClawMoatCallback
196
+
197
+ chain = LLMChain(
198
+ llm=OpenAI(),
199
+ callbacks=[ClawMoatCallback(
200
+ scan_input=True,
201
+ scan_output=True,
202
+ block_threats=True
203
+ )]
204
+ )
205
+ ```
206
+
207
+ **Agent-OS Integration:**
208
+ ```python
209
+ from agentmesh.integrations.langchain import AgentMeshGovernor
210
+
211
+ governor = AgentMeshGovernor(policy_path="policy.yml")
212
+ chain = governor.wrap(chain) # Adds policy enforcement
213
+ ```
214
+
215
+ ### 4.2 CrewAI Integration
216
+
217
+ **Combined Middleware:**
218
+ ```python
219
+ from clawmoat.integrations.crewai import ClawMoatMiddleware
220
+ from agentmesh.integrations.crewai import AgentMeshMiddleware
221
+
222
+ crew = Crew(
223
+ agents=[researcher, writer],
224
+ middleware=[
225
+ ClawMoatMiddleware(), # Threat scanning
226
+ AgentMeshMiddleware() # Policy enforcement
227
+ ]
228
+ )
229
+ ```
230
+
231
+ ### 4.3 OpenAI Agents SDK Integration
232
+
233
+ **Guardrail Chaining:**
234
+ ```python
235
+ from clawmoat.integrations.openai_agents import ClawMoatGuardrail
236
+ from agentmesh.integrations.openai_agents import AgentMeshGuardrail
237
+
238
+ agent = Agent(
239
+ input_guardrails=[
240
+ ClawMoatGuardrail(), # Scan before processing
241
+ AgentMeshGuardrail() # Enforce permissions
242
+ ]
243
+ )
244
+ ```
245
+
246
+ ---
247
+
248
+ ## 5. Reference Implementation
249
+
250
+ ### 5.1 CrewAI Security Stack
251
+
252
+ **Complete defense-in-depth for CrewAI:**
253
+
254
+ ```python
255
+ from crewai import Agent, Task, Crew
256
+ from clawmoat.integrations.crewai import ClawMoatMiddleware
257
+ from agentmesh.integrations.crewai import AgentMeshMiddleware
258
+
259
+ # Layer 1: ClawMoat scanning
260
+ security_scanner = ClawMoatMiddleware(
261
+ scan_input=True,
262
+ scan_output=True,
263
+ scan_tools=True,
264
+ block_on_threat=True
265
+ )
266
+
267
+ # Layer 2: Agent-OS governance
268
+ governance = AgentMeshMiddleware(
269
+ policy_path="security-policy.yml",
270
+ approval_required=["file_write", "network_request"],
271
+ trust_threshold=0.7
272
+ )
273
+
274
+ # Layer 3: Framework guards
275
+ research_agent = Agent(
276
+ role="Security Researcher",
277
+ goal="Research threats safely",
278
+ tools=[web_search, file_read], # Restricted toolset
279
+ max_rpm=10, # Rate limiting
280
+ memory=False # No persistent memory
281
+ )
282
+
283
+ # Combined protection
284
+ crew = Crew(
285
+ agents=[research_agent],
286
+ middleware=[security_scanner, governance],
287
+ verbose=True
288
+ )
289
+
290
+ result = crew.kickoff(task="Research AI security best practices")
291
+ ```
292
+
293
+ ### 5.2 Policy Configuration
294
+
295
+ **Unified security policy:**
296
+
297
+ ```yaml
298
+ # security-policy.yml
299
+ metadata:
300
+ name: "AI Agent Security Policy"
301
+ version: "1.0"
302
+ scope: ["research", "analysis"]
303
+
304
+ clawmoat:
305
+ input_scanning:
306
+ prompt_injection: { enabled: true, threshold: 0.8, action: "block" }
307
+ jailbreak: { enabled: true, action: "log_and_continue" }
308
+ excessive_agency: { enabled: true, threshold: 0.9, action: "block" }
309
+
310
+ output_scanning:
311
+ pii: { enabled: true, types: ["ssn", "credit_card"], action: "redact" }
312
+ secrets: { enabled: true, action: "block" }
313
+
314
+ tool_monitoring:
315
+ file_access: { log: true, forbidden_paths: ["~/.ssh", "/etc/passwd"] }
316
+ network: { log: true, blocked_domains: ["malware.com"] }
317
+
318
+ agentmesh:
319
+ roles:
320
+ research_agent:
321
+ tools: ["web_search", "file_read"]
322
+ rate_limits: { web_search: "10/min", file_read: "50/min" }
323
+ approval: { required: false, escalate_on_block: true }
324
+
325
+ admin_agent:
326
+ tools: ["web_search", "file_read", "file_write", "shell_exec"]
327
+ rate_limits: { shell_exec: "5/hour" }
328
+ approval: { required: true, approvers: ["security_team"] }
329
+
330
+ trust_system:
331
+ enabled: true
332
+ min_score: 0.6
333
+ factors:
334
+ - name: "compliance"
335
+ weight: 0.4
336
+ decay: "7d"
337
+ - name: "tool_success"
338
+ weight: 0.3
339
+ decay: "3d"
340
+ - name: "user_feedback"
341
+ weight: 0.3
342
+ decay: "30d"
343
+ ```
344
+
345
+ ---
346
+
347
+ ## 6. Benefits and Trade-offs
348
+
349
+ ### 6.1 Benefits
350
+
351
+ **Security:**
352
+ - **Comprehensive Coverage:** Multiple detection mechanisms prevent single-point failures
353
+ - **Threat Intelligence Sharing:** Cross-layer visibility improves detection accuracy
354
+ - **Zero-Day Protection:** Behavioral analysis catches novel attack patterns
355
+ - **Compliance Ready:** Built-in audit trails and reporting
356
+
357
+ **Developer Experience:**
358
+ - **Framework Agnostic:** Works with any agent framework
359
+ - **Gradual Adoption:** Can implement layers incrementally
360
+ - **Policy as Code:** Version-controlled, reviewable security configuration
361
+ - **Minimal Performance Impact:** Optimized scanning and caching
362
+
363
+ **Operations:**
364
+ - **Unified Dashboards:** Single pane of glass for security monitoring
365
+ - **Automated Response:** Policy violations trigger automatic remediation
366
+ - **Forensics:** Complete audit trail for incident investigation
367
+ - **Scaling:** Distributed architecture supports large agent deployments
368
+
369
+ ### 6.2 Trade-offs
370
+
371
+ **Performance:**
372
+ - **Latency:** Each layer adds processing overhead (~50-100ms total)
373
+ - **Resource Usage:** Scanning and governance require CPU/memory
374
+ - **Throughput:** Rate limiting may reduce peak agent performance
375
+
376
+ **Complexity:**
377
+ - **Configuration:** More moving parts require careful setup
378
+ - **Debugging:** Multi-layer failures harder to diagnose
379
+ - **Updates:** Changes require coordination across components
380
+
381
+ **False Positives:**
382
+ - **Over-blocking:** Conservative policies may impact legitimate use cases
383
+ - **Tuning Required:** Thresholds need adjustment for specific domains
384
+ - **Context Loss:** Cross-layer decisions may lack full context
385
+
386
+ ### 6.3 Mitigation Strategies
387
+
388
+ **Performance:**
389
+ - Asynchronous scanning where possible
390
+ - Caching of policy decisions and threat signatures
391
+ - Optional bypass modes for trusted environments
392
+
393
+ **Complexity:**
394
+ - Unified configuration format reduces mental overhead
395
+ - Comprehensive documentation and examples
396
+ - Automated testing across integration points
397
+
398
+ **False Positives:**
399
+ - ML-based threshold adaptation
400
+ - Human-in-the-loop approval workflows
401
+ - Domain-specific policy templates
402
+
403
+ ---
404
+
405
+ ## 7. Implementation Roadmap
406
+
407
+ ### Phase 1: Foundation (Q2 2026)
408
+ - [ ] Define unified policy schema
409
+ - [ ] Implement ClawMoat → Agent-OS data interchange
410
+ - [ ] Create LangChain reference integration
411
+ - [ ] Basic audit logging and alerting
412
+
413
+ ### Phase 2: Framework Coverage (Q3 2026)
414
+ - [ ] CrewAI middleware implementation
415
+ - [ ] OpenAI Agents SDK guardrails
416
+ - [ ] AutoGen conversation filtering
417
+ - [ ] Cross-platform policy validation
418
+
419
+ ### Phase 3: Advanced Features (Q4 2026)
420
+ - [ ] Behavioral anomaly detection
421
+ - [ ] Automated threat intelligence sharing
422
+ - [ ] ML-driven policy optimization
423
+ - [ ] Enterprise compliance dashboards
424
+
425
+ ### Phase 4: Ecosystem (Q1 2027)
426
+ - [ ] Google ADK integration
427
+ - [ ] PydanticAI type-safe policies
428
+ - [ ] Cloud-native deployment options
429
+ - [ ] Open source community governance
430
+
431
+ ---
432
+
433
+ ## 8. Conclusion
434
+
435
+ AI agents require **defense-in-depth security architecture** to operate safely in production environments. The combination of ClawMoat's reactive threat detection with Agent-OS's proactive governance provides comprehensive protection against the OWASP Agentic Top 10 while maintaining developer productivity.
436
+
437
+ This RFC proposes a practical, standards-based approach that:
438
+ - Works across agent frameworks
439
+ - Provides incremental adoption path
440
+ - Balances security with usability
441
+ - Scales to enterprise deployments
442
+
443
+ **Next Steps:**
444
+ 1. Community review and feedback on this RFC
445
+ 2. Proof-of-concept implementation with CrewAI
446
+ 3. Policy schema standardization with industry stakeholders
447
+ 4. Performance benchmarking and optimization
448
+
449
+ **Contributing:**
450
+ This RFC is open for community input. Please provide feedback on:
451
+ - Integration complexity and developer experience
452
+ - Policy schema completeness and flexibility
453
+ - Performance requirements and optimization strategies
454
+ - Additional framework support priorities
455
+
456
+ ---
457
+
458
+ **References:**
459
+ - [OWASP Agentic Top 10](https://owasp.org/www-project-agentic-security/)
460
+ - [ClawMoat Documentation](https://github.com/darfaz/clawmoat)
461
+ - [Agent-OS Architecture](https://github.com/imran-siddique/agentmesh)
462
+ - [Oasis Security Research](https://www.oasis.security/blog/openclaw-vulnerability)
463
+
464
+ **Contact:**
465
+ - ClawMoat Team: [security@clawmoat.com]
466
+ - Agent-OS Team: [governance@agent-os.dev]
467
+ - RFC Discussion: [GitHub Issues](https://github.com/darfaz/clawmoat/issues/20)