DashClaw: AI Agent Governance Runtime Released

What changed

The release of DashClaw introduces a governance runtime designed to provide oversight and control over AI agent actions. This system acts as an intermediary, intercepting potential tool calls or commands from AI agents before they are executed. Its primary function is to enforce predefined policies, require human approval for sensitive operations, and maintain a verifiable log of all decisions.

DashClaw supports a range of AI agents and integration methods, including hooks for Claude Code, Codex, and Hermes, the OpenClaw gateway, and a dashclaw_invoke command. It also offers cooperative enforcement through bare SDKs, APIs, and MCP integrations, where the agent caller must adhere to the governance verdict.

Key features include:

• Fail-closed interception: Actions are blocked at the execution seam, preventing destructive or expensive operations from running without approval.
• Remote approval: Users can resolve approval requests via a web inbox, CLI, PWA, Telegram, or Discord, even when not actively monitoring.
• Plain-English approvals: Pending actions are presented with clear explanations, highlighting irreversible consequences and potential risks like credential exfiltration.
• Standing grants: Users can create scoped, time-bounded permissions to automate approvals for recurring, low-risk actions.
• Verifiable evidence: Decision records and signed receipts provide an auditable trail of agent actions and resolutions.
• Calibrated interruptions: Approval verdicts tune the frequency of interruptions, aiming to minimize false positives.
• Prompt-injection scanning: Enabled by default, this feature scans for high-confidence system-override patterns to block or warn against malicious prompts.
• Multi-runtime support: Integrates with Claude Code, Codex, Hermes, OpenClaw, MCP, Node and Python SDKs, and REST APIs.
• MIT-licensed self-hosting: The software can be run locally or deployed on custom infrastructure.

DashClaw aims to stop specific risky operations such as rm -rf on working directories, DROP TABLE commands on live databases, git push --force origin main, and attempts to exfiltrate sensitive files like .env containing API keys.

Why it matters for builders

DashClaw addresses a critical gap in the deployment of AI agents, particularly for unattended or long-running sessions. Builders can now deploy agents against real code repositories and infrastructure with a significantly reduced risk of accidental damage or unauthorized actions. The ability to enforce policies and require approvals asynchronously is crucial for maintaining operational security and compliance, especially in team environments or CI/CD pipelines.

This tool empowers developers to grant agents more autonomy without sacrificing control. By providing granular oversight and auditable logs, DashClaw facilitates safer experimentation and production use of powerful AI agents, making them more reliable and trustworthy components of software development workflows.

Practical impact

AI builders can integrate DashClaw into their existing agent workflows by installing it via npx dashclaw up. For unattended sessions, the command npx dashclaw up --yes --no-browser can be used. The system provides a local API endpoint for health checks and diagnostics.

Developers can connect agents by configuring hooks or using SDKs. For example, the runGoverned function in the JavaScript SDK allows developers to wrap agent actions, ensuring they pass through DashClaw's governance layer. This function waits for required approvals, claims an execution attempt under a fresh policy check, invokes the provided callback, and reports the outcome.

For upgrades, it is recommended to deploy the matching server schema and upgrade SDK helpers afterward. Setting DASHCLAW_REQUIRE_EXECUTION_CLAIMS=1 after server upgrades enforces atomic execution claims.

Caveats and source limits

The source material indicates that enforcement is mechanically real only where DashClaw sits in the seam between an agent deciding to call a tool and the tool executing. This includes Claude Code, Codex, and Hermes PreToolUse hooks, the OpenClaw gateway, and dashclaw_invoke. In other integrations (bare SDK, API, MCP callers, desktop chat), governance is cooperative, meaning the caller must honor the verdict.

While DashClaw offers remote approval, the hosted trial requires human interaction due to CAPTCHAs and cannot be run headlessly. The source also notes that a signed receipt verifies its signed contents, not that an external effect occurred. The system's prompt-injection scanning is on by default, but its effectiveness against novel or sophisticated attacks is not detailed. The exact pricing for self-hosting or any potential managed services is not provided in the source material.