When your coding agent tries something destructive, DashClaw catches it before it runs.
It freezes the action and asks you first, with one click, from anywhere. A fail-closed approval layer for the long, unattended runs where your agent's native permission prompts cannot help, because they need you at the keyboard.
Installs the runtime, provisions Postgres, mints your key, and wires your first hook. No account on the path to your first caught action.
Rather not deploy yet? The hosted trial lets you see the Approvals inbox in your browser, no install.
Enforced at the hook seam in Claude Code, Codex, and Hermes, and at the OpenClaw gateway. Honored cooperatively by the Node and Python SDKs, the MCP server, and REST.
- agent_id
- deploy-bot
- action_type
- deploy
- declared_goal
- "Ship auth-service v2.1 to production"
- risk_score
- 92 / 100
- matched_policy
- production_deploy_gate
- REQUIRE_APPROVALheld, routed to on-call+0.3s
- approved by wes via Discord+41s
- deploy executed, outcome success+47s
The whole loop, on film · 55 seconds
Sound on. An agent action intercepted, held for a one-click approval, and recorded in the ledger.
Live demo, real demo endpoints
Try a real governance decision
Pick an action, hit Evaluate, and watch DashClaw enforce policy in real time. Every call hits the same governance runtime that ships to your instance.
await claw.guard({
agent_id: 'openai-deployer-1',
action_type: 'deploy',
risk_score: 85,
declared_goal: 'Deploy auth-service v2.1 to production with new session token rotation.',
});Pick an action and click Evaluate. The result will appear here, including the matched policy, the risk score, and what a human approver would see.
Guard decisions are live against the demo deployment. Approval clicks resolve locally so visitors can explore the flow without an account; your own instance routes them to /api/actions/:id/approve.
Native permission prompts protect you at the keyboard. DashClaw protects the runs you walk away from.
Claude Code and Codex already ship permission prompts for the at-keyboard user, for free. DashClaw does not compete with those. It does the job those prompts structurally cannot, because they need you present: it freezes the dangerous call and lets you approve it minutes or hours later, from anywhere.
| Dimension | Native permission prompts | DashClaw |
|---|---|---|
| Who it protects | You, while you watch each prompt | The run you walked away from |
| When you must be present | Every prompt, in real time | Never; approve later, from a phone |
| Policy scope | Per session, per machine allowlist | One policy across every runtime and session |
| Audit trail | None you can export | Signed, replayable ledger (Ed25519, JWKS) |
| Interruption rate | Fixed prompts, no tuning | Calibrated to a target false-block bound |
This is not observability either. LangSmith and Langfuse record what an agent did, after it did it. DashClaw decides what it is allowed to do, before it runs.
The whole product is one loop
Intercept, decide, approve, prove. The hook seam runs it for you in Claude Code, Codex, and Hermes; the SDK, MCP server, and REST run the same four calls when you want explicit control.
const claw = new DashClaw();
// 1. guard: policy decides before anything runs
const g = await claw.guard({
action_type: 'shell',
act: { kind: 'shell', command: 'git push --force origin main' },
});
// 2. createAction: open the decision record
const action = await claw.createAction({
action_type: 'shell',
declared_goal: 'Force-push the rebased branch',
});
// 3. waitForApproval: freeze until a human resolves it
if (g.decision === 'require_approval') {
await claw.waitForApproval(action.action_id);
}
// 4. close the record: one-shot, durable, retry-safe
try {
await run();
await claw.reportActionSuccess(action.action_id, 'Pushed');
} catch (err) {
await claw.reportActionFailure(action.action_id, err.message);
}Intercept
A PreToolUse hook in Claude Code, Codex, or Hermes (plus dashclaw_invoke and the OpenClaw gateway) catches a tool call before it executes.
Decide
The guard engine risk-scores the call against your policies into the lattice allow < warn < allow_contained < require_approval < block. The join is max, and a block is absolute.
Approve
require_approval freezes the action and pages a human, who approves or denies with one click, from the Approvals inbox or a phone. Grants are single-use and bound to the exact action. Long runs can submit their whole plan upfront: one review card, per-step verdicts, and each approved step becomes a single-use grant the run draws down without waking you again. Mid-band risk on a file edit can skip the freeze entirely: allow_contained lets the agent keep moving, staged in an isolated worktree, and you promote or discard the diff whenever you get to it.
Prove
Every decision writes a durable, replayable, signed audit row. A liveness probe keeps proving the governor is still enforcing.
Two things make the checkpoint livable
A governor you disable is worse than none. These two keep it earning its interruptions, and prove it is still awake.
Calibrated interruptions
A distribution-free controller tunes the interruption threshold from your approve and deny stream, with a proven false-block bound. It runs in shadow first, then loosens as well as tightens: the things you keep approving stop asking, never further than the riskiest action you approved, and one deny takes the band straight back. Governance earns its interruptions instead of nagging you into turning it off.
Enforcement liveness
Once, the governor stopped enforcing and nothing noticed, because the ledger kept looking healthy. Now a probe drives a synthetic held action through the real hook seam and verdicts by whether it executed, not by reading the ledger. Stale never renders green.
Definitions, theorems, and honest limits are in the governance core theory doc.
It meets your agent where it already runs
One command wires Claude Code, Codex, or Hermes. A plugin covers OpenClaw. The MCP server gives any MCP client the same loop through 17 tools and 3 resources, no SDK and no code changes. Everything else takes the Node or Python SDK.
# No clone required — the CLI downloads the hooks bundle
# from your instance, wires ~/.claude/settings.json, and
# defaults to observe mode.
npm i -g @dashclaw/cli
dashclaw install claude # prompts for endpoint + API key
dashclaw install claude --trial # hosted signup, paste the key
# Governs Bash, Edit, Write, MultiEdit, Agent/Task, mcp__* tools.
# Flip to enforce: set DASHCLAW_HOOK_MODE=enforce in
# ~/.dashclaw/claude-hooks/.envWhere the block is mechanical, and where it is honored
We do not claim universal enforcement. We publish the table.
Mechanical halt
Claude Code, Codex, and Hermes lifecycle hooks (fail-closed, exit-2 on block), the OpenClaw gateway, and dashclaw_invoke. The action is stopped in the seam before it runs.
Honored and recorded
Bare SDK, MCP, and chat-based callers consult guard and honor the decision cooperatively. Every call is still recorded, a block is never downgraded in the ledger, and any gap between decision and behavior is visible evidence, not silence. SDK callers can attach the actual command or request, so the server classifies risk from evidence instead of trusting the declaration.
One more honest line: the hook runs at your agent's own privilege level. It is a seatbelt against accidents, not a cage against intent — tampering with the hook is blocked by policy and loudly visible, but a tamper-proof boundary comes from your deployment (a container, a separate OS user, or a read-only hook path), not from software running inside the agent's reach.
Governance can be narrowed as well as switched off, and that is loud too. DASHCLAW_GOVERNED_CATEGORIES decides which tool categories reach the guard at all, so an excluded category produces no row and its silence looks exactly like a quiet agent. The hook declares what it is not governing, and any gap raises a red Governance scope narrowed signal naming what stopped being watched. Visibility, not enforcement: a client that narrows its own scope can also lie about the declaration, which is why the boundary above still matters.
The full per-surface table and threat model live in the enforcement boundary doc.
What developers use DashClaw for
Three patterns that come up in every production agent stack.
Stop runaway deployments
One approval before production, full audit trail after.
await claw.guard({
agent_id: 'deploy-bot',
action_type: 'deploy',
risk_score: 92,
declared_goal: 'Ship auth-service v2.1 to prod',
});Matched the production_deploy policy, paused the action, routed to the on-call engineer, recorded the approval.
Every governed action also lands in the signed decision ledger, ready to audit and export without a separate pipeline.
One primary surface, and the switches around it
The Approvals inbox is the front door. Everything else reads from the same ledger the loop writes.
Approvals inbox
The one primary human surface: what your agent just tried, what is frozen and waiting on you, and per item — allow, deny, or stop being asked about that exact target — plus whole-plan review cards with per-step approve/deny. Every item leads with a plain-English sentence for what the command actually does and flags what cannot be undone, with the exact command always shown underneath. Resolve from a browser, the CLI, a phone, Telegram, or Discord.
Decisions ledger
Every governed action, replayable: declared goal, risk composition, matched policies, the approver, and the terminal outcome. Signed rows, exportable.
Policies
A small set of safety switches plus calibration review, including caps on what spawned subagents may do. The default pack is catastrophe-only; a gallery of curated packs covers spend, outbound comms, unattended overnight runs, and more, each previewable against your own history before a one-click install. Anything that loosens enforcement is a proposal you ratify with one click, and your own decision engine can plug in too: its verdict joins stricter-wins, and it can never loosen a local result.
Calibrated interruption
Set a target false-interruption rate; the controller holds it with a distribution-free bound, learned from your approve and deny verdicts. Shadow first, then it loosens as well as tightens.
Enforcement liveness
A probe drives a synthetic held action through the real hook seam and verdicts by whether it executed, never by reading the ledger. A healthy ledger can hide a dead hook; a silent probe never renders green.
Pulse
A small always-on-top window that answers one question from across the room: is anything owed? A dim dash when nothing is, the pending count when something waits, and honesty rules that keep a dead pipe from ever rendering as calm. Read-only; opens with one click from the approvals inbox.
dashclaw doctor
Diagnoses the instance and the machine: database, config, auth, deployment, SDK reachability, stale installs. Report-only by default.
Put an approval layer in front of your unattended runs.
For the developer who kicks off a long run and cannot watch every tool call.