DashClaw

DashClaw

With a supported enforcement integration, when your AI agent (OpenClaw, Hermes, Claude Code, Codex) tries something destructive or expensive, DashClaw catches it before it runs and asks you first, even when you are not at the keyboard. Every decision lands in a signed ledger.

Run agents unattended without giving them unconditional authority.

What you get  · 
What it stops  · 
The loop  · 
What it is not  · 
Quick start  · 
Connect an agent

npx dashclaw up      # no account, first caught action in minutes

AI agents: setting DashClaw up for your user? Run npx dashclaw up --yes --no-browser — the plain command prompts and will hang a non-interactive shell. The API key lands in ~/.dashclaw/instance.json; verify with GET http://localhost:3000/api/health and npx dashclaw doctor. Full runbook: dashclaw.io/llms.txt. Do not attempt the hosted trial headlessly — its captcha needs your human.

A hook-integrated agent tries a destructive tool call. DashClaw freezes it before it runs, routes it to the Approvals inbox, and writes a replayable decision record when you resolve it.

This illustration shows the approval workflow. Explore the current interactive demo for the supported product surfaces.

What you get

A 10-second capability scan before the dense sections:

• Fail-closed intercept at the execution seam. The Claude Code, Codex, and Hermes hooks, the OpenClaw gateway, and dashclaw_invoke can cancel a blocked call before execution. Bare SDK, API, and ordinary MCP integrations are cooperative: the caller must honor the verdict.
• One-click remote approval. Resolve from the /approvals inbox, the CLI, a phone PWA, Telegram, or Discord. No presence required.
• Approvals in plain English. Every pending item leads with one sentence for what the command actually does, flags what cannot be undone, and warns when a file holds credentials. When no rule reads the command with confidence, it says so instead of guessing. The exact command is always shown underneath.
• "Allow, don't ask again." Preview the target, lease, and matching pending items before creating a scoped standing grant. The UI resolves eligible items through the normal approval path and reports partial failures. High-risk, ungrantable, expired, or self-approved sources are rejected. Standing grants remain visible and revocable in the inbox.
• Verifiable recorded evidence. Decision records, Ed25519 receipts where issued, and signed exports support later review. A receipt verifies its signed contents, not that an external effect happened. Authenticated identity and action-payload signing are shown separately.
• Calibrated interruptions. Your approve/deny verdicts tune how often it interrupts, with a proven cap on false interruptions instead of a guessed threshold.
• Autonomy is a number, not a prompt. How much your agent ships without a human looking is set by policy thresholds and checks, not by wording. Each action carries the agent's stated confidence — declared on the guard call, before the act, so it is a prediction and not a postscript — and the ledger scores it against the reported outcome, so an overconfident agent shows up as a number on /decisions, not as a surprise.
• Enforcement liveness. A