Dashclaw

Dashclaw is a fail-closed approval layer for unattended AI coding agents. It sits between your agent and the actions it wants to take, intercepting potentially destructive operations before they execute. When something risky comes through, it freezes the action, notifies you, and waits for approval. If you are running agents that can delete files, push code, or modify production infrastructure without you sitting at the keyboard, this is the governance layer that makes sure a human signs off on the dangerous operations before they happen. The product describes itself as a runtime that intercepts, decides, approves, and proves, with each step designed to ensure that autonomous agents cannot silently cause damage.

The system works through a four-step loop. First, PreToolUse hooks in Claude Code, Codex, Hermes, and OpenClaw gateway catch tool calls before execution. Second, a risk-scoring engine evaluates those calls against your policies and returns one of five decisions: allow, warn, allow but contained in an isolated environment like a worktree, require approval, or block outright. The risk scoring is itemized with base scores and modifiers visible, so you can see exactly how the decision was calculated and whether the server and client assessments agree. Third, for anything requiring human sign-off, the action gets frozen and you receive a notification through your approvals inbox, browser, CLI, mobile, Discord, or Telegram. One click approves or denies, and the agent proceeds or halts accordingly. Fourth, every decision gets recorded as a signed, replayable audit row so you have proof of what happened.

The audit trail is a core feature rather than an afterthought. Every decision gets recorded with Ed25519 signatures and JWKS verification, creating an exportable ledger that shows which policies matched, who approved, what the outcome was, and when it happened. For teams dealing with compliance requirements, security reviews, or just wanting to understand what their agents did at two in the morning, this is the paper trail that proves human oversight was in the loop. You can export the full ledger at any time. The system also supports multi-step plan approvals where you can review an entire sequence of actions with per-step verdicts and single-use grants, rather than approving each action in isolation without seeing the broader context.

Integration covers the major agent frameworks through native hooks. Dashclaw works with Claude Code, Codex, and Hermes through lifecycle hooks, with OpenAI tools through the OpenClaw gateway, and with LangChain and CrewAI through their respective SDKs. The MCP server exposes seventeen governance tools and three read-only resources for active policies, action history, and instance health. Any MCP-compatible client can connect through this standard interface. The installation is a single npm install or pip install, and the quick start command npx dashclaw up provisions Postgres, generates API keys, and wires hooks without requiring an account upfront. You can run it entirely self-hosted or use the hosted trial to test without setting up infrastructure.

One feature that distinguishes Dashclaw from simpler approval systems is calibrated interruption thresholds. A distribution-free controller learns from your approval and denial patterns with proven false-positive bounds, tightening only and never loosening on its own. This means that as you use the system, it gets better at knowing which actions you will approve and which need scrutiny, reducing the noise over time without ever relaxing vigilance unilaterally. There is also an enforcement liveness probe that runs synthetic test actions to verify the governor remains functional, catching the failure mode where an agent continues running but the governance layer has silently stopped working.

The threat model is transparent about limitations. Mechanical enforcement applies only to hook-seam intercepts, and SDK callers honor decisions cooperatively rather than being physically prevented from acting. The hook operates at the agent's privilege level, so tampering is visible but prevented through deployment-level controls like containers, separate OS users, and read-only paths rather than through the software alone. Dashclaw is honest that it is not a security sandbox but a governance layer that assumes cooperative agents and provides visibility plus approval gates for operations that cross risk thresholds.

Dashclaw is aimed at developers running production agents where native permission prompts fall short. The standard Claude Code permission dialog only works if you are sitting at the keyboard. If your agent runs overnight, in a CI pipeline, or across a fleet of machines, you need something that can page you remotely and wait for a response. This fills that gap with asynchronous, mobile-friendly approvals that do not require you to be at the terminal. The codebase is MIT licensed and publicly available on GitHub under ucsandman/DashClaw. Node.js and Python SDKs have full parity across all core governance features, and the REST API allows custom integrations for setups that do not fit the standard plugins. There is no charge to use it, no account required to get started, and the whole thing can run on your own infrastructure with no data leaving your network.