When your coding agent tries something destructive, DashClaw catches it before it runs.
It freezes the action and asks you first, with one click, from anywhere. A fail-closed approval layer for the long, unattended runs where your agent's native permission prompts cannot help, because they need you at the keyboard.
Installs the runtime, provisions Postgres, mints your key, and wires your first hook. No account on the path to your first caught action.
Rather not deploy yet? The hosted trial lets you see the Approvals inbox in your browser, no install.
Enforced at the hook seam in Claude Code, Codex, and Hermes, and at the OpenClaw gateway. Honored cooperatively by the Node and Python SDKs, the MCP server, and REST.
- agent_id
- deploy-bot
- action_type
- deploy
- declared_goal
- "Ship auth-service v2.1 to production"
- risk_score
- 92 / 100
- matched_policy
- production_deploy_gate
- REQUIRE_APPROVALheld, routed to on-call+0.3s
- approved by wes via Discord+41s
- deploy executed, outcome success+47s
The whole loop, on film · 55 seconds
Sound on. An agent action intercepted, held for a one-click approval, and recorded in the ledger.
Live demo, real demo endpoints
Try a real governance decision
Pick an action, hit Evaluate, and watch DashClaw enforce policy in real time. Every call hits the same governance runtime that ships to your instance.
await claw.guard({
agent_id: 'openai-deployer-1',
action_type: 'deploy',
risk_score: 85,
declared_goal: 'Deploy auth-service v2.1 to production with new session token rotation.',
});Pick an action and click Evaluate. The result will appear here, including the matched policy, the risk score, and what a human approver would see.
Guard decisions are live against the demo deployment. Approval clicks resolve locally so visitors can explore the flow without an account; your own instance routes them to /api/actions/:id/approve.
Native permission prompts protect you at the keyboard. DashClaw protects the runs you walk away from.
Claude Code and Codex already ship permission prompts for the at-keyboard user, for free. DashClaw does not compete with those. It does the job those prompts structurally cannot, because they need you present: it freezes the dangerous call and lets you approve it minutes or hours later, from anywhere.
| Dimension | Native permission prompts | DashClaw |
|---|---|---|
| Who it protects | You, while you watch each prompt | The run you walked away from |
| When you must be present | Every prompt, in real time | Never; approve later, from a phone |
| Policy scope | Per session, per machine allowlist | One policy across every runtime and session |
| Audit trail | None you can export | Signed, replayable ledger (Ed25519, JWKS) |
| Interruption rate | Fixed prompts, no tuning | Calibrated to a target false-block bound |
This is not observability either. LangSmith and Langfuse record what an agent did, after it did it. DashClaw decides what it is allowed to do, before it runs.
The whole product is one loop
Intercept, decide, approve, prove. The hook seam runs it for you in Claude Code, Codex, and Hermes; the SDK, MCP server, and REST run the same four calls when you want explicit control.
const claw = new DashClaw();
// 1. guard: policy decides before anything runs
const g = await claw.guard({
action_type: 'shell',
act: { kind: 'shell', command: 'git push --force origin main' },
});
// 2. createAction: open the decision record
const action = await claw.createAction({
action_type: 'shell',
declared_goal: 'Force-push the rebased branch',
});
// 3. waitForApproval: freeze until a human resolves it
if (g.decision === 'require_approval') {
await claw.waitForApproval(action.action_id);
}
// 4. close the record: one-shot, durable, retry-safe
try {
await run();
await claw.reportActionSuccess(action.action_id, 'Pushed');
} catch (err) {
await claw.reportActionFailure(action.action_id, err.message);
}Intercept
A PreToolUse hook in Claude Code, Codex, or Hermes (plus dashclaw_invoke and the OpenClaw gateway) catches a tool call before it executes.
Decide
The guard engine risk-scores the call against your policies into the lattice allow < warn < require_approval < block. The join is max, and a block is absolute.
Approve
require_approval freezes the action and pages a human, who approves or denies with one click, from the Approvals inbox or a phone. Grants are single-use and bound to the exact action.
Prove
Every decision writes a durable, replayable, signed audit row. A liveness probe keeps proving the governor is still enforcing.
Two things make the checkpoint livable
A governor you disable is worse than none. These two keep it earning its interruptions, and prove it is still awake.
Calibrated interruptions
A distribution-free controller tunes the interruption threshold from your approve and deny stream, with a proven false-block bound. It runs in shadow first, and when active it only ever tightens; loosening always routes through a proposal a human ratifies. Governance earns its interruptions instead of nagging you into turning it off.
Enforcement liveness
Once, the governor stopped enforcing and nothing noticed, because the ledger kept looking healthy. Now a probe drives a synthetic held action through the real hook seam and verdicts by whether it executed, not by reading the ledger. Stale never renders green.
Definitions, theorems, and honest limits are in the governance core theory doc.
It meets your agent where it already runs
One command wires Claude Code, Codex, or Hermes. A plugin covers OpenClaw. The MCP server gives any MCP client the same loop through 15 tools and 3 resources, no SDK and no code changes. Everything else takes the Node or Python SDK.
# No clone required — the CLI downloads the hooks bundle
# from your instance, wires ~/.claude/settings.json, and
# defaults to observe mode.
npm i -g @dashclaw/cli
dashclaw install claude # prompts for endpoint + API key
dashclaw install claude --trial # hosted signup, paste the key
# Governs Bash, Edit, Write, MultiEdit, Agent/Task, mcp__* tools.
# Flip to enforce: set DASHCLAW_HOOK_MODE=enforce in
# ~/.dashclaw/claude-hooks/.envWhere the block is mechanical, and where it is honored
We do not claim universal enforcement. We publish the table.
Mechanical halt
Claude Code, Codex, and Hermes lifecycle hooks (fail-closed, exit-2 on block), the OpenClaw gateway, and dashclaw_invoke. The action is stopped in the seam before it runs. The agent cannot proceed past a block.
Honored and recorded
Bare SDK, MCP, and chat-based callers consult guard and honor the decision cooperatively. Every call is still recorded, a block is never downgraded in the ledger, and any gap between decision and behavior is visible evidence, not silence. SDK callers can attach the actual command or request, so the server classifies risk from evidence instead of trusting the declaration.
The full per-surface table lives in the enforcement boundary doc.
What developers use DashClaw for
Three patterns that come up in every production agent stack.
Stop runaway deployments
One approval before production, full audit trail after.
await claw.guard({
agent_id: 'deploy-bot',
action_type: 'deploy',
risk_score: 92,
declared_goal: 'Ship auth-service v2.1 to prod',
});Matched the production_deploy policy, paused the action, routed to the on-call engineer, recorded the approval.
Every governed action also lands in the signed decision ledger, ready to audit and export without a separate pipeline.
One primary surface, and the switches around it
The Approvals inbox is the front door. Everything else reads from the same ledger the loop writes.
Approvals inbox
The one primary human surface: what your agent just tried, what is frozen and waiting on you, two buttons per item. Resolve from a browser, the CLI, a phone, Telegram, or Discord.
Decisions ledger
Every governed action, replayable: declared goal, risk composition, matched policies, the approver, and the terminal outcome. Signed rows, exportable.
Policies
A small set of safety switches plus calibration review. The default pack is catastrophe-only; anything that loosens enforcement is a proposal you ratify with one click.
Calibrated interruption
Set a target false-interruption rate; the controller holds it with a distribution-free bound, learned from your approve and deny verdicts. Shadow first, tighten-only when active.
Enforcement liveness
A probe drives a synthetic held action through the real hook seam and verdicts by whether it executed, never by reading the ledger. A healthy ledger can hide a dead hook; a silent probe never renders green.
dashclaw doctor
Diagnoses the instance and the machine: database, config, auth, deployment, SDK reachability, stale installs. Report-only by default.
Put an approval layer in front of your unattended runs.
For the developer who kicks off a long run and cannot watch every tool call.