Plug in your own evaluators — regex, Sigma, CEL, SQL, ML, or LLM-as-judge — and protect your AI agents in minutes. Bring-your-own-security.
OpenClaw gives your AI agent access to messaging platforms, shell commands, file systems, and APIs — but ships with no security layer. This project fills that gap.
Already running OpenClaw? Drop this in. No fork, no migration — it's a plugin. Have your own detection models? Plug them in as ONNX models or LLM-as-judge policies.
Want to reuse your SOC's Sigma rules? Point them at OpenClaw events. Need custom policies? Write them in regex, CEL, SQL, or Python — your choice.
The platform doesn't tell you what's dangerous. You tell it — through whatever combination of evaluators fits your threat model.
Two deployment modes — a lightweight plugin for tool-level blocking, or a full reverse proxy for blocking at every stage.
| Stage | Shim plugin | API proxy | What it covers |
|---|---|---|---|
| tool.before | Block, redact, detect | Block, redact, detect | Tool calls — dangerous commands, policy violations |
| message.before | Detect and alert | Block, redact, detect | Inbound prompts — injection, PII, abuse |
| tool.after | Detect and alert | Block, redact, detect | Tool output — secret leakage, sensitive data |
Shim plugin: Only tool.before can block (sequential hook). The other stages are fire-and-forget — they evaluate and alert but cannot prevent the event.
API proxy: Sits between OpenClaw and the Anthropic API. Can block at every stage, including rewriting streamed responses.
Cheapest evaluators run first. Short-circuits on block — if regex catches it, ML never wakes up.
From microsecond pattern matching to semantic AI judgement. Use what you need, skip what you don't.
Microsecond-fast secret scanning and command detection. Ships with rules for AWS keys, GitHub tokens, PII, and dangerous commands.
Industry-standard YAML detection rules mapped to OpenClaw events. Reuse rules from the entire Sigma ecosystem.
Common Expression Language for conditional policies. Full access to every event field with boolean logic.
In-memory SQLite for temporal queries — rate limiting, burst detection, session-level anomaly scoring.
ONNX Runtime models for prompt injection, toxicity, and custom classifiers. Runs locally — no API calls, no data leaves your machine.
Use Claude as a judge for nuanced decisions that rules can't capture. Policy-driven, structured verdicts.
Every evaluator type is extensible — bring your own rules, models, and policies. See the GitHub repo for configuration examples and how to write custom evaluators.
Choose the level of control you need — a lightweight plugin or a full reverse proxy.
A TypeScript plugin registers OpenClaw hooks and forwards events to the Python evaluation server over HTTP. Blocks on tool.before, detects on all stages.
A reverse proxy sits between OpenClaw and the Anthropic API. Intercepts every request and response. Blocks at every stage — including rewriting streamed responses.
API Proxy mode: OpenClaw → Proxy (:9920) → Anthropic API. The proxy evaluates at all three stages inline, with full blocking capability. No plugin installation needed — it's transparent to OpenClaw.
git clone && cd openclaw-security-platform && pip install -e .
openclaw plugins install --link ./shim
openclaw plugins enable openclaw-security
openclaw config set plugins.allow '["openclaw-security"]'
openclaw-security serve -c openclaw-security.yaml
openclaw gateway --force — hooks are live.
git clone && cd openclaw-security-platform && pip install -e .
openclaw-security setup-openclaw
Registers a secured provider, copies your API key, and sets it as default.
openclaw-security serve --mode proxy -c openclaw-security.yaml
All Anthropic API traffic now flows through the security proxy.
To revert proxy mode: openclaw-security revert-openclaw
Every evaluation streams live to a built-in dashboard at /dashboard — no extra setup required.
Every block, redact, detect, and allow appears instantly via Server-Sent Events. Filter by action, stage, or free-text search. Click any event for full evaluator details.
Running totals for every action type. In-memory history of the last 10,000 events with latency tracking per evaluation. All available via API at /dashboard/api/.
{
"stage": "tool.before",
"session_id": "sess-abc",
"tool_name": "exec",
"tool_args": { "command": "rm -rf /" }
}
→ { "action": "block",
"blocked": true,
"reasons": ["Recursive delete root"] }
{
"status": "ok",
"mode": "server",
"evaluators": 4
}
Returns evaluator count and server status. Use for monitoring and liveness probes.