When your coding agent tries something destructive, DashClaw catches it before it runs.
It freezes the action and asks you first, with one click, from anywhere. A fail-closed approval layer for the long, unattended runs where your agent's native permission prompts cannot help, because they need you at the keyboard.
Installs the runtime, provisions Postgres, mints your key, and wires your first hook. No account on the path to your first caught action.
Governing Claude Code? Install the plugin Start a hosted trial
Rather not deploy yet? The hosted trial lets you see the Approvals inbox in your browser, no install.
Enforced at the hook seam in Claude Code, Codex, and Hermes, and at the OpenClaw gateway. Honored cooperatively by the Node and Python SDKs, the MCP server, and REST.
MIT licensedSelf hostedNo account to your first blockYour data stays on your infrastructure
The whole loop, on film · 55 seconds
Sound on. An agent action intercepted, held for a one-click approval, and recorded in the ledger.
Live demo, real demo endpoints
Try a real governance decision
Pick an action, hit Evaluate, and watch DashClaw enforce policy in real time. Every call hits the same governance runtime that ships to your instance.
Guard decisions are live against the demo deployment. Approval clicks resolve locally so visitors can explore the flow without an account; your own instance routes them to /api/actions/:id/approve.
Native permission prompts protect you at the keyboard. DashClaw protects the runs you walk away from.
Claude Code and Codex already ship permission prompts for the at-keyboard user, for free. DashClaw does not compete with those. It does the job those prompts structurally cannot, because they need you present: it freezes the dangerous call and lets you approve it minutes or hours later, from anywhere.
This is not observability either. LangSmith and Langfuse record what an agent did, after it did it. DashClaw decides what it is allowed to do, before it runs.
The whole product is one loop
Intercept, decide, approve, prove. The hook seam runs it for you in Claude Code, Codex, and Hermes; the SDK, MCP server, and REST run the same four calls when you want explicit control.
Intercept
A PreToolUse hook in Claude Code, Codex, or Hermes (plus dashclaw_invoke and the OpenClaw gateway) catches a tool call before it executes.
Decide
The guard engine risk-scores the call against your policies into the lattice allow < warn < allow_contained < require_approval < block. The join is max, and a block is absolute.
Approve
require_approval freezes the action and pages a human, who approves or denies with one click, from the Approvals inbox or a phone. Grants are single-use and bound to the exact action. Long runs can submit their whole plan upfront: one review card, per-step verdicts, and each approved step becomes a single-use grant the run draws down without waking you again. Mid-band risk on a file edit can skip the freeze entirely: allow_contained lets the agent keep moving, staged in an isolated worktree, and you promote or discard the diff whenever you get to it.
Prove
Every decision writes a durable, replayable, signed audit row. A liveness probe keeps proving the governor is still enforcing.
Two things make the checkpoint livable
A governor you disable is worse than none. These two keep it earning its interruptions, and prove it is still awake.
Calibrated interruptions
A distribution-free controller tunes the interruption threshold from your approve and deny stream, with a proven false-block bound. It runs in shadow first, then loosens as well as tightens: the things you keep approving stop asking, never further than the riskiest action you approved, and one deny takes the band straight back. Governance earns its interruptions instead of nagging you into turning it off.
Enforcement liveness
Once, the governor stopped enforcing and nothing noticed, because the ledger kept looking healthy. Now a probe drives a synthetic held action through the real hook seam and verdicts by whether it executed, not by reading the ledger. Stale never renders green.
Definitions, theorems, and honest limits are in the governance core theory doc.
It meets your agent where it already runs
One command wires Claude Code, Codex, or Hermes. A plugin covers OpenClaw. The MCP server gives any MCP client the same loop through 17 tools and 3 resources, no SDK and no code changes. Everything else takes the Node or Python SDK.
Where the block is mechanical, and where it is honored
We do not claim universal enforcement. We publish the table.
Mechanical halt
Claude Code, Codex, and Hermes lifecycle hooks (fail-closed, exit-2 on block), the OpenClaw gateway, and dashclaw_invoke. The action is stopped in the seam before it runs.
Honored and recorded
Bare SDK, MCP, and chat-based callers consult guard and honor the decision cooperatively. Every call is still recorded, a block is never downgraded in the ledger, and any gap between decision and behavior is visible evidence, not silence. SDK callers can attach the actual command or request, so the server classifies risk from evidence instead of trusting the declaration.
One more honest line: the hook runs at your agent's own privilege level. It is a seatbelt against accidents, not a cage against intent — tampering with the hook is blocked by policy and loudly visible, but a tamper-proof boundary comes from your deployment (a container, a separate OS user, or a read-only hook path), not from software running inside the agent's reach.
Governance can be narrowed as well as switched off, and that is loud too. DASHCLAW_GOVERNED_CATEGORIES decides which tool categories reach the guard at all, so an excluded category produces no row and its silence looks exactly like a quiet agent. The hook declares what it is not governing, and any gap raises a red Governance scope narrowed signal naming what stopped being watched. Visibility, not enforcement: a client that narrows its own scope can also lie about the declaration, which is why the boundary above still matters.
The full per-surface table and threat model live in the enforcement boundary doc.
What developers use DashClaw for
Three patterns that come up in every production agent stack.
Every governed action also lands in the signed decision ledger, ready to audit and export without a separate pipeline.
One primary surface, and the switches around it
The Approvals inbox is the front door. Everything else reads from the same ledger the loop writes.
Put an approval layer in front of your unattended runs.
For the developer who kicks off a long run and cannot watch every tool call.