clawsec

What problem does it solve?

Many autonomous AI agents make outbound network requests that can accidentally leak secrets, expose sensitive files, or carry injected commands; ClawSec provides transparent, real-time visibility and automatic detection so you can see and stop those risks without changing agent code or workflows.

Core Features & Use Cases

• Transparent HTTP/HTTPS proxy that inspects both request and response payloads and supports optional TLS MITM via a locally generated CA for full plaintext analysis.
• Pattern-based threat detection for API keys, private key material, sensitive file paths, command injection, reverse shells, and SSH lateral movement with deduplication and structured JSONL logging.
• Operational tooling & deployment including a Docker Compose option, a PID-managed CLI (start/stop/status/threats), and an integrated test suite to validate detection and resilience.
• Use case: Route a containerised agent through the proxy to detect and block accidental exfiltration of API keys or execution of shell payloads delivered over HTTP.

Quick Start

Install the cryptography dependency and start the monitor in the foreground to inspect traffic on localhost:8888.