PRIVATE BETA · FOR SELF-HOSTED OPENCLAW

Your agent has root.Contain it.

A proxy in front of OpenClaw that checks every message, tool call and skill before your agent acts.

Join the private betaTry the demo console →
INTERCEPT LOG · SAMPLEARMED
CRITblocked WebSocket origin spoof → gateway:18789
HIGHquarantined skill “What Would Elon Do?” (curl .env)
AGENTOpenClawCONTAINED
RCE PAYLOAD
PROMPT INJECTION
MALICIOUS SKILL
TOKEN EXFIL
The threat model

Autonomy is the attack surface.

Three published OpenClaw CVEs. The gateway hardener checks for each.

Read more

OpenClaw gets your terminal, filesystem and API keys. That access is what makes it useful, and it is what an attacker inherits when one layer fails. Scores are from the public CVE records.

9.4

Unauthenticated access

Admin endpoints trust 127.0.0.1. Behind a bad proxy, that's everyone.

CVE-2025-49596
8.8

1-click RCE

An unvalidated gatewayUrl leaks the auth token to a remote WebSocket.

CVE-2026-25253
8.8

Docker sandbox escape

PATH manipulation lets a sandboxed skill run commands on the host.

CVE-2026-24763

230 malicious ClawHub skills reported in one week. The #1-ranked one sent the user's .env to an attacker.

The perimeter

Eight checks. No code changes.

IN

WhatsApp · Telegram · skills

PROXY

ClawShield · 8 checks

OUT

OpenClaw gateway :18789

Point your channels at the proxy with one env var. Every decision streams to the console.

  1. 01

    Credential Vault

    Keys are swapped for tokens at the proxy. The model never sees them.

  2. 02

    Prompt Firewall

    Strips hijack instructions from WhatsApp, Telegram and skill output.

  3. 03

    Skill Scanner

    Checks ClawHub packages before install, statically and by behaviour.

  4. 04

    Gateway Hardener

    Pins WebSocket origins. Drops the localhost-is-trusted assumption.

  5. 05

    Command Gatekeeper

    Shell and file calls need a policy match. PATH tricks get denied.

  6. 06

    DLP Engine

    Scans outbound tool calls for secrets and PII before they leave.

  7. 07

    Memory Defense

    Integrity-checks long-term memory so a poisoned note can't stick.

  8. 08

    Runtime Monitor

    Flags burst tool calls, new egress hosts and privilege jumps.

8

Checks per request

40,000+

Exposed instances reported

230

Bad skills in one week

0

Code changes needed

Private beta

Put a perimeter around your agent.

One email when the beta opens. Nothing else.