DashClaw
Fail-closed human approval layer that freezes high-risk AI agent actions at the hook seam and records a signed audit trail.
Buy DashClaw if your agents keep working after you walk away. It freezes a high-risk call at the hook seam and holds it until a human answers — from a phone, Discord, or Telegram — then writes the verdict into a signed, replayable ledger, which is exactly what a compliance reviewer asks to see. Compare honestly: LangSmith and Langfuse log behaviour post-hoc and cannot stop a bad deploy, and native Claude Code and Codex prompts need you at the keyboard. The catch is that you run it, author the
Verified 4d ago · liveness 78/100 · cite: rightaichoice.com/tools/dashclaw
- DevOps and platform teams running unattended Claude Code, Codex, or Hermes agents
- Teams that need high-risk calls like production deploys frozen until a human approves from a phone
- Compliance and risk owners who need signed, replayable per-action evidence with explicit signature status
- Engineering orgs that prefer MIT-licensed self-hosted governance on their own infrastructure with no seat limit
- Hobbyists building low-risk chatbots where an approval inbox is pure overhead
- Teams that will not author or maintain risk policies — the guard engine needs rules to enforce
- Agent paths with no enforcing seam and no willingness to adopt runGoverned or MCP — there the decision is only cooperatively honored
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip DashClaw if your agents only ever run interactively while you watch, or if you want a fully managed service and will not self-host, author policies, or wire an SDK or hook into the agent path.
Hosted Indie and Team both carry a monthly governed-action ceiling; going past it is the main way a $49/mo Indie tier stops matching the bill you expected.
Self-hosting is free forever under MIT with no seat limit and no action ceiling, which beats metered governance tools that charge per action at any volume. Hosted Indie at $49/mo billed monthly suits a solo builder or small team that would rather not run Postgres and Redis themselves; hosted Team at $199/mo billed monthly adds seats, headroom, and a 90-day retention window. Both are far cheaper than standing up an enterprise approval workflow, and both are more than a team already paying for
In short
DashClaw — Fail-closed human approval layer that freezes high-risk AI agent actions at the hook seam and records a signed audit trail. Best for DevOps and platform teams running unattended Claude Code, Codex, or Hermes agents, Teams that need high-risk calls like production deploys frozen until a human approves from a phone, Compliance and risk owners who need signed, replayable per-action evidence with explicit signature status. Free to start; paid plans from $49/mo.
What people actually say about DashClaw — is it worth it?
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
32 mentions across 3 sources (Hacker News, YouTube, Lemmy) · researched Aug 13, 2026.
Average across the 3 sources that answered — each source counts once, not each post.
- +Intercepts before execution, so dangerous actions can't slip through
- +Signed, replayable audit trail with Ed25519 for accountability
- +One-command install for Claude Code, Codex, and Hermes
- +Shadow mode lets you test policies without blocking anything
- +Calibration controller tunes false-block rate to your target
- −Extremely early stage with almost zero independent community feedback
- −No real-world reliability data for long unattended sessions
- −Policy tuning requires nuance to avoid false-blocks or real breaks
- −Docs and examples are mentioned but not widely shared or reviewed
- −YouTube coverage focuses on OpenClaw dashboard, not the approval layer
- • Self-hosting requires your own server, storage, and ops time
- • Potential ingestion costs for audit logs if you use cloud storage
- • Customizing policies and integrating with non-MCP agents may need developer time
Viability Score
How well maintained and how widely used is DashClaw? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →Key Features
- PreToolUse hook interception that halts supported tool calls in Claude Code, Codex, and Hermes before they execute
- Enforcing interception at the OpenClaw gateway plugin
- Risk decision lattice: allow, warn, allow_contained, require_approval, block
- Max-join policy resolution with absolute block and fail-closed exit-2 on block
- Human approval from the dashboard, phone, Discord, or Telegram
- Replayable decision ledger with explicit identity and payload-signature status (Ed25519, JWKS)
- Protocol 1 execution claim binding one fresh, exact-act, principal-bound attempt
- runGoverned bounded invocation helper for Node.js and Python with confirmed execution claim
- MCP server exposing 17 governance tools and 3 resources to MCP clients
- Distribution-free calibration controller tuned to a false-block bound, starting in shadow mode
- Enforcement liveness probe driving a synthetic held action through an installed hook seam
- Predicted vs actual comparison of agent-stated confidence against terminal outcomes over 30 days
- allow_contained staging of file work in an isolated worktree or Postgres staging for later promotion or discard
- One-command install via npx dashclaw up, which provisions Postgres, mints a key, and wires the first hook
- Governs Bash, Edit, Write, MultiEdit, Agent/Task, and mcp__* tools in Claude Code
About DashClaw
DashClaw is a self-hosted, MIT-licensed governance runtime for AI coding agents that need a human in the loop after you close the laptop. It installs a PreToolUse hook in Claude Code, Codex, and Hermes, a gateway plugin at OpenClaw, and bounded dashclaw_invoke calls that halt a supported tool call before it runs. The guard engine risk-scores each call against your policies and sorts it into a fixed lattice: allow, warn, allow_contained, require_approval, or block. The join is max, and a block is absolute — fail-closed, exit-2 on block. Anything landing on require_approval is held and routed to an Approvals inbox you can clear from a dashboard, your phone, Discord, or Telegram. Protocol 1 consumes approval or plan authority in the same database statement that claims one fresh, exact-act, principal-bound attempt, so duplicate authority inside DashClaw is prevented. Every decision and outcome lands in a replayable ledger with explicit identity and payload-signature status (Ed25519, JWKS). Three things keep the checkpoint tolerable. A distribution-free calibration controller tunes the interruption threshold from your approve/deny stream with a stated false-block bound, runs in shadow first, then loosens as well as tightens — one deny snaps the band back. An enforcement liveness probe drives a synthetic held action through an installed seam and reports whether it executed; stale reports never render green. And recorded actions can carry the agent's stated confidence, which the ledger compares against agent-reported terminal outcomes over 30 days. Install is one command: npx dashclaw up provisions Postgres, mints your key, and wires your first hook. No account stands between you and your first caught action. This is deliberately not observability — LangSmith and Langfuse record what an agent did after it ran, while an enforcing DashClaw seam evaluates policy before the supported call executes. It is built for DevOps and platform teams running unattended coding agents,
Behind the Verdict
The interesting thing about DashClaw is what it refuses to claim. The vendor publishes a table splitting mechanical halts from cooperatively honored decisions, and that honesty is the reason we would trust it in an audit conversation. Claude Code, Codex, and Hermes lifecycle hooks stop the action in the seam; bare SDK, MCP, and chat-based callers consult guard and honor the result on their word. If your risky path lives on the cooperative side, DashClaw records intentions, it does not enforce them — budget for that gap. We would reach for this the moment an agent runs unattended. Deploys, force-pushes, schema drops, anything with an irreversible blast radius. The approval hop is the product: a held action sits until someone resolves it minutes or hours later, and the ledger timestamps the whole arc — held at +0.3s, approved via Discord at +41s, outcome reported at +47s. Calibration is what keeps it from getting uninstalled. A governance layer you disable after a week of false blocks is worse than none, so the controller learns from your approve/deny stream, starts in shadow, and ratchets back fast on a single deny. We like that more than a static allowlist you babysit. The liveness probe is the sleeper feature: it answers whether the hook you installed actually held a synthetic test action, which is the question you cannot answer from logs alone. When to pass. If your agents only run while you watch, native permission prompts are free and already there. If all you need is tracing, LangSmith or Langfuse is cheaper and less work. And if nobody on the team will author or maintain policies, you are buying an inbox nobody clears. Where it bites: you own the infrastructure on self-host, Postgres included, and optional integrations each need their own configuration.
Researching DashClaw? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas DashClaw actually fits — and what changes day-one when you adopt it.
Installs the runtime with npx dashclaw up, wires the PreToolUse hook, and writes a production_deploy_gate policy before leaving for the day.
Outcome: A force-push and a production deploy are both frozen at the hook seam; the deploy lands in the Approvals inbox, gets approved from a phone in under a minute, and both decisions appear in the ledger with signature status.
Runs agents in shadow mode first to see what the calibration controller would have held, then tightens to an enforcing seam with require_approval on any action scoring above the tuned threshold.
Outcome: Every governed action carries an explicit identity and payload-signature status, giving reviewers a replayable record instead of a per-session allowlist export.
Routes the risky edits through allow_contained so the work is staged in an isolated worktree rather than applied.
Outcome: The change is reviewed and either promoted or discarded later, and the staging decision plus its eventual outcome are recorded in the same ledger as the held actions.
Use Cases
- Freezing a coding agent's attempt to drop a production database table and holding it for a human verdict.
- Requiring approval before Claude Code triggers a production deploy, resolved from a phone hours later.
- Producing a signed, replayable audit trail of every governed action for a regulated-industry review.
- Calibrating interruption frequency from your approve/deny stream so routine actions stop asking.
- Staging risky file edits with allow_contained in an isolated worktree for later promotion or discard.
- Submitting a long unattended run as a plan and reviewing one card with per-step verdicts.
- Scanning agent prompts for injection attacks and blocking malicious inputs.
- Recording unverified assumptions behind an action so the eventual outcome can be read in context.
Models Under the Hood
as of 2026-10-17
Limitations
- Enforcement strength varies by integration: hooks in Claude Code, Codex, and Hermes plus the OpenClaw gateway provide an enforcing seam, while the Node and Python SDKs, the MCP server, and REST honour decisions cooperatively.
- Protocol-1 prevents duplicate authority inside DashClaw and does not make an external effect exactly once.
- The free tier means self-hosting the core guard, policy, approval, and decision-ledger stack, its Postgres, and your retention policy, and optional integrations still need their own configuration.
- Exact governed-action ceilings for the hosted plans are published only in the docs, not the pricing page.
as of 2026-10-04
Verification history
We have re-verified DashClaw 9 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-checked, vendor evidence unchanged
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Showing the 6 most recent of 9 verification passes.
Free to cite with attribution — this page re-verifies continuously.
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Plans compared
For each published DashClaw tier: who it actually fits, and what it adds vs. the previous tier. Cross-reference the cost calculator above for projected annual outlay.
Self-hosted
$0/mo
Ideal for
Platform or DevOps teams with their own infrastructure who want governance without a per-seat or per-action bill and are comfortable running Postgres themselves.
What this tier adds
Free entry point under MIT — core guard, policy, approval, and decision-ledger capabilities, no account, no telemetry, no seat limit and no action ceiling, on your own infrastructure and retention policy.
Hosted Indie
$49/mo
Ideal for
A solo builder or small team of up to two approvers who would rather not run infrastructure but still want the same governance stack.
What this tier adds
Adds managed hosting with 2 seats, a monthly governed-action ceiling, 30-day retention, and email support versus the self-hosted free tier.
Hosted Team
$199/mo
Ideal for
A larger team that has outgrown two seats, needs faster answers, and wants a deeper audit retention window for reviews.
What this tier adds
Adds 10 seats, a higher governed-action ceiling, 90-day retention instead of 30, org-scoped rate limits, and priority support over hosted Indie.
Where the pricing makes sense
The company stage and team size where DashClaw's pricing actually pencils out — and where peers do it cheaper.
Self-hosting is free forever under MIT with no seat limit and no action ceiling, which beats metered governance tools that charge per action at any volume. Hosted Indie at $49/mo billed monthly suits a solo builder or small team that would rather not run Postgres and Redis themselves; hosted Team at $199/mo billed monthly adds seats, headroom, and a 90-day retention window. Both are far cheaper than standing up an enterprise approval workflow, and both are more than a team already paying for
Setup time & first value
How long it actually takes to get something useful out of DashClaw — broken out by persona, not the marketing-page minute.
Self-hosted: minutes to a first caught action, since npx dashclaw up installs the runtime, provisions Postgres, mints your key, and wires your first hook with no account required. Getting an agent on the dashboard in a governed flow is documented as a 5-minute path. Budget longer for the parts the command cannot do — authoring policies, wiring the hook or runGoverned into your agent path, and
Switching to or from DashClaw
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From native Claude Code or Codex permission prompts: add the DashClaw hook and move allowlists into a shared policy service so approvals survive past the session.
- →From LangSmith or Langfuse: keep the logging stack for post-hoc traces and add DashClaw at the hook seam, since it decides before the call rather than after.
- →From a manual deploy gate: replace the human-in-the-loop Slack ping with a require_approval policy and resolve from the Approvals inbox instead.
- →From a hosted DashClaw workspace to self-hosted: export the full decision history and configuration as one file and re-import it into the instance you control.
- ↗To LangSmith or Langfuse: you keep the trace history but lose pre-execution blocking, since those tools record after the call runs.
- ↗To native permission prompts: simpler setup, but you are back to per-session, per-machine allowlists and no shared export or tuned interruption rate.
- ↗To a general workflow automation tool: you can gate an API call, but you lose the decision lattice, the signed ledger, and the protocol-1 execution claim.
- ↗To hand-rolled policy checks in your own agent code: possible, but you would rebuild risk scoring, approval routing, retention, and audit signing.
Integrations
Resources & Guides
Tutorials & Learning
YouTube returned 6 videos for “DashClaw”, and we withheld 6: 6 could not be judged, because “DashClaw” is a single word that other videos use for other things. We are showing none, because we could not prove any of them are about DashClaw.
Official links
Featured Head-to-Head Comparisons
Dashclaw vs Audioeye
AudioEye and DashClaw serve entirely different domains: AudioEye is a paid compliance platform for web accessibility, while DashClaw is an open-source governance runtime for AI agents. Choose AudioEye if you need ADA/WCAG compliance, VPAT documentation, and legal support for your website; choose DashClaw if you deploy autonomous coding agents (like Claude Code) and need guardrails, audit trails, and human-in-the-loop approval. They are not competitors.
Dashclaw vs Push Security
Choose Push Security if your priority is defending against browser-based attacks (AiTM, ClickFix, session hijacking) and controlling AI data leakage from employee browsers. Choose DashClaw if you need a governance layer for autonomous AI agents (coding agents, LLM integrations) to enforce policies, require human approval, and maintain an audit trail. They solve different problems — browser security vs. agent runtime governance — and are complementary, not competitive.
Dashclaw vs Sublime Security
If you need to govern autonomous coding agents with audit trails and human approval, choose DashClaw (open-source, self-hosted). If you need to protect your enterprise email from sophisticated BEC and phishing attacks with low false positives, choose Sublime Security (paid, integrates with M365/Google Workspace). There is no overlap in problem space.
Popular in AI Governance & Guardrails
Mindgard
Mindgard automates AI red teaming — agent-native reconnaissance, exploit validation, and continuous AI security testing for production AI
Poolside AI
Poolside builds open-weight agentic coding models — Laguna XS 2.1 (33B) and Laguna S 2.1 (118B) — for code that stays inside your security
Olas Network
Co-own autonomous AI agents on-chain: stake OLAS, run agents that trade, hire each other and settle payments.
Frequently Asked Questions
Categories
Used DashClaw? Help shape our editorial sentiment research.