A runtime middleware that replaces OpenClaw's trust-by-default model with capability-scoped permissions per agent per task
OpenClaw agents have unrestricted system access by design. A viral HN critique comparing this to MS-DOS (307 points, 331 comments) argues that wrappers and sandboxes cannot fix the fundamental architecture. SecurityScorecard confirms 42,900 exposed instances with 63% vulnerable to RCE. Existing solutions either wrap OpenClaw without changing its internal trust model (NemoClaw, ClawPatrol) or require full migration to a different platform (IronClaw, ZeroClaw). This middleware intercepts every agent-to-system call at the runtime level and requires explicit capability grants before execution, changing from 'allow everything' to 'deny by default' without requiring users to abandon their existing OpenClaw setup.
Demand Breakdown
Social Proof 2 sources
Gap Assessment
5 tools exist (NemoClaw, ClawPatrol, IronClaw, ZeroClaw, KiloClaw) but gaps remain: Still trust-by-default within the sandbox boundary. Doesn't change OpenClaw's internal permission model. Requires NVIDIA hardware ecosystem.; Only intercepts at the gateway boundary. Internal agent-to-system calls bypass it. Depends on Enkrypt AI cloud API for semantic analysis..
Features4 agent-ready prompts
Competitive LandscapeFREE
| Product | Does | Missing |
|---|---|---|
| NemoClaw | Wraps OpenClaw with kernel-level sandboxing via OpenShell and a YAML policy engine for access controls | Still trust-by-default within the sandbox boundary. Doesn't change OpenClaw's internal permission model. Requires NVIDIA hardware ecosystem. |
| ClawPatrol | Six gateway hooks that block dangerous tool calls and filter compromised messages at the gateway level | Only intercepts at the gateway boundary. Internal agent-to-system calls bypass it. Depends on Enkrypt AI cloud API for semantic analysis. |
| IronClaw | Rust reimplementation with WASM capability-based sandbox per tool, AES-256-GCM encryption, zero telemetry. 11.5K GitHub stars. | Requires full migration from OpenClaw. Incompatible with ClawHub skills ecosystem. Fewer integrations (no WhatsApp, limited channels). |
| ZeroClaw | Full Rust rewrite with 99% smaller footprint (3-5MB), strict sandboxing, 30K GitHub stars | Requires full migration. Cannot reuse existing OpenClaw configs, skills, or memory files. Smaller ecosystem. |
| KiloClaw | Managed hosting with PASTA threat model security assessment, zero cross-tenant vulnerabilities confirmed | Proprietary managed service. Vendor lock-in. You lose self-hosting control and data sovereignty. |
Sign in to unlock full access.