Runtime security for OpenClaw agents
Clawmont inspects every prompt, tool call, and model output at four boundaries inside your OpenClaw gateway. It catches prompt injection, credential leaks, and unsafe commands before they run, with zero false positives. Your API keys never leave your machine.
Works with Claude GPT-5 Gemini Llama Gemma & any LLM via OpenRouter
$ curl -fsSL https://api.clawmont.com/install.sh | bash -s -- --config <your-id>The onboarding wizard hands you this one-liner with your config baked in. Rails are active from your first message.
Detection is best-effort defense-in-depth, not a guarantee: strong on known attacks, lower on novel ones, and honest about the gap. See the measured rates and full red-team methodology on the security page.
Clawmont is a local-first security layer for OpenClaw AI agents. It inspects four conversation boundaries (user input, tool calls, tool results, and model output) and catches prompt injection, credential leaks, and unsafe tool calls before they execute, with zero false positives. Your API keys never leave your machine.
The problem
The moment an agent can read your files, call your APIs, and run commands on your behalf, each of those powers becomes a way in. Every tool you wire up is a path an attacker can try to walk.
Someone hides instructions in a PR comment, a fetched web page, or a file. Your agent reads them and follows, without ever telling you.
An agent that can read your code can also read ~/.aws/credentials. A single "paste these keys here" request is enough.
rm -rf. curl | bash. DROP TABLE. Without a guardrail, every tool your agent has is a destructive command away.
How it works
Clawmont is an in-process plugin that inspects every boundary in the agent loop before the model acts. Each port is bypass-tested independently. Full methodology and measured rates on the security page.
Every prompt is scanned for injection attacks, hidden instructions, and credential patterns before it ever reaches the model.
When the model tries to run a tool, Clawmont checks the command against path restrictions, dangerous-command blocklists, and schema validators.
Data coming back from tools is checked for indirect prompt injection and exfiltration patterns before it re-enters the conversation.
The model's final response is checked for leaked secrets, covert channels, and injection artifacts before it reaches you.
Provider API keys are validated on-device. Never proxied, never logged, never shipped to a Clawmont server.
Every prompt, tool call, and redaction is hash-chained to disk. Any edit breaks the chain and Clawmont flags it on the next boot.
See it in action
Pick an attack below. Watch the plugin catch these known patterns locally, before they ever reach the model.
No banned phrase appears — this is scored on intent, so dropping or swapping a word doesn't get it past the layer.
This preview runs a deterministic subset of the engine: the full 4-port layer, stateful tracking, the full bypass-tested corpus, and the cost-gated LLM-judge run locally once installed. Some attacks get through here; that's honest security, not theater. Exact measured rates and methodology at the security page and security.clawmont.com.
Want the deep, developer-grade version with every port broken out? Open the full playground →
No security tool catches everything. Read our honest limitations in the Security Disclaimer.
Why not a free classifier?
Free tools like Meta PromptGuard chase a higher raw detection score, but raise false alarms on legitimate prompts. Clawmont catches prompt injection with zero false positives: no alert fatigue, no phantom threats to chase. It runs locally across all four ports, priced once for setup, not as an enterprise seat tax. See the honest side-by-side on the security page.
Who needs this most
The teams that get burned usually aren't careless. They just never tested for the attack that hit them. Three setups where the risk is real:
Running it unattended
You want to wake up to finished work, not a leaked key or a wrecked repo because something it read told it to. Clawmont keeps an eye on what it does while you can't.
Plugged into your inbox
Now one sketchy email or DM could quietly tell it to forward your data or delete a file. Clawmont checks what comes in first, so you're not trusting every message blindly.
Access to everything
That's a lot to hand something that runs on its own. Clawmont is the safety net between "it works" and "it pasted my API key into a public PR."
Runs on OpenClaw
Clawmont runs as a plugin inside OpenClaw, the local-first AI agent runtime: any model, any tool, all on your machine. Start with a persona (Developer, Trader, SRE, or Researcher) for a role-tuned setup with curated MCP tools, or add Clawmont Security on its own.
Pricing
Two things, priced separately. A persona is the one-time setup: a role-tuned OpenClaw install with curated tools. Clawmont Security is the four-port security layer, a monthly subscription, bundled or standalone. The security product is what protects you.
Step 1 Set up with a persona one-time
Single persona
Pick one of four personas.
Pay now, choose your persona in onboarding.
Apex · all-access
Every persona, plus every future one.
One-time payment. All future personas included.
Step 2 Add Clawmont Security the security product
Clawmont Security · Guardrails
The four-port security layer, active on your machine. $9.99/mo when you add it to any persona or Apex at checkout, $19.99/mo standalone. Both start with a 7-day free trial: $0 due today, run it against your agent's real traffic, cancel in the trial and pay nothing.
7-day free trial, $0 due today. Cancel anytime. Pro-rata refund for the unused period. Add-on stays unchecked until you choose it.
The four-port security layer is active from your first message, no configuration required. Want the background first? Start with the AI agent security glossary, the security methodology, or the blog.
We use analytics cookies (PostHog: usage stats, heatmaps and session replay with all typed input masked) and first-party usage analytics to improve the site. Our basic traffic stats (Cloudflare) are cookieless. Privacy policy