Straight answers.

They are never sent to Clawmont - not once. Your Anthropic, OpenAI, or any other provider API key is stored locally and used only for direct calls from your machine to your provider. Clawmont never proxies, logs, or transmits your provider keys. Other MCP gateways route your keys through their own servers - we refuse on principle. The only things that ever leave your machine are HMAC-signed, redacted security-alert metadata, and only if you opt into the Guardrails cloud add-on.

No. Clawmont is a security plugin that installs inside OpenClaw. It adds four bypass-tested security checkpoints plus role-based configuration on top of your existing setup - nothing is replaced, nothing is proxied, nothing new has to run. See clawmont.com/security for the full architecture.

A one-time $30 license for any one of the four personas - Developer, Trader, SRE, or Researcher. Each is a role-tuned OpenClaw setup: a curated, version-pinned set of MCP servers, skills, and presets shaped around that role, with provider keys you enter locally that never touch our servers. One payment, no subscription on setup; your license stays active while your account is in good standing. Want the four-pillar security layer on top? Add Clawmont Security (Guardrails) for $9.99/mo.

Apex is the all-access persona - Developer, Trader, SRE, and Researcher merged and deduplicated into one setup, plus every future persona we ship at no extra charge. A one-time purchase. Add Clawmont Security (Guardrails) anytime for $9.99/mo.

It is the four-pillar security layer itself - the product. It inspects every prompt, tool call, tool result, and model output on your machine and is built to block or flag attacks before your agent acts on them. It also delivers what it catches: real-time alerts to Discord / Slack / Telegram / email, a daily security digest, a hosted audit trail with 90-day retention, and a webhook + API for your own tooling. Bundled with a persona or Apex it is $9.99/mo; standalone, with no persona, it is $19.99/mo - the same security layer either way, and the only recurring charge we sell. Every alert is HMAC-signed and redacted of secrets before it leaves your machine; your provider API keys are never involved.

Four checkpoints across the full agent loop: input rail, tool dispatch, tool response, and model output. Each one is independently bypass-tested against the OWASP LLM Top 10 and an extensive red-team corpus. Under the hood, a fast deterministic layer handles known attack shapes and an AI judge reviews ambiguous or novel cases. The full architecture breakdown, methodology, and current detection measurements are on the security page (clawmont.com/security) and at security.clawmont.com.

A standalone MCP gateway is a separate proxy your agent traffic routes through - which means another service to run, and often your provider keys passing through someone else's infrastructure. Clawmont takes the opposite posture: it runs in-process inside OpenClaw as a plugin, so there's no extra hop and no new single point of failure. Strict auth, guard rails on every tool call, `chmod 600` configs, CSP-hardened onboarding, AES-256-GCM for Clawmont-side secrets - and your provider keys never touch our infrastructure. (We don't claim a runtime sandbox - our known limitations are published in the Security Disclaimer.)

Yes, for the security layer. Personas are one-time purchases with no trial: any single persona is $30, and you can upgrade to Apex later for just the $10 price difference. The security subscription is different: Clawmont Security (Guardrails) starts with a 7-day free trial on both rates, $9.99/mo bundled and $19.99/mo standalone. You enter a payment method at checkout but are not charged until the trial ends, and cancelling during the trial costs nothing. Your license stays active as long as your account is in good standing; Clawmont reserves the right to disable licenses for fraud, abuse, or chargeback.

You keep your persona license and your local configuration on disk. Your Clawmont Security (Guardrails) subscription - the security layer, cloud alert delivery, and the hosted audit trail - ends at the close of the billing period. Re-subscribe anytime to switch it back on; cancellation is pro-rata refunded per our refund policy.

No. Your prompts, completions, and provider keys never touch our servers - we don't ingest any of them, we don't relay them, and we don't train on anything. Security alerts are the only thing that travel to the cloud (only if Guardrails is enabled), and they're HMAC-signed and redacted before leaving your machine.

No. Every claim on this site is anchored to a reproducible source: the OWASP LLM Top 10, an extensive red-team corpus, and the plugin's Vitest suite. Raw measurements are published at security.clawmont.com, including the attacks we cannot yet block. We'd rather ship fewer claims than fake them.

We're a team of security engineers and red-teamers who got tired of watching AI agents ship with broad tool access and no guardrails. Clawmont is what we built to close that gap - the plugin, the API, and this site, source-available and held to an aggressive adversarial regression suite that re-runs on every change. No VC money and no growth-hacking team behind it - just practitioners focused on one thing: making autonomous AI safe enough to actually trust.

Any OpenClaw instance - macOS, Linux, and Windows. After checkout, use the token-aware command from the setup wizard: `curl … | bash -s -- --config <your-token>` on macOS / Linux, or `$env:CLAWMONT_CONFIG='<your-token>'; irm https://api.clawmont.com/install.ps1 | iex` in native PowerShell. Windows also supports Git Bash and WSL2 - see `clawmont.com/docs/windows-install` for the testing matrix and known caveats. The plugin is a pure TypeScript package with minimal runtime dependencies (only `@clack/prompts` for interactive installs), keeping the supply-chain surface trivial to audit.

Not today - Clawmont runs inside OpenClaw only. It is an in-process plugin for the OpenClaw gateway, not a universal proxy, and we would rather say that plainly than claim coverage we do not have. If you use Claude Code or Cursor directly, enable their native sandboxing and look at the broader tool landscape in our blog guide to local AI agent security tools. If you run your agents through OpenClaw, Clawmont covers all four trust boundaries of that loop.

No - Clawmont is source-available under the Business Source License 1.1 (BUSL-1.1), which is not an OSI-approved open-source license. The source is public and auditable, and the license converts to Apache 2.0 in 2028. We use "source-available" deliberately and would rather be precise than borrow the open-source label.

Agentic security is the discipline of securing AI systems that act - call tools, execute code, browse, write files - rather than just generate text. The threat model spans four boundaries: what goes into the model (prompt injection), what the model asks tools to do, what tools return (indirect injection), and what the model outputs (credential leakage, exfiltration). Clawmont implements runtime detection at all four; the full vocabulary lives in our glossary at clawmont.com/glossary.