runta-dev/clawshell

Registry 信息

项目简介

Clawshell 是为 OpenClaw/Hermes-agent 设计的运行时安全层，为个人身份信息（PII）和敏感凭证提供关键保护。基于 Rust 构建，它作为安全防护装置，防止 AI 代理操作过程中意外泄露机密信息。

要点

• 运行时 PII 与凭证保护
• AI 代理工作流的安全防护装置
• 基于 Rust 构建，性能可靠
• 与 Hermes-agent 无缝集成
• 防止意外机密泄露

使用场景

• 保护 AI 代理与敏感数据的交互安全
• 在自动化工作流中保护凭证
• 运行时监控 PII 泄露
• 增强 OpenClaw 部署的安全性
• 在多代理系统中保护机密信息

README 摘要

# ClawShell 🛡️  > **Powered by Runta. The essential safety harness for OpenClaw/Hermes Agent's PII & Sensitive Credentials.** [](LICENSE) [](https://github.com/clawshell/clawshell/actions) [](https://www.npmjs.com/package/@clawshell/clawshell) [](https://crates.io/crates/clawshell) ## 📖 Introduction **ClawShell** is a security-privileged process for the **OpenClaw/Hermes Agent** ecosystem. It sits between OpenClaw/Hermes Agent and upstream LLM API providers (OpenAI, Anthropic, OpenRouter), performing virtual-to-real API key mapping and DLP (Data Loss Prevention) scanning on request and response bodies. It can also expose an Email read endpoint with sender allowlist/denylist filtering. OpenClaw/Hermes Agent never holds real API keys, only virtual keys that ClawShell swaps for real ones before forwarding requests upstream. Real keys are stored in a privileged config directory (`/etc/clawshell`) protected by Unix file system permissions. ## Key Features ### 1. API Token Secure Binding ClawShell maps virtual API keys to real provider keys so that OpenClaw/Hermes Agent never has direct access to real credentials. - **Key Isolation**: Real API keys are stored in `/etc/clawshell/clawshell.toml`, readable only by the `clawshell` system user. OpenClaw/Hermes Agent holds only virtual keys. - **Multi-Provider Support**: Maps keys to OpenAI or Anthropic, injecting the correct authentication header format (`Authorizati

话题