Claw Patrol, a security firewall for agents
At Deno we've been using OpenClaw and other agents increasingly for addressing production problems in Deno Deploy - when a PagerDuty alert fires, the agent starts researching the cause and making fixes. In order to do this, the agent needs access to real production systems - postgres, kubernetes, gcp, clickhouse, github, etc. But this is dangerous to say the least - we want destructive actions to be reviewed by other LLMs, approved by humans, and logged appropriately. Claw Patrol terminates TCP connections over WireGuard or Tailscale, then parses application protocols (eg http, postgres,…
Claw Patrol, a security firewall for agents launched on June 9, 2026 with 112 votes, #325 of 22,647 launches that month and more than 95% of that year's launches.
In plain words
Claw Patrol is a security firewall designed for AI agents that need access to production systems like Kubernetes, PostgreSQL, and GCP. It intercepts and monitors TCP connections over WireGuard or Tailscale, parsing application protocols to enforce granular access rules. The tool allows teams to require human approval and LLM review for destructive actions while logging all activity, enabling safer autonomous agent operations in production environments.
written from the facts on this page · September 2026
From the sources
Security firewall for agents. Contribute to denoland/clawpatrol development by creating an account on GitHub.
Claw Patrol sits between your agents and prod, parses their traffic at the wire, and gates each action against rules you write in HCL. For example, you can block destructive SQL, or pause kubectl delete pod until a human approves it before the request reaches Kubernetes. curl -fsSL https://clawpatrol.dev/install.sh | sh From source: make (requires Go and Node.js). rule "k8s-no-secrets" { endpoint = k8s - prod condition = " k8s.resource == 'secrets' " verdict = " deny " reason = " Secret values must not leave the cluster via the agent " } Conditions are CEL expressions over wire-level facts the gateway extracts per protocol: SQL verbs and table names for Postgres / ClickHouse, resource /…from github.com
In the maker’s words, at launch
At Deno we've been using OpenClaw and other agents increasingly for addressing production problems in Deno Deploy - when a PagerDuty alert fires, the agent starts researching the cause and making fixes. In order to do this, the agent needs access to real production systems - postgres, kubernetes, gcp, clickhouse…
Does a similar job
all alternatives →
ClawMetry for OpenClawFeb 2026 · clawmetry.com · ▲191Real-time observability dashboard for OpenClaw AI agents
More ai this month
the category →
Paintings by AI models: programs run through a simulation of oil paint.
AI · 21d ago · stillwet.art
PixVerse R2▲381A real-time world model you can explore and change
AI · 30d ago · world.pixverse.video
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, June 2026
the whole month →
Fundraisly▲1,537AI fundraising agent that finds investors and books meetings
AI · Jun 2026 · fundraisly.com
Homebrew 6.0.0▲1,481Today, I’m proud to announce Homebrew 6.0.0. The most significant changes since 5.1.0 are a new tap trust security mechanism, the new faster, smaller, default internal Homebrew JSON API, sandboxing on Linux, better defaults informed by our user survey, many brew bundle improvements, improved performance and initial support for macOS 27 (Golden Gate). Happy to discuss any questions here!
Dev tools · Jun 2026 · brew.sh
Hi HN! I was super frustrated at apps like tiktok and wechat preventing me from saving or downloading the animated gifs, so I made a little tool to turn a screen recording into a slack-sized emoji. Hope you get some value from this!
Life & fun · Jun 2026 · vorpus.github.io
Search 18 years of Hacker News and chart how any topic, tool, or person trended. Overlay terms to compare their rise and fall across 45M posts and comments.
Life & fun · Jun 2026 · hackernewstrends.com