Show HN: Claw Patrol, a security firewall for agents

Jun 9, 2026•rough-sea•View Original

TL;DR Highlight

A firewall that gates agent traffic to prod with HCL rules and human approval.

Who Should Read

Backend or DevOps engineer who gives coding agents DB or Kubernetes access and worries about destructive commands.

Core Mechanics

A proxy between agents and prod
- Claw Patrol sits between your agents and prod.
- It parses their traffic at the wire and checks each action against rules written in HCL.
Block destructive SQL, approve deletes
- It can block destructive SQL.
- It can pause kubectl delete pod until a human approves it.
Rules are CEL conditions
- CEL (Common Expression Language, a small expression language for conditions) checks wire-level facts per protocol.
- Postgres and ClickHouse expose SQL verbs and table names, Kubernetes exposes resource, verb and namespace, and HTTP exposes method, path, headers and body.
A rule has endpoint, condition, verdict, reason
- The example rule k8s-no-secrets denies requests on k8s-prod where k8s.resource is secrets.
- The reason given is that secret values must not leave the cluster via the agent.
Three deployment shapes
- clawpatrol gateway config.hcl runs the proxy itself.
- clawpatrol join <gateway-url> routes the whole host through a WireGuard tunnel.
- clawpatrol run claude wraps one process tree (Linux netns, macOS NetworkExtension).

Community Reactions

Overlaps with Agent Vault but at a different layer
- One commenter saw it as similar to Agent Vault but with content-based deny and approval policies.
- They suggested stacking them: agent → Claw Patrol → Agent Vault → external network.
Action firewall in front, credential broker behind
- The author of agent-vault-proxy said the agent only gets a placeholder and the proxy swaps in the real secret in transit.
- They saw the two tools as complementary.
Why not just a read-only account?
- One commenter asked why add software to block SQL writes when you can give a read-only account.
- They felt this reinvents service accounts and permissions.
Open questions on defaults and operations
- A commenter noted from the docs that it is default-allow with no rules shipped, and asked about a default rule set.
- Others asked about approval timeouts, per-user credential injection and what the agent sees when blocked.

How to Apply

List what your agents can reach
- In 30 minutes today, list the DB, Kubernetes and HTTP endpoints your agents use.
- Write one line per endpoint on what to block (DROP, delete, secrets reads).
Pair it with read-only accounts
- Give read-only DB accounts wherever reads are enough.
- Use Claw Patrol rules only for actions accounts can't express, like kubectl delete.
Wrap one agent with clawpatrol run on staging
- Run clawpatrol run claude so only that process goes through the gateway.
- Add one deny rule like k8s-no-secrets and confirm it blocks.
Write deny rules yourself since it's default-allow
- Per a commenter, it is default-allow with no rules, so nothing is blocked out of the box.
- Start from gateway.example.hcl and add essential deny rules before going to prod.

Try It

copy & run

# Paste into Claude or ChatGPT (drafting Claw Patrol rules)

You are a security engineer designing firewall rules for agents.
For the systems below, make a table of actions to deny and actions that need human approval.
For each, give the condition (SQL verb/table, k8s resource/verb/namespace, HTTP method/path) and the reason.
Format reference: rule "k8s-no-secrets" { endpoint = k8s-prod, condition = "k8s.resource == 'secrets'", verdict = "deny", reason = "..." }

Systems the agent can access: {{system list}}
Agent role: {{agent role}}

Terminology

Wire-level parsingReading the actual content of network traffic, like SQL statements or Kubernetes requests. It's like reading the letter, not just the envelope.

HCLThe configuration language used by Terraform. Here it's the file format for firewall rules.

CELCommon Expression Language, a lightweight language for conditions like "k8s.resource == 'secrets'".

Human-in-the-loopRequiring a person to approve a risky action before it runs.

WireGuardA lightweight, fast VPN tunnel protocol. It carries agent traffic to the gateway here.

Related Resources

Show HN: Claw Patrol, a security firewall for agents

Jun 9, 2026•rough-sea•View Original

TL;DR Highlight

A firewall that gates agent traffic to prod with HCL rules and human approval.

Who Should Read

Backend or DevOps engineer who gives coding agents DB or Kubernetes access and worries about destructive commands.

Core Mechanics

A proxy between agents and prod
- Claw Patrol sits between your agents and prod.
- It parses their traffic at the wire and checks each action against rules written in HCL.
Block destructive SQL, approve deletes
- It can block destructive SQL.
- It can pause kubectl delete pod until a human approves it.
Rules are CEL conditions
- CEL (Common Expression Language, a small expression language for conditions) checks wire-level facts per protocol.
- Postgres and ClickHouse expose SQL verbs and table names, Kubernetes exposes resource, verb and namespace, and HTTP exposes method, path, headers and body.
A rule has endpoint, condition, verdict, reason
- The example rule k8s-no-secrets denies requests on k8s-prod where k8s.resource is secrets.
- The reason given is that secret values must not leave the cluster via the agent.
Three deployment shapes
- clawpatrol gateway config.hcl runs the proxy itself.
- clawpatrol join <gateway-url> routes the whole host through a WireGuard tunnel.
- clawpatrol run claude wraps one process tree (Linux netns, macOS NetworkExtension).

Community Reactions

Overlaps with Agent Vault but at a different layer
- One commenter saw it as similar to Agent Vault but with content-based deny and approval policies.
- They suggested stacking them: agent → Claw Patrol → Agent Vault → external network.
Action firewall in front, credential broker behind
- The author of agent-vault-proxy said the agent only gets a placeholder and the proxy swaps in the real secret in transit.
- They saw the two tools as complementary.
Why not just a read-only account?
- One commenter asked why add software to block SQL writes when you can give a read-only account.
- They felt this reinvents service accounts and permissions.
Open questions on defaults and operations
- A commenter noted from the docs that it is default-allow with no rules shipped, and asked about a default rule set.
- Others asked about approval timeouts, per-user credential injection and what the agent sees when blocked.

How to Apply

List what your agents can reach
- In 30 minutes today, list the DB, Kubernetes and HTTP endpoints your agents use.
- Write one line per endpoint on what to block (DROP, delete, secrets reads).
Pair it with read-only accounts
- Give read-only DB accounts wherever reads are enough.
- Use Claw Patrol rules only for actions accounts can't express, like kubectl delete.
Wrap one agent with clawpatrol run on staging
- Run clawpatrol run claude so only that process goes through the gateway.
- Add one deny rule like k8s-no-secrets and confirm it blocks.
Write deny rules yourself since it's default-allow
- Per a commenter, it is default-allow with no rules, so nothing is blocked out of the box.
- Start from gateway.example.hcl and add essential deny rules before going to prod.

Try It

copy & run

# Paste into Claude or ChatGPT (drafting Claw Patrol rules)

You are a security engineer designing firewall rules for agents.
For the systems below, make a table of actions to deny and actions that need human approval.
For each, give the condition (SQL verb/table, k8s resource/verb/namespace, HTTP method/path) and the reason.
Format reference: rule "k8s-no-secrets" { endpoint = k8s-prod, condition = "k8s.resource == 'secrets'", verdict = "deny", reason = "..." }

Systems the agent can access: {{system list}}
Agent role: {{agent role}}

Terminology

Wire-level parsingReading the actual content of network traffic, like SQL statements or Kubernetes requests. It's like reading the letter, not just the envelope.

HCLThe configuration language used by Terraform. Here it's the file format for firewall rules.

CELCommon Expression Language, a lightweight language for conditions like "k8s.resource == 'secrets'".

Human-in-the-loopRequiring a person to approve a risky action before it runs.

WireGuardA lightweight, fast VPN tunnel protocol. It carries agent traffic to the gateway here.

Show HN: Claw Patrol, a security firewall for agents

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources

Show HN: Claw Patrol, a security firewall for agents

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources