Claw Patrol: Agent Security Firewall

Summary

Claw Patrol is an agent security firewall from Deno that sits between agents and production. It parses agent wire traffic and gates each action against HCL rules. 840 stars, MIT license, Go implementation.

Three Deployment Shapes

1. clawpatrol gateway config.hcl — standalone proxy
2. clawpatrol join <gateway-url> — WireGuard tunnel (routes all host traffic)
3. clawpatrol run claude — per-process tunnel using Linux netns / macOS NetworkExtension (only wrapped command’s traffic goes through gateway)

Protocol Support

• SQL verbs and table names for Postgres / ClickHouse
• Resource/verb/namespace for Kubernetes
• Method/path/headers/body for HTTP

Relevance

• Deno (established infrastructure company) entering agent security validates the category
• clawpatrol run wrapping pattern is directly applicable to Hermes agent execution
• HCL rule engine concept could upgrade Hermes tool-guard from allowlist/denylist to protocol-aware rules

References

• GitHub: https://github.com/denoland/clawpatrol
• HN: https://news.ycombinator.com/item?id=48462928