Clawvisor CLI
Clawvisor is a gateway between agent and APIs: the agent declares a task, a human approves scope, the gateway injects keys.
- 286 ★ on the repository
- Last commit
Broad access
Why this level
- The gateway stores Gmail, GitHub, Slack and other service keys and acts on your behalf.
- An agent on the same host bypasses the gateway, and LLM intent checks guarantee nothing.
Install
- Works in
Manual install
curl -fsSL https://raw.githubusercontent.com/clawvisor/clawvisor/main/scripts/install.sh | shThe first command of the Self-host section: downloads the daemon binary and starts a setup wizard. Read the script before running. No-install option: sign up at clawvisor.com.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The gateway stores Gmail, GitHub, Slack and other service keys and acts on your behalf.
- An agent on the same host bypasses the gateway, and LLM intent checks guarantee nothing.
This is third-party code. Review the repository files before installing.
What it does
Clawvisor keeps credentials itself, and the agent never sees them. The agent describes a task, for example triaging an inbox: reading mail is fine, sending only on request. The user approves the scope once, the gateway injects keys, runs requests and logs them. Actions outside the scope go to a separate approval, and some operations can be blocked outright. The `clawvisor-server` daemon connects through `connect-agent` to Claude Code, which gets a skill, and to Claude Desktop over MCP. There is a dashboard, a terminal interface and an `/mcp` entry with tools such as `create_task` and `gateway_request`.
Who it is for. People who want an agent to use Gmail, calendar, GitHub and Slack while keeping the decision over each type of action.
Good fit when
- An agent triages the inbox, and sending mail must be approved by hand.
- You want a log of every agent request to external APIs.
- Tokens cannot be handed to the agent but work with services is needed.
- Several agents must reach the same services with different rights.
Not a fit when
- The agent and Clawvisor share a host: the agent can then read the database or environment and bypass the gateway.
- It would be the only safeguard for sensitive data: the authors call the project experimental.
- The request targets a service outside the supported list.
Example request
Triage my mail for today: reading is allowed, sending is not. Create a task in Clawvisor and show which requests went to Gmail.Limitations
The authors warn: the project is experimental, not independently security-audited, and intent checks rely on an LLM that guarantees nothing. Run the agent in a separate environment or it will bypass the gateway through the database or environment. The README install is a `curl ... | sh` script, so read it before running. The license is reported as NOASSERTION; read the terms in the repository.
How to disable. Disconnect the agent with the `clawvisor-server` management command, delete the `~/.claude/skills/clawvisor` skill and the `CLAWVISOR_URL` and `CLAWVISOR_AGENT_TOKEN` variables from `~/.claude/settings.json`. Stop the daemon and clear `~/.clawvisor/`.
FAQ
How do I connect Claude Code?
Run `clawvisor-server connect-agent claude-code`: it installs the skill and environment variables. For Claude Desktop use `connect-agent claude-desktop`, which configures MCP.
Is there a hosted option?
Yes, a hosted version runs at clawvisor.com with no installation. For self-hosting there is an install script, Docker and a source build with Go and Node.
What does the agent see instead of keys?
It gets an agent token and calls the gateway with a task description. Clawvisor injects the real service keys when it executes each request.
Which services are supported?
The list is in the Supported Services section of the README: Gmail, calendar, Drive, GitHub, Slack and others. Some integrations connect through MCP definitions.
What happens for an action outside the approved scope?
The request goes to the user for one-off approval. Specific actions can be blocked entirely with a restriction.
Discussion
No questions or reviews yet.
Related
CLI toolsVigils sits between an AI agent and its tools: it hides secrets, asks for approval and keeps a tamper-evident log of calls
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A policy gateway for AI agents: it checks tool calls before they run, holds risky ones for approval and writes an audit trail
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
An OpenClaw skill that audits the agent itself: 230 checks, change watching and an A to F grade.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Clawvisor (this card) | no | 286 | ||
| MCP Gateway for GigaChat and YandexGPT | no | API key | 1 | an MCP gateway for Russian LLMs with fallback; Clawvisor gives an agent API access per task with human approval |
| Agentgateway | yes | OAuth | 6,144 | a proxy for agents and MCP servers; Clawvisor adds task approval and key injection |
README in short
The README describes a task-based authorization gateway, daemon install, agent connection, a dashboard, a terminal interface and a security model. A separate section warns about the experimental status.