DashClaw plugin
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
- 313 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Intercepts the agent's tool calls and decides whether shell commands and file writes run
- Issues an API key and keeps a decision ledger that all agents connect to
- Connects to Telegram, Discord and a mobile PWA for remote approvals
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/dashclawDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Intercepts the agent's tool calls and decides whether shell commands and file writes run
- Issues an API key and keeps a decision ledger that all agents connect to
- Connects to Telegram, Discord and a mobile PWA for remote approvals
This is third-party code. Review the repository files before installing.
What it does
DashClaw is a plugin with PreToolUse hooks and a standalone server that sit between an agent deciding to call a tool and the call itself. If a call matches a policy (`rm -rf`, `DROP TABLE`, `git push --force` to the main branch, reading `.env` and sending it out), it is frozen and the request goes to an approvals inbox where you allow or deny it. You can approve in the browser or the CLI. Remote requests reach a mobile PWA, Telegram and Discord. Each card starts with one sentence about what the command really does, flags irreversible actions and warns about files with secrets. An "allow, don't ask again" button creates a scoped standing grant that can be revoked. Claude Code, Codex and Hermes hooks cancel a blocked call before it runs. The OpenClaw gateway and `dashclaw_invoke` stop it too, while bare SDK, REST and ordinary MCP integrations are cooperative and depend on the caller honoring the result. Every decision goes to a ledger with an Ed25519 signature.
Who it is for. For a developer or small team that runs a coding agent unattended for hours and wants to keep the decision on dangerous actions.
Good fit when
- An agent works on a repo overnight and `git push --force` or deleting a directory must wait for your approval
- You step away from the computer while the agent keeps working and now and then asks for permission
- A team wants one shared policy for Claude Code, Codex, Hermes and OpenClaw
- You want a decision ledger with how confident the agent was, so overconfident mistakes show up
- You want prompt-injection defence: DashClaw blocks clear attempts to override system instructions
Not a fit when
- You need tracing and model quality evaluation: DashClaw only decides what may run
- You need protection from an agent with the same privileges: the hook runs at the agent's privilege level, and real isolation comes from a container or a separate OS user
- You need a solution proven at scale: the project started in February 2026 and so far only the author tests it in daily work
Example request
Before the overnight task, wire up DashClaw and show me which commands the policy blocks todayLimitations
Hard stopping works only where a mechanism sits: Claude Code, Codex and Hermes hooks, the OpenClaw gateway and `dashclaw_invoke`. Other paths only evaluate and record the verdict. The hook runs with the agent's own privileges, so it catches mistakes and makes tampering visible but does not replace isolation. The first run needs Node.js 20 or newer and Postgres (Docker or embedded). Observe mode only logs and shows a banner that nothing is blocked. The project is maintained by an AI agent under a charter held by the owner.
How to disable. In Claude Code run `/plugin uninstall dashclaw@dashclaw`. Remove the hooks the CLI wrote to `~/.claude/settings.json` by hand. To have hooks only record verdicts and block nothing, set `DASHCLAW_HOOK_MODE=observe`. The local instance stops with the `npx dashclaw up` process.
FAQ
How do I install DashClaw in Claude Code?
Inside Claude Code run `/plugin marketplace add ucsandman/DashClaw` and `/plugin install dashclaw@dashclaw`. The plugin brings an MCP server, the dashclaw-governance skill and hooks. Another path is `npm i -g @dashclaw/cli` and `dashclaw install claude`.
What does `npx dashclaw up` do?
One command provisions Postgres (Docker or embedded), generates secrets, mints the API key, applies migrations, starts the app on port 3000 and offers to wire Claude Code hooks. No account is needed for the first caught action.
Which Claude Code calls does it check?
The PreToolUse hook fires on Bash, sub-agent spawns and the Edit, Write and MultiEdit file tools. Every MCP tool call is checked too. A fresh install starts in enforce mode, and the default rule pack holds irreversible actions.
How does DashClaw differ from Claude Code's own permission prompts?
Local prompts serve the person at the keyboard. DashClaw targets unattended work: remote approval, shared policy across agents, a signed ledger and interruption rates tuned to your verdicts.
Where is the data stored?
The instance runs on your side, locally or on your own hosting, under the MIT license. A hosted trial is there for a first look, and its workspace can be moved to your instance with `dashclaw import`. Secrets and API keys are not copied over.
Discussion
No questions or reviews yet.
Related
PluginsA plugin that holds dangerous tool calls in Claude Code for a human's confirmation and, optionally, a signed receipt.
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
A CLI with policies that intercepts dangerous AI agent commands like rm -rf, force push or reading .env before they run
A Claude Code hook that rates Bash command risk with rules and Haiku, asking for approval only on risky commands
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| DashClaw (this entry) | no | 313 | |
| EMILIA Guard: action confirmation for Claude Code | yes | 601 | stops dangerous calls in Claude Code and waits for a human, with no shared server for several agents or mobile approvals |
| Trail of Bits Claude Code Config | no | 2,143 | a set of settings and recommendations with no approval server of its own |
README in short
The author shows real caught actions and a sample loop: the agent asks, the policy holds, a human decides. A table compares agent integrations by how hard they block, and a separate section lists what DashClaw does not do.