Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
| Date | Stars |
|---|---|
| 2026-07-31 | 963 |
| 2026-08-01 | 964 |
| 2026-08-06 | 964 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
35.0
growth rate 0.00%/day
# clawpatrol
The security firewall for agents.
Claw Patrol sits between your agents and prod, parses their traffic
at the wire, and gates each action against rules you write in HCL.
For example, you can block destructive SQL, or pause `kubectl delete pod`
until a human approves it before the request reaches Kubernetes.
For the full overview see [clawpatrol.dev](https://clawpatrol.dev).
## Install
```
curl -fsSL https://clawpatrol.dev/install.sh | sh
```
From source: `make` (requires Go and Node.js).
## A rule
A real rule from our own production config:
```hcl
rule "k8s-no-secrets" {
endpoint = k8s-prod
condition = "k8s.resource == 'secrets'"
verdict = "deny"
reason = "Secret values must not leave the cluster via the agent"
}
```
Conditions are CEL expressions over wire-level facts the gateway
extracts per protocol: SQL verbs and table names for Postgres /
ClickHouse, resource / verb / namespace for Kubernetes, method /
path / headers / body for HTTP. The full set of facts lives in the
[config reference](https://clawpatrol.dev/docs/config-reference).
## Run
Three deployment shapes; pick whichever fits.
```
clawpatrol gateway config.hcl # run the proxy itself
clawpatrol join <gateway-url> # join a gateway
clawpatrol run claude # wrap one agent's process tree
```
`clawpatrol run` opens a per-process tunnel on Linux (via netns) or
macOS (via NetworkExtension); only the wrapped command's traffic
goes through the gateway. `clawpatrol join` brings up a WireGuard
tunnel that routes the whole host. `clawpatrol gateway` is the
proxy: a single binary that loads your HCL config and accepts
clients tunneling in via WireGuard or Tailscale.
## Configure
[clawpatrol.dev/docs/getting-started](https://clawpatrol.dev/docs/getting-started)
walks through a first config end-to-end.
[clawpatrol.dev/docs/config-reference](https://clawpatrol.dev/docs/config-reference)
is the auto-generated field reference. See
[`gateway.example.hcl`](examples/gateway.example.hcl) for an
annotated starting template.
## License
MIT. See [LICENSE.md](LICENSE.md).
Excerpt of 2,101 characters
Read on GitHub
134
121
99
71
65
29
17
4
3
2
2
1
1
Yusuke Hayashi · @haya-inc · Japan
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:352a99e3558129e8, llm:Repository description: 'Security firewall for agents' (denoland/clawpatrol).