ucsandman/DashClaw

npx dashclaw up  # self-host: provisions Postgres, generates secrets, starts on :3000, wires Claude Code hooks
npm i -g @dashclaw/cli  # CLI inbox; dashclaw install claude|codex wires hooks
npm install dashclaw (Node 18+) or pip install dashclaw (Python 3.7+) for SDKs; npx @dashclaw/mcp-server for the MCP server
Deploy to Vercel + Neon on free tiers for $0

Usage

• •dashclaw install claude wires ~/.claude/settings.json with fail-closed PreToolUse hooks (fresh installs default to enforce; --observe for log-only)
• •Approve/deny from /approvals inbox, CLI (dashclaw approve <id>), /approve mobile PWA, Telegram, or Discord
• •SDK loop: guard() -> waitForApproval() -> reportActionSuccess/Failure; decisions are one-shot and retry-safe (409 on later writes)
• •Connect via MCP: 17 governance tools + 3 read-only resources (dashclaw://policies, history, status); every instance also serves Streamable HTTP MCP at /api/mcp

Key features

• ✓Fail-closed intercept: blocked tool calls never run (hook exit 2 at the seam); decision lattice allow < warn < allow_contained < require_approval < block
• ✓One-click remote approval from any surface with no presence required; pending approvals never auto-resolved
• ✓Tamper-evident, replayable ledger with Ed25519 signed receipts verifiable without an API key (JWKS-published key)
• ✓Calibrated interruptions (distribution-free false-interruption bound), a liveness probe that proves enforcement is still on, and prompt-injection scanning on by default
• ✓Multi-runtime: Claude Code, Codex, Hermes, OpenClaw, MCP, Node/Python SDKs, plain REST (123 routes)

Best for

Solo developers or small teams running long unattended coding-agent sessions (overnight runs, CI agents) who need remote async approval and a tamper-evident audit trail without giving agents unconditional authority.

Caveats

• ⚠Not universal hard enforcement: mechanical only at the hook seam (Claude Code/Codex/Hermes PreToolUse hooks, OpenClaw gateway, dashclaw_invoke); everywhere else (SDK, API, MCP callers, desktop chat) governance is cooperative
• ⚠Not tamper-proof against the agent it governs: hooks run at the agent's privilege level — real isolation is a deployment property (container, separate OS user, or read-only hook path)
• ⚠Very young: first commit February 2026, near-daily releases; API tiered (39 stable, 17 beta, 67 experimental); proven by dogfood, not a battle-tested incumbent
• ⚠Maintained by an AI agent under a human-held charter (blocks are absolute, no self-approval, credentials stay human)