What is enclawed and how does it relate to OpenClaw?

enclawed is the security-hardened fork of OpenClaw, the upstream personal-AI / agentic-AI gateway. It ships the entire upstream OpenClaw extension catalog (channels, model providers, tool plugins) but loads every plugin through a hardened admission gate, a hash-chained audit log, a two-layer egress allowlist, a DLP scanner, and a structural prompt shield by default. The MIT-licensed enclawed-oss is the open-source foundation; enclawed-enclaved is the proprietary commercial layer, with cryptography bound to the host's FIPS 140-3 validated module, on top.

Is enclawed a drop-in replacement for OpenClaw?

Yes. The CLI command, the config keys, the plugin layout, and the upstream extension catalog are all preserved. Migrating from OpenClaw to enclawed-oss is a substitution, not a rewrite. Your existing agents, channels, model providers, and tools come along, with capability declaration, signed manifests, hash-chained audit, two-layer egress allowlisting, DLP scanning, and a structural prompt shield wrapped around them.

Why should I switch from OpenClaw to enclawed?

We back this empirically with three nested layers of evidence: a 1600-sample template-baseline run (100 legit + 100 adversarial per failure mode F1-F4 across two real cloud channels), an 80,000-sample stress extension at n=10,000 per cell, and a ten-LLM cross-model generalisation run that re-runs the same task with adversarial content authored by ten different production LLMs (Gemini 2.5 Flash, Groq GPT-OSS-120B, Groq Llama 3.3 70B, Groq Llama 4 Scout 17B, OpenRouter Llama 3.1 70B, and Ollama Gemma2 9B / Llama 3.1 8B / Llama 3.2 3B / Mistral 7B / Qwen 2.5 7B). Across all three layers upstream OpenClaw scores recall = 0.000 on every F1-F4 cell of every confusion matrix; enclawed-oss and enclawed-enclaved both score precision = recall = F1 = accuracy = 1.000 on the in-distribution baseline and stress test, and recall = 1.000 on every cooperating LLM in the cross-LLM run. The framework additionally emits the full NIST OSCAL 1.2.2 FedRAMP-submission model set — Component Definition, Assessment Results, System Security Plan starter, and Plan of Action and Milestones — schema-validated, Ed25519-signed, and importable directly into a deployer's GRC tooling without manual rekey. Every OpenClaw plugin is materially safer when loaded through enclawed-oss because it inherits a deny-by-default policy, tamper-evident audit, allowlisted egress, structural prompt-injection sanitization, and runtime biconditional admission for any extension that needs the network. None of those properties hold on upstream OpenClaw without operator opt-in. The MIT license, the unchanged surface, and the zero-cost availability mean there is no business case for staying on upstream OpenClaw once a comparable hardened fork exists.

Is enclawed safe for OpenClaw agents wired to real-world devices (robots, 3D printers, vehicle controllers)?

OpenClaw's permissive defaults are no longer defensible the moment an agent gets connected to an actuator. Prompt injection, hallucinated tool calls, third-party module compromise, and unbounded egress stop being academic the moment the loop reaches a physical device. enclawed-oss closes that gap before the agent reaches the actuator and is the recommended choice for any OpenClaw-driven device deployment.

Does enclawed-enclaved need its own FIPS 140-3 certificate?

No. enclawed implements no cryptographic primitives of its own — every cryptographic operation uses FIPS-approved algorithms (AES-256-GCM, SHA-256, Ed25519, scrypt) executed by the host's FIPS 140-3 validated cryptographic module, such as the OpenSSL FIPS provider. Deployed in approved mode on a validated host, enclawed's cryptography inherits that module's validation; there is no separate enclawed module to submit or certify, and none is required. This is the standard, accepted posture for application-layer software under FedRAMP, CMMC, and HIPAA.

What is the relationship between enclawed-oss and enclawed-enclaved?

enclawed-oss is an MIT-licensed hard fork of OpenClaw with security features. enclawed-enclaved is the proprietary layer on top, adding cryptography bound to the host's FIPS 140-3 validated module, multi-witness accreditation, and the full OSCAL submission documentation.

Which industries does enclawed serve?

Federal civilian and DoD, financial services, healthcare, AI/LLM platform operators, critical infrastructure, and cloud/DevSecOps SaaS expanding into regulated verticals. Each vertical has a dedicated whitepaper available for direct download.

How can I evaluate the product?

Email alfredo.metere@enclawed.com. The whitepapers are direct-downloadable on this site without a form-wall. The public roadmap and full NIST 800-53 control mapping are available on request after a brief intro conversation.

For regulated organisations

Prove your agents are
under control.

Sooner or later a customer, an auditor or a regulator will ask you to demonstrate it. A control that decides by judgement cannot be certified — standards approve mechanisms an inspector can open and examine. enclawed is that mechanism.

Why probabilistic controls cannot close this

Model-judged guardrails

An LLM reviewing another LLM lowers the rate of bad actions. It cannot guarantee one, and there is no certificate for a rate.

Governance platforms

Control depends on a semantic model built and maintained by hand, and an LLM reasoning over it. Whatever is not modelled is not governed.

enclawed

Permitted if and only if the action matches declared policy. No model to maintain, no interpretation step, and a single component an assessor can evaluate.

A structural difference, not a feature gap. A control that reconciles many policies at interaction time cannot be enumerated in advance — and what cannot be enumerated cannot be certified, nor reconstructed for an inspector after an incident. A fixed list can be both.

What an assessor gets

Deterministic admission control. Per-tool authorisation, evaluated before any irreversible action executes.
A tamper-evident record. Cryptographically chained, independently re-verifiable, with four linked entries per request so the trace can be reconstructed.
A hardware root of trust. Physical entropy source; tamper detection meeting FIPS 140-3 Level 2 on the current device, with the architecture designed for Level 3/4 and Common Criteria.
Fail-secure behaviour on violation. A mismatch between what happened and what was recorded halts operations and latches — surviving restart, clearing only by human recovery with the bound device present, with a forensic snapshot captured at the moment of the event.

What it maps to

Framework	Where enclawed supplies evidence
EU AI Act (Reg. 2024/1689)	Human oversight, robustness, and event logging for high-risk systems.
NIS2	Risk-management measures and traceability of automated action on essential systems.
GDPR	Demonstrable technical control over automated access to personal data.
DORA	Operational-resilience evidence and an operations register for financial entities.
FIPS 140-3	Level 2 met by the current device; Level 3/4 is the design target of the module programme.

Frameworks certify the deploying organisation. enclawed supplies the controls and the evidence, not the certificate.

Published, peer-reviewed, and on the standards track. Six papers filed in four months; one examined by independent reviewers and accepted at an ACM workshop. Two live Standards Track proposals to extend the Model Context Protocol — one authored, one co-authored, whose canonicalisation is aligned to the first.

Sector briefs

Written for the people who have to sign: threat model, control mapping and the evidence each framework expects.

Federal & DoD Financial services Healthcare AI & LLM operators Critical infrastructure Cloud & DevSecOps

See the measurements · Research & papers · For security teams

Begin with an exposure review

Every deployment is bespoke, so it starts by looking: which agents run, under which credentials, and what they can reach. You keep that finding either way.

Talk to us

Not you?Individuals Teams & businesses Regulated enterprise

Prove your agents areunder control.