What is enclawed and how does it relate to OpenClaw?

enclawed is the security-hardened fork of OpenClaw, the upstream personal-AI / agentic-AI gateway. It ships the entire upstream OpenClaw extension catalog (channels, model providers, tool plugins) but loads every plugin through a hardened admission gate, a hash-chained audit log, a two-layer egress allowlist, a DLP scanner, and a structural prompt shield by default. The MIT-licensed enclawed-oss is the open-source foundation; enclawed-enclaved is the proprietary commercial layer, with cryptography bound to the host's FIPS 140-3 validated module, on top.

Is enclawed a drop-in replacement for OpenClaw?

Yes. The CLI command, the config keys, the plugin layout, and the upstream extension catalog are all preserved. Migrating from OpenClaw to enclawed-oss is a substitution, not a rewrite. Your existing agents, channels, model providers, and tools come along, with capability declaration, signed manifests, hash-chained audit, two-layer egress allowlisting, DLP scanning, and a structural prompt shield wrapped around them.

Why should I switch from OpenClaw to enclawed?

We back this empirically with three nested layers of evidence: a 1600-sample template-baseline run (100 legit + 100 adversarial per failure mode F1-F4 across two real cloud channels), an 80,000-sample stress extension at n=10,000 per cell, and a ten-LLM cross-model generalisation run that re-runs the same task with adversarial content authored by ten different production LLMs (Gemini 2.5 Flash, Groq GPT-OSS-120B, Groq Llama 3.3 70B, Groq Llama 4 Scout 17B, OpenRouter Llama 3.1 70B, and Ollama Gemma2 9B / Llama 3.1 8B / Llama 3.2 3B / Mistral 7B / Qwen 2.5 7B). Across all three layers upstream OpenClaw scores recall = 0.000 on every F1-F4 cell of every confusion matrix; enclawed-oss and enclawed-enclaved both score precision = recall = F1 = accuracy = 1.000 on the in-distribution baseline and stress test, and recall = 1.000 on every cooperating LLM in the cross-LLM run. The framework additionally emits the full NIST OSCAL 1.2.2 FedRAMP-submission model set — Component Definition, Assessment Results, System Security Plan starter, and Plan of Action and Milestones — schema-validated, Ed25519-signed, and importable directly into a deployer's GRC tooling without manual rekey. Every OpenClaw plugin is materially safer when loaded through enclawed-oss because it inherits a deny-by-default policy, tamper-evident audit, allowlisted egress, structural prompt-injection sanitization, and runtime biconditional admission for any extension that needs the network. None of those properties hold on upstream OpenClaw without operator opt-in. The MIT license, the unchanged surface, and the zero-cost availability mean there is no business case for staying on upstream OpenClaw once a comparable hardened fork exists.

Is enclawed safe for OpenClaw agents wired to real-world devices (robots, 3D printers, vehicle controllers)?

OpenClaw's permissive defaults are no longer defensible the moment an agent gets connected to an actuator. Prompt injection, hallucinated tool calls, third-party module compromise, and unbounded egress stop being academic the moment the loop reaches a physical device. enclawed-oss closes that gap before the agent reaches the actuator and is the recommended choice for any OpenClaw-driven device deployment.

Does enclawed-enclaved need its own FIPS 140-3 certificate?

No. enclawed implements no cryptographic primitives of its own — every cryptographic operation uses FIPS-approved algorithms (AES-256-GCM, SHA-256, Ed25519, scrypt) executed by the host's FIPS 140-3 validated cryptographic module, such as the OpenSSL FIPS provider. Deployed in approved mode on a validated host, enclawed's cryptography inherits that module's validation; there is no separate enclawed module to submit or certify, and none is required. This is the standard, accepted posture for application-layer software under FedRAMP, CMMC, and HIPAA.

What is the relationship between enclawed-oss and enclawed-enclaved?

enclawed-oss is an MIT-licensed hard fork of OpenClaw with security features. enclawed-enclaved is the proprietary layer on top, adding cryptography bound to the host's FIPS 140-3 validated module, multi-witness accreditation, and the full OSCAL submission documentation.

Which industries does enclawed serve?

Federal civilian and DoD, financial services, healthcare, AI/LLM platform operators, critical infrastructure, and cloud/DevSecOps SaaS expanding into regulated verticals. Each vertical has a dedicated whitepaper available for direct download.

How can I evaluate the product?

Email alfredo.metere@enclawed.com. The whitepapers are direct-downloadable on this site without a form-wall. The public roadmap and full NIST 800-53 control mapping are available on request after a brief intro conversation.

For individuals

Your assistant has your passwords.
Give it a lock.

The AI you use every day stopped being a chatbot a while ago. The moment it browses, sends mail, moves files or runs a command, it is acting — with your accounts, on your machine. enclawed decides what it is allowed to do, by rule.

The chatbot talks

You ask it to draft an email. It answers, you decide what to do. If it gets something wrong, you lost two minutes.

The agent does

Same program, but you gave it the keys: inbox, files, browser, terminal. It does not offer you the email. It sends it.

enclawed stands in between

Every action is checked against a list of what you allowed. On the list, it happens. Not on the list, it does not. There is nothing to talk around.

Why a list beats a smarter AI. The usual answer is to watch the AI with more AI. That lowers how often things go wrong; it cannot rule anything out. A rule has no error rate: the action either matches what you permitted, or it does not.

What you get

The open core, free to inspect. enclawed’s core is open source. You do not have to take our word for how it decides — you can read it.
A record you can check. Every action, allowed or refused, lands in a log built so that altering it after the fact is visible.
The Enclaweder, when you want the lock outside the computer. A device the size of a credit card on a USB-C port. The permissions live in it, not on the machine — so someone who gets into the machine still does not reach them.

Measured, not asserted. Across 1,600 messages routed through real services — real attacks mixed with ordinary requests — the unhardened runtime stopped none. enclawed stopped all of them, with zero false alarms on legitimate traffic. The test harness and the per-sample data are public.

See the measurements · See the device · Read the open core

Get on the list

The Enclaweder ships once its certification is granted. Tell us what you run and we’ll tell you what it takes to secure it.

Talk to us

Not you?Individuals Teams & businesses Regulated enterprise