What is enclawed and how does it relate to OpenClaw?

enclawed is the security-hardened fork of OpenClaw, the upstream personal-AI / agentic-AI gateway. It ships the entire upstream OpenClaw extension catalog (channels, model providers, tool plugins) but loads every plugin through a hardened admission gate, a hash-chained audit log, a two-layer egress allowlist, a DLP scanner, and a structural prompt shield by default. The MIT-licensed enclawed-oss is the open-source foundation; enclawed-enclaved is the proprietary commercial layer, with cryptography bound to the host's FIPS 140-3 validated module, on top.

Is enclawed a drop-in replacement for OpenClaw?

Yes. The CLI command, the config keys, the plugin layout, and the upstream extension catalog are all preserved. Migrating from OpenClaw to enclawed-oss is a substitution, not a rewrite. Your existing agents, channels, model providers, and tools come along, with capability declaration, signed manifests, hash-chained audit, two-layer egress allowlisting, DLP scanning, and a structural prompt shield wrapped around them.

Why should I switch from OpenClaw to enclawed?

We back this empirically with three nested layers of evidence: a 1600-sample template-baseline run (100 legit + 100 adversarial per failure mode F1-F4 across two real cloud channels), an 80,000-sample stress extension at n=10,000 per cell, and a ten-LLM cross-model generalisation run that re-runs the same task with adversarial content authored by ten different production LLMs (Gemini 2.5 Flash, Groq GPT-OSS-120B, Groq Llama 3.3 70B, Groq Llama 4 Scout 17B, OpenRouter Llama 3.1 70B, and Ollama Gemma2 9B / Llama 3.1 8B / Llama 3.2 3B / Mistral 7B / Qwen 2.5 7B). Across all three layers upstream OpenClaw scores recall = 0.000 on every F1-F4 cell of every confusion matrix; enclawed-oss and enclawed-enclaved both score precision = recall = F1 = accuracy = 1.000 on the in-distribution baseline and stress test, and recall = 1.000 on every cooperating LLM in the cross-LLM run. The framework additionally emits the full NIST OSCAL 1.2.2 FedRAMP-submission model set — Component Definition, Assessment Results, System Security Plan starter, and Plan of Action and Milestones — schema-validated, Ed25519-signed, and importable directly into a deployer's GRC tooling without manual rekey. Every OpenClaw plugin is materially safer when loaded through enclawed-oss because it inherits a deny-by-default policy, tamper-evident audit, allowlisted egress, structural prompt-injection sanitization, and runtime biconditional admission for any extension that needs the network. None of those properties hold on upstream OpenClaw without operator opt-in. The MIT license, the unchanged surface, and the zero-cost availability mean there is no business case for staying on upstream OpenClaw once a comparable hardened fork exists.

Is enclawed safe for OpenClaw agents wired to real-world devices (robots, 3D printers, vehicle controllers)?

OpenClaw's permissive defaults are no longer defensible the moment an agent gets connected to an actuator. Prompt injection, hallucinated tool calls, third-party module compromise, and unbounded egress stop being academic the moment the loop reaches a physical device. enclawed-oss closes that gap before the agent reaches the actuator and is the recommended choice for any OpenClaw-driven device deployment.

Does enclawed-enclaved need its own FIPS 140-3 certificate?

No. enclawed implements no cryptographic primitives of its own — every cryptographic operation uses FIPS-approved algorithms (AES-256-GCM, SHA-256, Ed25519, scrypt) executed by the host's FIPS 140-3 validated cryptographic module, such as the OpenSSL FIPS provider. Deployed in approved mode on a validated host, enclawed's cryptography inherits that module's validation; there is no separate enclawed module to submit or certify, and none is required. This is the standard, accepted posture for application-layer software under FedRAMP, CMMC, and HIPAA.

What is the relationship between enclawed-oss and enclawed-enclaved?

enclawed-oss is an MIT-licensed hard fork of OpenClaw with security features. enclawed-enclaved is the proprietary layer on top, adding cryptography bound to the host's FIPS 140-3 validated module, multi-witness accreditation, and the full OSCAL submission documentation.

Which industries does enclawed serve?

Federal civilian and DoD, financial services, healthcare, AI/LLM platform operators, critical infrastructure, and cloud/DevSecOps SaaS expanding into regulated verticals. Each vertical has a dedicated whitepaper available for direct download.

How can I evaluate the product?

Email alfredo.metere@enclawed.com. The whitepapers are direct-downloadable on this site without a form-wall. The public roadmap and full NIST 800-53 control mapping are available on request after a brief intro conversation.

For teams & businesses

You’re running agents for the business.
Nobody is checking them.

No regulator is forcing you yet. But your agents already touch client data, production systems and money — and the day one of them does something you cannot explain, “no one made us” is not an answer you can give a customer.

Agents you did not deploy

Someone in ops wired an assistant into the CRM. A developer runs a coding agent with production credentials. None of it went through review.

Blast radius, not bugs

The risk is not a wrong answer. It is a correct-looking action taken against the wrong target, at machine speed, hundreds of times before anyone looks.

A gate you own

One list of permitted actions, per agent, enforced before anything executes — and a record you can hand to a client who asks.

Why now, before anyone makes you

Your customers will ask first. Security questionnaires already have AI sections. “We review outputs manually” does not survive a serious one.
Retrofitting is worse. Writing the permission list while you have twelve agents is an afternoon. Writing it at two hundred is a project.
It is the same control auditors will want. When a mandate does arrive, the evidence already exists rather than being built under deadline.

You do not have to change anything you already run. Not the model, not the cloud, not the tooling. enclawed sits between the agent and the systems it can reach — and the systems stay where they are. There is no platform to migrate into and no vendor to become dependent on.

What a deployment looks like

Software	Runs on your own machines. Decides every action against the list, records each one in a tamper-evident log.
Enclaweder Pro	The hardware gate for business use. Card-sized, USB-C, and you add units as you add agents. The permissions live in the device rather than on the host.
The permission list	Written with you, department by department. It only works if it reflects how you actually operate — so we start by looking at what is already running.

The evidence is public. 1,600 messages, real attacks mixed with ordinary requests, routed through real services against three runtimes. The unhardened runtime stopped none; enclawed stopped all, with zero false alarms. It is not keyword matching — 42 messages appear twice in the corpus, once legitimate and once as an attack, with identical text.

Compare the runtimes · See the hardware · Request a demo

Start with what you already run

The first step is not a quote. It is a short exposure review: which agents are running, with which credentials, and what they can reach.

Talk to us

Not you?Individuals Teams & businesses Regulated enterprise

You’re running agents for the business.Nobody is checking them.