Clawvisor

Clawvisor executes authenticated actions in outside systems on the agent's behalf. Fourteen service adapters cover Gmail, Google Calendar, Drive and Contacts; messaging through iMessage, Slack and Twilio; work tools in GitHub, Notion, Linear and Granola; and Stripe, Dropbox and Perplexity.

Each takes the agent's requested action, attaches the real credential from the vault inside the gateway and returns the result, and customers can write their own adapters against the source for internal APIs. That is read, write and actionable integration, with credentials scoped per task and revoked when it ends. SendGrid, Jira, Salesforce and Airtable are listed as coming soon.

SourceClawvisor, clawvisor.com/integrations and /faqread 2026-09-25

Authorizing an agent's calls is the job here, not running its work. A task is the authorized unit of work (purpose, allowed tool calls and approver), with a lifecycle of approval, scope expansion and expiry, but the steps, their order and any handoffs between agents belong to the agent itself. That is an authorization lifecycle, not a workflow model.

SourceClawvisor, clawvisor.com/faq and the README at github.com/clawvisor/clawvisorread 2026-09-25

The product gates the agent's calls and indexes none of the customer's documents for an agent to ground its answers on. Chain-context extraction pulls identifiers from API responses for Clawvisor's own checks, which is not retrieval over the customer's corpus.

SourceClawvisor, clawvisor.com/faqread 2026-09-25

A review and approve surface ships with the product. A person approves each task's declared purpose before the agent can act; calls outside that purpose, or that score high for blast radius, are held before they leave the gateway while the agent waits for a decision, and high or critical risk tasks need a confirmation step. Sending an iMessage always requires approval, any service or action can be blocked outright, pending approvals expire after a set timeout, and approvals can be made from the dashboard or a paired mobile device.

SourceClawvisor, clawvisor.com/faq and /security, and the README at github.com/clawvisor/clawvisorread 2026-09-25

Access controls are in place: SAML and OIDC single sign-on ship for Enterprise orgs, each agent authenticates to the gateway with its own bearer token, management API tokens are scoped, revocable and hashed at rest, and every tool call is limited to the task a person approved, with blocked lists of services and actions (least-privilege tool access).

Compliance is missing: no SOC 2, ISO or other attestation is published, the security page asks buyers to verify claims by reading the public source, and the repository README warns that the software is experimental and has not been audited for security. No RBAC or ABAC model is named.

SourceClawvisor, clawvisor.com/faq and /security, and the README at github.com/clawvisor/clawvisor (linked from clawvisor.com)read 2026-09-25

Every protected tool call is recorded with its action, arguments, policy decision and the task that authorized it, replayable and tied to the person who approved the work, alongside every purpose declaration and credential injection. Activity rolls up by task and approver, so a buyer sees which accounts each agent touched, and the web and terminal dashboards show it live. The managed cloud adds extended log retention on the Pro plan. That is step by step inspection of the agent's own tool calls, with an audit record.

SourceClawvisor, clawvisor.com/security, /faq and /pricingread 2026-09-25

The state kept is about the agent's authorization, not memory for the agent. Chain-context verification extracts structural facts (IDs, email addresses, phone numbers) from adapter results and feeds them into Clawvisor's own verification prompts for later steps, and standing tasks keep a grant open until revoked. Clawvisor applies both as rules; the agent never reads them as context to decide. No memory layer the agent reads is documented.

SourceClawvisor, README at github.com/clawvisor/clawvisor and clawvisor.com/faqread 2026-09-25

Customers choose between a managed cloud and self hosting inside their own network from the public source (a gateway service plus a datastore for the vault and audit log), with the same purpose verification, risk scoring, vault and audit trail either way; self-hosted, credentials and traffic never leave the customer's network. The repository documents Docker, VPS, container platform and Cloud Run setups. The FAQ lists data residency options as future Enterprise work.

SourceClawvisor, clawvisor.com/faq and /pricing, and the README at github.com/clawvisor/clawvisorread 2026-09-25

No ready-made agents, workflows or templates ship with the product. Its fourteen service adapters are integrations rather than packs, and the installable skill only teaches an agent to route its calls through the gateway.

SourceClawvisor, clawvisor.com/integrations and /faqread 2026-09-25

Clawvisor does not start agents. The agent calls the gateway; when a held request resolves or a task is approved, denied, expanded or expires, Clawvisor POSTs a callback to a URL the agent supplied. Those callbacks answer the agent's own requests rather than starting new work, so no event, schedule or channel wakes an agent.

SourceClawvisor, README at github.com/clawvisor/clawvisorread 2026-09-25

When self hosting, the operator picks the model behind Clawvisor's own AI checks (intent verification, task risk scoring and optional chain-context extraction): Anthropic, OpenAI, Google Vertex AI, Groq or a local Ollama model, set in the setup wizard or config. That is admin controlled model choice with the customer's own key. On the managed cloud the model is Clawvisor's choice, and the proxy-lite runtime that presents Anthropic and OpenAI compatible endpoints to agents is labeled preview.

SourceClawvisor, clawvisor.com/faq and the README at github.com/clawvisor/clawvisorread 2026-09-25

An HTTP API is documented for the platform itself: agents create tasks and send gateway requests with bearer tokens, a management API takes scoped, revocable API tokens so Terraform and CI can drive it, and a CLI manages the server, services and agents. It also serves an MCP server at /mcp with OAuth 2.1 and enumerated tools (fetch_catalog, create_task, get_task, complete_task, expand_task, gateway_request) that create and change its core objects. There is no SDK; agents connect through a skill or plain HTTP.

SourceClawvisor, README at github.com/clawvisor/clawvisor (linked from clawvisor.com) and clawvisor.com/faqread 2026-09-25

Evaluation suites exist for Clawvisor's own intent-verification model (179 cases across benign tasks, scope creep and adversarial prompts, 249 across all three checks), with results in the public repo that a customer can rerun. That measures Clawvisor's verifier, not the customer's agent. Nothing documented tests, scores or optimizes the customer's agent.

SourceClawvisor, clawvisor.com/faqread 2026-09-25

Clawvisor brokers API calls to services such as Gmail, GitHub and Slack and does not operate a browser or a computer; no browser or computer use capability is documented.

SourceClawvisor, clawvisor.com and /integrationsread 2026-09-25