What Clawvisor Is Actually For

In July 2026, Palo Alto's Unit 42 traced a wave of compromised AI-agent skills on ClawHub back to one mechanism: permissions the agents already held.

That breach, plus four chainable OpenClaw vulnerabilities disclosed in May with a top CVSS score of 9.6, exposed the same design flaw across the autonomous-agent stack. Once an agent gets access to Gmail, Slack or GitHub, it usually keeps that access indefinitely, with no per-task limit and no automatic revocation.

Clawvisor, a solo-founder startup from Y Combinator's Spring 2026 batch, answers that flaw directly: instead of a standing credential, it hands out access one task at a time and revokes it the moment the task ends. For a team already running an OpenClaw-style agent against real production tools, that distinction is the whole pitch, and it is worth understanding exactly how it works before wiring it in.

Four CVEs and a skill-store breach made this urgent

OpenClaw's 2026 security record reads like a case study in over-privileged agents. Cyera Research disclosed a chain of four vulnerabilities in May, nicknamed Claw Chain. The worst, CVE-2026-44112, is a time-of-check-to-time-of-use race in OpenClaw's sandbox rated 9.6 on the CVSS scale, letting an attacker rewrite configuration and plant a persistent backdoor. Three related CVEs, 44113, 44115 and 44118, compounded it.

Then in July, Unit 42 attributed the ClawHub skill-store breach to attackers uploading malicious markdown-driven skills. Those skills did not need a new exploit. They quietly used permissions the host agent already had: local file access, CLI execution, saved credentials.

The scale is what turned this into a market rather than a single bad headline. Censys counted 21,639 exposed OpenClaw instances leaking API keys and OAuth tokens by June, up from roughly 1,000 a few months earlier. A separate incident at a project called Moltbook exposed 1.5 million agent API tokens in one breach. Regulators in France, Singapore and Hong Kong issued advisories on agent credential handling between February and July.

If you are still deciding whether self-hosting an agent like this makes sense for your team at all, that question sits upstream of everything below it. HokAI's own playbook on running OpenClaw is a reasonable place to start before choosing a gateway to sit in front of it.

What Clawvisor actually does

Clawvisor sits as a gateway in front of the services an agent touches: Gmail, Google Drive, Slack, GitHub, Stripe and ten others. It works in three layers, according to its own documentation. Restrictions hard-block specific service and action combinations before anything else runs.

Task scopes let an agent declare what it needs to do, a human approves once, and the agent gets exactly that scope for exactly that task. A third layer catches anything undeclared: a per-request approval step, backed by an LLM that checks whether the requested action actually matches the stated purpose.

Credentials themselves never reach the agent. Clawvisor's server injects them directly into the outbound request and vaults them with AES-256-GCM encryption, so a compromised agent process has nothing to leak. Every action is logged, and the system scores requests for anomalies that look like prompt injection. It is a genuine answer to the exact failure mode Claw Chain and the ClawHub breach both exploited: standing access that outlives the task.

The founder's Trust & Safety record is the actual evidence here

Clawvisor is a one-person company, per its Y Combinator profile, built by Eric Levine. That matters more than it would for a funded, multi-founder startup, because a pre-1.0 security product asks a buyer to trust the person building it as much as the code.

Levine co-founded Berbix, a YC Summer 2018 identity-verification company that Socure acquired in 2023 for roughly 70 million dollars, and led Trust & Safety engineering at Airbnb before that. He has also served as a Visiting Group Partner at YC. None of that guarantees the product holds up, but it is a specific, checkable reason to take a solo pre-1.0 security tool seriously rather than dismiss it on team size alone.

Pricing, and two corrections to make on HokAI's own listing

Clawvisor's free tier is not a trial. It is a permanent plan: 1,000 protected calls a month, no credit card, with the full gateway, vault, revocation and audit trail included.

Pro costs 120 dollars a month billed annually, or 150 dollars month to month, for 20,000 calls, with request packs available above that starting at 0.025 dollars per call. Self-hosting is free under the Elastic License 2.0, which is source-available rather than an OSI-approved open source license, since it restricts competitors from offering Clawvisor itself as a hosted service.

Clawvisor's pricing page, captured 27 Aug 2026. The free plan carries no time limit, only a call cap.

HokAI's own Clawvisor listing currently describes it as fully open source with a free cloud trial. Both descriptions are slightly wrong, and worth fixing given how directly they shape a reader's expectations.

The project's GitHub repository shows steady commit activity, including security fixes to close open CVEs in its own dependencies, but its latest tagged release, v0.9.10, shipped roughly two months before this piece. A security product still on 273 stars and 756 commits without a release in that window is pre-1.0 by its own version numbering, whatever the commit graph looks like.

Clawvisor's repository, captured 27 Aug 2026. The commit history is active; the release tag is not.

Who else is building this, and where the bet gets risky

Clawvisor is not alone in the space that OpenClaw's 2026 problems created. Dynamo AI's AgentWarden takes a guardrail approach rather than an authorization gateway, and reports cutting a tested MCP deployment's attack surface by 97 percent in under five minutes, a faster but shallower fix than Clawvisor's per-task model.

QueryPie AIP approaches the same problem from an enterprise database-security background dating to 2017, building an MCP gateway aimed at large organizations rather than fast-moving startups. Funded identity incumbents including Auth0 and Microsoft's Entra Agent ID are also extending existing identity infrastructure to cover agents, competing on scale rather than Clawvisor's task-level precision.

That is the honest risk in recommending Clawvisor today. It is a single founder's source-available product, pre-1.0, going up against companies with orders of magnitude more engineering headcount. If Levine stops shipping, or a well-funded competitor ships the same task-scoped model with an SLA behind it, the technical advantage evaporates fast.

What survives that risk is the free tier: piloting Clawvisor on a non-critical agent workflow costs nothing but the setup time, and it forces a team to actually map what an agent can touch, which is worth doing regardless of which vendor ends up owning the category. If your evaluation stretches past a handful of tools and starts looking like a real vendor comparison, running it through Smart Match will surface the identity and access-control options that fit your specific stack rather than the ones that rank highest in search.

The next real signal to watch is not a feature launch. It is whether Clawvisor tags a 1.0 release and adds a second engineer before its free-tier users outgrow the 1,000-call ceiling and have to decide, for real money, whether the bet holds.

Frequently asked questions

What is Clawvisor used for?

Clawvisor sits between an AI agent and the services it touches, such as Gmail, Slack, GitHub and Stripe. Instead of giving the agent a standing API key or OAuth token, it grants access one declared task at a time and revokes it automatically once the task ends. Credentials are injected server-side, so the agent process itself never holds them.

Is Clawvisor free?

Yes, with limits. The free plan covers 1,000 protected calls a month with no credit card required and includes the full gateway, credential vault, revocation and audit log. The Pro plan starts at $120 a month billed annually ($150 month to month) for 20,000 calls, and self-hosting is free under the Elastic License 2.0.

Is Clawvisor open source?

Not in the OSI-approved sense, though HokAI's own listing has previously described it that way. Clawvisor's self-hosted code is released under the Elastic License 2.0, a source-available license that lets you read, modify and run the code but blocks competitors from offering it as a hosted service.

Why did Clawvisor become relevant in 2026?

A chain of four OpenClaw vulnerabilities disclosed by Cyera Research in May, including one rated 9.6 on the CVSS scale, and a July skill-store breach on ClawHub attributed to Palo Alto's Unit 42, both exploited the same weakness: AI agents holding standing access to tools and credentials with no automatic expiry. Clawvisor's task-scoped model is a direct answer to that specific failure mode.

Who competes with Clawvisor?

Dynamo AI's AgentWarden takes a guardrail approach that reduces an MCP deployment's attack surface rather than gating access per task. QueryPie AIP offers an enterprise MCP gateway aimed at large organizations. Identity incumbents including Auth0 and Microsoft's Entra Agent ID are also extending existing infrastructure to cover AI agents, competing on scale rather than Clawvisor's task-level precision.

Covered in this guide

• Clawvisor: Open-source authorization gateway for AI agents that vaults credentials and enforces purpose-based access control. YC Spring 2026-backed, free cloud trial.
• Dynamo AI: Enterprise AI guardrail platform whose AgentWarden cut a tested MCP deployment's attack surface by 97% in under 5 minutes.
• OpenClaw: OpenClaw is a local-first, open-source AI agent scoring 48.7% on SWE-bench Verified. Self-hosted and free, with a paid cloud tier available.
• QueryPie AIP: QueryPie AIP is an enterprise MCP gateway and agent builder from QueryPie, a database security company founded in 2017 in Seoul, South Korea.

Sources