Last updated: 2026-08-05
Clawvisor is an open-source authorization gateway, now at 562 commits, that sits between AI agents and the outside APIs they call. Agents declare a task once; Clawvisor vaults the credential server-side and enforces that exact scope on every request, so the agent itself never touches a raw API key or OAuth token.
About Clawvisor
Clawvisor is an open-source AI agent authorization gateway founded in 2026 and backed by Y Combinator's Spring 2026 batch. Built by Eric Levine, a serial founder who previously co-founded identity verification company Berbix (acquired by Socure in 2023) and led Trust and Safety engineering at Airbnb, the tool addresses a structural flaw in how AI agents use APIs: OAuth scopes are too broad for nondeterministic agents, and credential sprawl across .env files creates serious security risks. The core mechanism is purpose-based authorization. When an agent needs to take action, it declares a task describing what it plans to do and which services it needs. The user approves the scope once. From that point, Clawvisor enforces that approved scope on every subsequent request, credential injection happens server-side, and the agent never sees the underlying API keys or OAuth tokens. Every request is risk-scored before execution, and anomalous parameters, unusual access patterns, or scope creep trigger immediate blocks. The three-layer authorization model gives fine-grained control without approval fatigue. Hard restrictions block matching actions unconditionally. Task scopes with auto-execute enabled let pre-approved actions run without prompts. Anything outside those scopes goes to a per-request approval queue, where users respond via the web dashboard, Telegram bot, or mobile push notification. This design batches intent approval rather than requiring action-by-action confirmation. Clawvisor supports 14 service adapters spanning productivity, developer, and communication tools, with Jira, Salesforce, and Airtable coming soon. It is agent-agnostic and works with any agent that can talk HTTP, including Claude Code, Claude Cowork, Hermes, and Perplexity Computer. It also exposes an MCP server at /mcp with OAuth 2.1 for direct integration with Claude Desktop and other MCP clients. Deployment options are cloud-hosted (free trial, no credit card required) or self-hosted via Docker container or cloud VM. The project is open source on GitHub, written in Go 1.25+ with a React 18 frontend, and reached v0.9.7 in May 2026 with 184 stars and 562 commits. Clawvisor explicitly states it is experimental software that has not been audited for security and should not be used as the sole safeguard for critical systems.
Pricing
Free cloud trial with no credit card required. Self-hosted version is free and open source (Go 1.25+ backend). Enterprise plan includes SSO, SAML, private cloud or on-prem deployment, audit and compliance tools, and dedicated support; contact sales@clawvisor.com for pricing.
Key Features
- Credential Vaulting: API keys and OAuth tokens are stored in an encrypted server-side vault so agents never see them; credentials are injected after each authorized request, eliminating the risk of token leakage across .env files and agent memory.
- Purpose-Based Task Authorization: Agents declare tasks upfront stating what they intend to do across the supported services; users approve the scope once, and Clawvisor enforces that exact purpose on every subsequent API call without requiring per-action confirmation.
- Three-Layer Access Control: Hard restrictions block unconditionally, task scopes with auto-execute handle pre-approved actions silently, and any out-of-scope request routes to a per-request approval queue accessible via the web dashboard or Telegram.
- Real-Time Risk Scoring: Every request is scored for risk before execution using LLM-powered assessment evaluating scope breadth, purpose coherence, and internal consistency; anomalous parameters and scope creep trigger immediate blocks.
- MCP Server with OAuth 2.1: Clawvisor exposes a Model Context Protocol server at /mcp with OAuth 2.1, enabling direct integration with Claude Desktop and any other MCP-compatible client without additional configuration.
- Full Audit Trail: Every gateway request is logged with a unique request ID enforced by a database constraint, recording the action, parameters, outcome, and credential injection timestamp for compliance and incident investigation.
- 14 Service Adapters: Native adapters cover Gmail, Google Calendar, Drive, Contacts, Outlook, OneDrive, GitHub, Slack, Notion, Linear, Stripe, Twilio, iMessage, and Dropbox, with Jira, Salesforce, and Airtable already in development.
Pros
- Agents never hold credentials, eliminating one of the most common AI agent security failures where API keys end up in agent memory or logs.
- Task-based approval model prevents approval fatigue: users review intent once rather than approving each individual action in a long-running session.
- Agent-agnostic design: any agent that can make HTTP requests works with Clawvisor, including Claude Code, Hermes, and Perplexity Computer, with no code changes beyond pointing the agent at the gateway.
- Open source and self-hostable, so security teams can audit the code directly and run their own instance instead of trusting a third-party cloud vendor with every credential.
Cons
- Explicitly experimental and not yet security-audited; the documentation itself warns against relying on it as a sole safeguard for sensitive data or critical production systems.
- Team of one (founder only) means the project's cadence and long-term support depend entirely on a single contributor, creating concentration risk for enterprise buyers.
- No verifiable compliance certifications (SOC 2, ISO 27001, HIPAA) as of May 2026, blocking adoption in regulated industries like healthcare and financial services.
Product Information
- Cloud
- Yes
- Self-Hosted
- Yes
- On-Premise
- No
- Languages
- English
- Training
- Documentation, GitHub README, YC community
Frequently Asked Questions
What are Clawvisor's pricing plans in 2026?
Clawvisor's hosted cloud plan is free to try and does not ask for a credit card at signup. Running your own copy is also free since the entire codebase is open source on GitHub. Teams that need SSO, SAML, on-premises deployment, or dedicated support can contact sales@clawvisor.com for an Enterprise quote; that tier's price is not published.
Can you use Clawvisor without paying?
The cloud plan has no published usage cap and requires no credit card, so most individual developers can run it entirely free. The self-hosted version is free forever since the code is open source on GitHub. Only the Enterprise tier, aimed at compliance-heavy teams needing SSO or on-prem deployment, carries a negotiated price.
What should you use instead of Clawvisor?
LikeClaw is the closest pick for teams that want sandboxed execution across many models rather than a credential-vaulting proxy in front of existing tools. HiddenLayer suits teams whose main risk is a compromised ML model rather than an overexposed API key, since it scans model files for backdoors instead of gating requests. Cyera fits enterprises that need to classify and protect sensitive data at rest, a different problem than authorizing what an agent can call.
Is Clawvisor better than using direct OAuth?
A direct OAuth grant typically hands an agent broad, standing access to an entire mailbox or repository, with the token sitting in a config file. Clawvisor instead narrows access to the exact task a user approved and keeps the credential in its own vault, so nothing sensitive touches the agent's memory. The tradeoff is one extra network hop per request and a dependency on Clawvisor's own uptime, which matters most for latency-sensitive calls like sending email or moving a Stripe payment.
How long does it take to get going with Clawvisor?
Connecting a first service takes minutes: register at clawvisor.com, then link the services an agent needs to reach, such as Gmail, GitHub, or Slack, through OAuth. From there, point the agent's HTTP requests at the Clawvisor gateway endpoint instead of the service's API directly; any agent that can speak HTTP works with no code changes. The first time the agent declares a task, review its purpose and scope in the dashboard or via Telegram, then approve it once.
Top Alternatives
- LikeClaw: LikeClaw sandboxes AI agent execution across many models at once; Clawvisor instead vaults credentials and gates access to real productivity tools like Gmail and GitHub.
- HiddenLayer: HiddenLayer's job is scanning ML models for backdoors and prompt injection; Clawvisor's job is stopping agents from misusing the API keys they already hold.
- Cyera: Cyera classifies and protects sensitive data at rest across an enterprise; Clawvisor authorizes what an AI agent can actively do with that data in the moment.
HokAI guides covering Clawvisor
- Clawvisor vs. Cyera: Why These Two AI Security Tools Aren't Really Competing: Clawvisor is free and built by one person. Cyera just raised $600M at a $12B valuation. Here is why picking between them is the wrong question for most teams.