Clawforge

Self-hosted Operations Intelligence Platform

Clawforge connects infrastructure, events, security information, operational
telemetry, and controlled automation in one auditable operations layer. People
and LLM agents receive the same redacted context through the versioned Agent
API and the read-only MCP server.

Clawforge is not an autonomous AI administrator. It collects and evaluates
information, explains relationships, and exposes controlled interfaces for
people and agents. External actions are allowlisted, policy checked, approval
gated, audited, and dry-run by default in v1.0.0.

English · Deutsch

Why Clawforge?

Modern environments combine containers, servers, cloud services, repositories,
monitoring, security feeds, and automation. Information is produced in many
places, while the relationships between signals are difficult to see.
Clawforge provides one Operations Intelligence layer: it collects events,
correlates them, preserves traceable incidents, and combines risk, trust,
provider health, and recommendations.

Architecture

Infrastructure
      |
Connector Layer
      |
Provider Intelligence
      |
Event Backbone
      |
Correlation Engine
      |
Incident Intelligence
      |
Risk / Trust / Policy Engine
      |
Decision Intelligence
      |
Workflow Governance
      |
Controlled Operations
      |
Agent API v1
      |
MCP Server
      |
LLM Agent

• Connectors read safe projections from Docker, GitHub, and Proxmox.
• Provider Intelligence normalizes threat, ASN, BGP, and RPKI data.
• Event Backbone persists structured events for correlation, incidents,
  alerts, and audit consumers.
• Correlation and Incident Intelligence preserve relationships and an
  auditable incident lifecycle.
• Risk, Trust, and Policy evaluate signals separately. A single feed, ASN,
  RPKI status, or connector cannot block by itself.
• Decision and Workflow Governance produce explainable recommendations and
  manage approvals.
• Controlled Operations only knows registered actions. The v1.0 executor
  is dry-run and performs no external mutation.
• Agent API and MCP expose bounded, redacted, read-only context to OpenClaw
  and other agents.

The detailed architecture is in docs/architecture.md
(and Deutsch).

Feature matrix

Clawforge uses an extensible Connector Framework rather than a technology-
specific administrator. Connectors provide normalized state, health, and
capabilities for container platforms, infrastructure systems, virtualization,
repositories, cloud services, monitoring, and external data sources. Docker,
GitHub, and Proxmox are the initial examples.

LLM and MCP integration

LLMs do not receive direct infrastructure or database access. MCP calls only the
Agent API v1 and returns bounded, redacted responses. Scopes, timeouts,
response limits, and audit records apply to every call.

LLM -> MCP -> Agent Context API -> Events / Incidents / Risk / Provider health
     -> explanation or recommendation

A controlled operation follows this path:

LLM -> Decision -> Policy -> Approval -> Execution Queue -> Worker -> Audit

MCP remains read-only: it has no direct database access, hidden actions, or
write tools. See docs/llm-integration.md and
docs/llm-integration.de.md.

Docker installation

Requirements: Docker Engine and the Docker Compose plugin.

git clone https://github.com/lesecuritae/clawforge.git
cd clawforge
cp .env.example .env
./scripts/init-secrets.sh
./scripts/validate-secrets.sh --bootstrap
docker compose pull
docker compose up -d
curl http://127.0.0.1:8080/ready

The initializer creates private, untracked files with restrictive permissions;
it never overwrites existing secrets. The one-time administrator bootstrap
secret is not mounted during normal operation. Enable it only with
compose.bootstrap.yml, complete bootstrap, recreate the API with the base
Compose file, and remove the bootstrap secret. The MCP service is similarly
opt-in through the agent profile after replacing mcp_agent_api_token with
an issued, read-only Agent API token.

Use docker compose up -d --build for a local build. Published images are
available from ghcr.io/lesecuritae/clawforge-<service>:v1.0.0 (also published
as 1.0.0) for API, MCP, frontend, correlation, incidents, worker, and
executor. See
docs/deployment.md and
docs/deployment.de.md for upgrades, backups, and
health checks.

Security boundaries

• Least privilege through roles and explicit agent scopes.
• Append-only audit records for access, state changes, approvals, and
  executions.
• No automatic blocking or remediation from one signal or from an LLM.
• Human approval for critical operations.
• Secrets are injected with Docker Secrets or external references and never
  returned by API, MCP, logs, or frontend projections.
• Non-root containers, health checks, migration checks, and backup workflows.

See docs/security.md,
docs/security.de.md, and the
security audit.

Documentation

• Architecture · Deutsch
• Security Control Plane architecture and gap analysis (Deutsch)
• Security Control Plane implementation roadmap (Deutsch)
• LLM/MCP integration · Deutsch
• Deployment and updates · Deutsch
• Security model · Deutsch
• Agent API v1
• MCP server
• Providers
• Connectors
• Backup and recovery
• Final release · Deutsch

Roadmap after v1.0: Operations Firewall foundation

Clawforge v1.0 remains an Operations Intelligence Platform. Future releases
may add a control layer for agent governance and infrastructure operations:

LLM Agent -> MCP/API -> Clawforge Control Firewall
                         Context | Policy | Risk | Approval | Audit | Execution
                                      -> Infrastructure

The planned layer is not a replacement for a network firewall. It is a
governance boundary for AI agents, automation, infrastructure actions and
operational decisions. Possible capabilities include agent capability control,
context filtering, risk-based approvals, sandbox execution, rollback,
configuration guardrails, drift detection and complete decision auditing.
The v1.0 release does not claim to be an Operations Firewall.

Validation

cargo fmt --all -- --check
cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings
npm --prefix frontend test
npm --prefix frontend run build
docker compose config
docker compose build

License

Apache License 2.0. Clawforge is an independent Rust project and contains no
KorbKlar, supermarket, or OpenClaw runtime code.