ClawKeeper

Classification

Built artifact

Repository

Alexi5000/ClawKeeper

Language

TypeScript

Licence

MIT

Status

Active development

Tests

3 recorded gates

Last verified

2026-08-06

Related write-up

alexcinovoj.com

ClawKeeper is a control plane that sits between an operator and a fleet of Claude agents doing finance work. Every proposed action passes a deterministic policy evaluation before any model call is made, so a denied action never reaches a provider. Spend is opt-in rather than opt-out: autonomous budget is zero until an operator raises it. The audit log is append-only at the database layer, not at the application layer.

• Policy engine evaluates a proposed tool call against deterministic rules before any provider request is issued.
• Agent clusters are grouped by responsibility: intake, validation, reconciliation, reporting, compliance.
• Postgres with row-level security carries tenant isolation; the audit table is append-only and enforced in the database.
• Bun and Hono on the service side, React on the dashboard side, Docker Compose for local bring-up.
• Skills and steering documents (SKILLS.md, STEERING.md, AGENTS.md) are checked into the repository so agent behaviour is reviewable in diffs.

  operator request
        |
        v
  +-----------------+      deny
  | policy engine   |----------------> audit log (append-only)
  | (deterministic) |
  +--------+--------+
           | allow
           v
  +-----------------+     +----------------------+
  | budget ceiling  |---->| provider call        |
  | (default $0)    |     | (Claude)             |
  +-----------------+     +----------+-----------+
                                     |
                                     v
                            audit log (append-only)

• The README states 147 passing tests; the suite runs in the repository's GitHub Actions workflow (.github/workflows/ci.yml).
• Lint and type checks are wired into the same workflow via eslint.config.js and the package scripts.
• CODEOWNERS, CONTRIBUTING.md, and SECURITY.md are present, so review and disclosure paths are defined.

• This is an open-source control plane, not a hosted product. There is no managed deployment behind it.
• The policy engine is deterministic by design: it does not reason about intent, so policies must be written explicitly.
• Finance workflows in the repository are reference implementations, not certified accounting logic.

• README →github.com/Alexi5000/ClawKeeper#readme
• CI workflow →github.com/Alexi5000/ClawKeeper/blob/main/.github/workflows/ci.yml
• Security policy →github.com/Alexi5000/ClawKeeper/blob/main/SECURITY.md
• Skills manifest →github.com/Alexi5000/ClawKeeper/blob/main/SKILLS.md