HomeGet Started

Self-host your own governance control plane

Free to deploy. You own the data. Run doctor, connect your first agent, and verify the first decision record in under 10 minutes.

Connect your first agent Open Source Repo

View live demoSDK docsCheck instance status

Expected proof after deploy

npm run doctor or dashclaw doctor exits 0 or names the blocker. Your first governed action appears in /decisions, held work appears in /approvals, and /api/setup/live-proof can capture setup evidence without exposing secrets.

Cloud (recommended)

Vercel + Neon free tiers. Zero cost, accessible from any device, auto-HTTPS. Takes ~10 minutes.

Local

Docker + localhost. Good for development or if you want everything on your machine.

No OAuth required to get started. Use Quick Start to deploy solo in under 10 minutes (full walkthrough: deploy without OAuth). Switch to Team Setup when you're ready to invite teammates. Coming from the hosted trial? Click Export workspace on your trial's /connect card, then run dashclaw import <file> once your instance is up: policies, decisions, and action history carry over (API keys never do).

Create a free Neon database

Neon gives you a serverless Postgres database on their free tier, no credit card required.

Sign up at neon.tech
Create a new project (any name, e.g. "dashclaw")
Copy the connection string: it looks like postgresql://user:pass@ep-xyz.neon.tech/neondb

You'll paste this as DATABASE_URL in the next step.

Deploy to Vercel

Fork the repo and import it into Vercel. Add the environment variables and deploy.

Fork ucsandman/DashClaw to your GitHub account
Go to vercel.com/new and import your fork
Generate your secrets, then paste them into Vercel's environment variables:

About the API key: DASHCLAW_API_KEY is your bootstrap admin key: it authenticates agents and seeds your first organization. After you sign in, you can create and manage additional API keys from the dashboard at /api-keys.

Tables are created automatically on first request.

Set your admin password

No OAuth app required. Add one environment variable in Vercel and you can sign in immediately.

In your Vercel project → Settings → Environment Variables, add:

DASHCLAW_LOCAL_ADMIN_PASSWORD = your-strong-password-here

Then redeploy. Visit your app and sign in with your password on the login page.

Use a strong password. This grants full admin access. You can add OAuth later when you want to invite teammates.

Enable Live Updates (Redis)

Use Upstash Redis to bridge Vercel's serverless functions for real-time dashboard events.

Sign up for a free account at upstash.com
Create a new Redis database (Global or in the same region as your Vercel app)
Copy the REST URL and REST Token, or the raw Redis URL
Add these environment variables to Vercel:
- REALTIME_BACKEND=redis
- REDIS_URL=<redis-connection-string>
- REALTIME_ENFORCE_REDIS=true
Redeploy your Vercel app to apply the changes

The 30MB free tier at Upstash is more than enough for DashClaw's live event buffer.

Connect your agents

Agents only need a base URL plus API key. Every action they take flows through the same guard, record, and outcome loop. The deeper surfaces (scoring profiles, prompt templates, learning analytics) are available from the same SDK once you are connected.

View prompt

Agent environment

DASHCLAW_BASE_URL=https://your-app.vercel.app
DASHCLAW_API_KEY=<your-secret-api-key>
DASHCLAW_AGENT_ID=my-agent

Your Vercel app uses Vercel env vars. Your agent uses its own environment variables.

Quick integration (Node.js)

agent.js

import { DashClaw, GuardBlockedError } from 'dashclaw';

const dc = new DashClaw({
  baseUrl: process.env.DASHCLAW_BASE_URL,
  apiKey: process.env.DASHCLAW_API_KEY,
  agentId: process.env.DASHCLAW_AGENT_ID || 'my-agent',
});

// 1. Ask the policy engine before acting.
const decision = await dc.guard({
  action_type: 'deploy',
  declared_goal: 'Ship auth-service v2.1',
  risk_score: 40,
});
if (decision.decision === 'block') {
  throw new GuardBlockedError(decision);
}

// 2. Record the attempt. The server is the source of truth.
const { action_id } = await dc.createAction({
  action_type: 'deploy',
  declared_goal: 'Ship auth-service v2.1',
  risk_score: 40,
});

// 3. Run your real work, then close the loop.
await dc.reportActionSuccess(action_id, 'Deployed auth-service v2.1');

Quick integration (Python)

agent.py

import os
from dashclaw import DashClaw, GuardBlockedError

dc = DashClaw(
    base_url=os.environ["DASHCLAW_BASE_URL"],
    api_key=os.environ["DASHCLAW_API_KEY"],
    agent_id=os.environ.get("DASHCLAW_AGENT_ID", "my-agent"),
)

# 1. Ask the policy engine before acting.
decision = dc.guard({
    "action_type": "deploy",
    "declared_goal": "Ship auth-service v2.1",
    "risk_score": 40,
})
if decision["decision"] == "block":
    raise GuardBlockedError(decision)

# 2. Record the attempt. The server is the source of truth.
result = dc.create_action(
    action_type="deploy",
    declared_goal="Ship auth-service v2.1",
    risk_score=40,
)
action_id = result["action_id"]

# 3. Run your real work, then close the loop.
dc.report_action_success(action_id, "Deployed auth-service v2.1")

Verify

Confirm your deployment is healthy

Doctor diagnoses database, configuration, auth, deployment, SDK reachability, governance staleness, data hygiene, shape drift, and write-path health (live canary writes that prove heartbeats, action records, and guard audit rows actually land: synthetic, isolated, self-cleaning). It reports by default; pass --fix to apply safe repairs. Run it as the first thing after your instance comes up.

The live host canary covers the outside-in half: an hourly GitHub Actions cron probes your deployed hosts as a real unauthenticated client (pages render, trial mint stays fail-closed, OAuth discovery and the MCP handshake answer their contracts) and files its verdict to your instance; failures render on /setup#live-canary and raise a posture finding.

Operator (on the host)

npm run doctor

Filesystem-level fixes. Can write missing env vars to .env (always backed up first), run pending DB migrations, generate NEXTAUTH_SECRET/ENCRYPTION_KEY, fix CORS, and seed a default policy.

npm run doctor

Anyone with an API key

dashclaw doctor

Same engine, invoked via GET /api/doctor + POST /api/doctor/fix. No filesystem access. Add --json for CI, --no-fix to diagnose only.

npm install -g @dashclaw/cli
dashclaw doctor

Exit codes: 0 healthy, 1 warnings, failures, or unreachable.

Approve from anywhere

Resolve pending actions without opening the dashboard

Every instance exposes four approval surfaces against the same /api/approvals/:id endpoint. Pick whichever your on-call workflow prefers. waitForApproval unblocks the agent within about a second regardless of which surface resolved the action.

Mobile PWA

`/approve`

Phone-first approval surface. Add to your home screen and incoming approvals appear with the triggering policy, risk score, and one-tap Allow / Deny.

https://<your-instance>/approve

Telegram bot (optional)

Inline Approve / Reject

Pending actions push to an admin chat with inline buttons. If Telegram is unreachable, DashClaw warn-logs and approvals stay available via the other surfaces; it is purely additive.

dashclaw install telegram

Dashboard (/approvals) and CLI (dashclaw approve) are always on. Mobile PWA ships by default; Telegram is opt-in via TELEGRAM_BOT_TOKEN.

What you just deployed

Your DashClaw instance ships with the full governance API surface. Every feature works out of the box -- no LLM API key required.

Governance

Decision audit trail with full action traces
Behavior guard -- no-code policy decisions (mechanically enforced on hook and capability surfaces)
Policy pack gallery on /policies/packs -- 18 curated packs (spend, outbound comms, unattended runs, infra, fleets, and more), each previewable against your own action history before a one-click install
Human-in-the-loop approval gates with expiry (a lapsed approval can never release work)
Preflight plan authorization -- an agent submits its plan, you review one card with per-step verdicts, approved steps become single-use act-bound grants
Plan deviation events -- every governed action is diffed against the live approved plan; departures (substituted payloads, scope escapes, off-plan actions) are always recorded, and consequence is your explicit per-kind policy choice
Scoped delegation constraints -- cap a spawned subagent's risk, action types, paths, and depth; attenuation only tightens
Role constraints -- a named authority bundle per agent role (allowed action types, risk ceiling, path scope); anything outside the role escalates to your inbox
Containment verdicts -- a file-scoped edit can proceed reversibly instead of freezing: staged in an isolated worktree, you promote or discard the diff on your own time
Approval flood guard with bulk resolution
Plain-English approvals -- every pending item leads with one sentence for what the command actually does, flags what cannot be undone, and shows the exact command underneath
One judgment queue on /policies -- tuning, tightening, loosening, and calibration proposals with ratify/dismiss/undo in one click
Calibrated interruption controller on /calibration -- set a target false-interruption rate, hold it with a distribution-free bound; shadow first, then relief mode stops it asking about the things you keep approving (never past your own riskiest approval, and one deny takes the band back)
External decision provider -- plug one outside decision engine into the guard; its verdict joins stricter-wins (its deny is absolute, its allow never loosens), with an explicit fail-closed posture when it is unreachable and an optional action-type scope for domain-specific providers
Guard degradation observability (deadline fallbacks surfaced, never silent)
Prompt injection scanning

Observability

Real-time SSE event stream
Token usage and per-action cost recorded on every decision
Risk signal monitoring (autonomy spikes, repeated failures, assumption drift, stale actions)
Coverage truth -- record-vs-recorded tool-use coverage with an explicit "no evidence" state, plus close_source outcome provenance
Fleet attribution -- multi-agent fan-outs joined from persisted lineage evidence
Risk composition ledger -- every guard score itemized (risk_breakdown)
Session retros -- evidence-based end-of-session defensibility review

Audit & Evidence

Signed, replayable audit trail (Ed25519 receipts, JWKS export)
Evidence packaging (guard decisions + action records)
Tamper-evident proof of what was blocked, approved, and by whom

Security

Verified agent identity (JWKS / JWT verification)
Per-harness composed identities (parent:sub) with fleet grouping
agent_defense rollup -- the agent's advocate on every action detail
Automatic secret redaction
Assumption tracking with one-click invalidation and drift reports
Content scanning for sensitive data

Platform

Multi-tenant org isolation
HMAC-signed webhooks
Full activity audit log
Docker + Vercel + any Node.js host

All features are free, self-hosted, and work without any external AI provider. The governance core (guard, policies, approvals, and action recording) is pure runtime logic with no LLM dependency.

Alternative: Local Setup

Run locally with Docker

The installer generates secrets, writes .env.local, installs dependencies, and prints the API key your agents should use.

View prompt

Windows (PowerShell)

./install-windows.bat

Mac / Linux (bash)

bash ./install-mac.sh

When it finishes, open http://localhost:3000.

Optional: enable verified agents

For cryptographic identity binding, set ENFORCE_AGENT_SIGNATURES=true on the dashboard host. The Python SDK's create_pairing_from_private_jwk() helper generates a keypair and registers the public key via POST /api/pairings; an admin then approves the pairing in the dashboard before the agent's signed actions are accepted.

Connect your agent framework

Step-by-step guides for popular agent frameworks. Each takes under 20 minutes.

Create a free Neon database

Neon gives you a serverless Postgres database on their free tier, no credit card required.

Sign up at neon.tech
Create a new project (any name, e.g. "dashclaw")
Copy the connection string: it looks like postgresql://user:pass@ep-xyz.neon.tech/neondb

You'll paste this as DATABASE_URL in the next step.

Deploy to Vercel

Fork the repo and import it into Vercel. Add the environment variables and deploy.

Fork ucsandman/DashClaw to your GitHub account
Go to vercel.com/new and import your fork
Generate your secrets, then paste them into Vercel's environment variables:

Tables are created automatically on first request.

Set your admin password

No OAuth app required. Add one environment variable in Vercel and you can sign in immediately.

In your Vercel project → Settings → Environment Variables, add:

DASHCLAW_LOCAL_ADMIN_PASSWORD = your-strong-password-here

Then redeploy. Visit your app and sign in with your password on the login page.

Use a strong password. This grants full admin access. You can add OAuth later when you want to invite teammates.

Enable Live Updates (Redis)

Use Upstash Redis to bridge Vercel's serverless functions for real-time dashboard events.

Sign up for a free account at upstash.com
Create a new Redis database (Global or in the same region as your Vercel app)
Copy the REST URL and REST Token, or the raw Redis URL
Add these environment variables to Vercel:
- REALTIME_BACKEND=redis
- REDIS_URL=<redis-connection-string>
- REALTIME_ENFORCE_REDIS=true
Redeploy your Vercel app to apply the changes

The 30MB free tier at Upstash is more than enough for DashClaw's live event buffer.

Connect your agents

View prompt

Agent environment

DASHCLAW_BASE_URL=https://your-app.vercel.app
DASHCLAW_API_KEY=<your-secret-api-key>
DASHCLAW_AGENT_ID=my-agent

Your Vercel app uses Vercel env vars. Your agent uses its own environment variables.

Quick integration (Node.js)

agent.js

import { DashClaw, GuardBlockedError } from 'dashclaw';

const dc = new DashClaw({
  baseUrl: process.env.DASHCLAW_BASE_URL,
  apiKey: process.env.DASHCLAW_API_KEY,
  agentId: process.env.DASHCLAW_AGENT_ID || 'my-agent',
});

// 1. Ask the policy engine before acting.
const decision = await dc.guard({
  action_type: 'deploy',
  declared_goal: 'Ship auth-service v2.1',
  risk_score: 40,
});
if (decision.decision === 'block') {
  throw new GuardBlockedError(decision);
}

// 2. Record the attempt. The server is the source of truth.
const { action_id } = await dc.createAction({
  action_type: 'deploy',
  declared_goal: 'Ship auth-service v2.1',
  risk_score: 40,
});

// 3. Run your real work, then close the loop.
await dc.reportActionSuccess(action_id, 'Deployed auth-service v2.1');

Quick integration (Python)

agent.py

import os
from dashclaw import DashClaw, GuardBlockedError

dc = DashClaw(
    base_url=os.environ["DASHCLAW_BASE_URL"],
    api_key=os.environ["DASHCLAW_API_KEY"],
    agent_id=os.environ.get("DASHCLAW_AGENT_ID", "my-agent"),
)

# 1. Ask the policy engine before acting.
decision = dc.guard({
    "action_type": "deploy",
    "declared_goal": "Ship auth-service v2.1",
    "risk_score": 40,
})
if decision["decision"] == "block":
    raise GuardBlockedError(decision)

# 2. Record the attempt. The server is the source of truth.
result = dc.create_action(
    action_type="deploy",
    declared_goal="Ship auth-service v2.1",
    risk_score=40,
)
action_id = result["action_id"]

# 3. Run your real work, then close the loop.
dc.report_action_success(action_id, "Deployed auth-service v2.1")

Self-host your own governance control plane

Cloud (recommended)

Local

Create a free Neon database

Deploy to Vercel

Set your admin password

Enable Live Updates (Redis)

Connect your agents

Agent environment

Quick integration (Node.js)

Quick integration (Python)

Confirm your deployment is healthy

npm run doctor

dashclaw doctor

Resolve pending actions without opening the dashboard

/approve

Inline Approve / Reject

What you just deployed

Governance

Observability

Audit & Evidence

Security

Platform

Run locally with Docker

Optional: enable verified agents

Connect your agent framework

Claude Code

Codex

Hermes Agent

Claude Desktop

OpenAI Agents SDK

LangGraph

CrewAI

OpenClaw

AutoGen

Pydantic AI

Vercel AI SDK

Create a free Neon database

Deploy to Vercel

Set your admin password

Enable Live Updates (Redis)

Connect your agents

Agent environment

Quick integration (Node.js)

Quick integration (Python)

`/approve`