DemoSimulated data. Deploy your own DashClaw instance to connect real agents.

Deployment truth surface

DashClaw can partially verify this instance, but some follow-up is required before normal use is trustworthy.

Live

Needs attention

Checked at Jul 27, 2026, 2:53 PM

Open Approvals Connect an agent

Readiness

needs_attention

Overall state projected from database, config, auth, deploy, and SDK checks.

Live verification

Pending

A setup page can be healthy without live proof. Proof becomes attached after a successful validation flow.

Proof artifact

Ready

Use /api/setup/status for machine checks and this page for operator truth.

Write-path health

Live canary writes just exercised the heartbeat, action-ledger, and guard-audit write paths against this database. A dead write path fails here before an agent hits it.

pass

Checked: real INSERTs under the isolated canary org, verified and deleted. Nothing synthetic reaches your ledger, posture, or rate-limit windows.

Organizations write path
Canary org row upserted — organizations accepts writes.
pass
Agent presence write path (heartbeats)
Live heartbeat upsert landed and was cleaned up.
pass
Action ledger write path
Live action-record insert landed and was cleaned up.
pass
Guard audit write path
Live guard-decision insert landed, read back, and was cleaned up.
pass
Guard enforcement (end to end)
A live block policy was loaded, evaluated, enforced (decision: block), and audited — governance is actually governing.
pass

Live host canary

A scheduled canary probes the production hosts as a real client: marketing, docs, demo entry, trial mint, OAuth discovery, and the hosted MCP handshake, and files its verdict here.

skipped

Checked: unauthenticated requests against the public hosts, asserting each surface’s expected contract. The canary’s traffic never touches the action or guard ledgers.

No canary reports yet. The live-canary GitHub Actions workflow probes the hosts hourly and reports to /api/live-canary once its secrets are set.

Enforcement liveness

A synthetic held action is driven through the real pretool hook seam, and this checks that it did not execute. A healthy decision ledger can still hide a dead hook (v4.72.1); this is the probe that catches that.

skipped

Checked: a synthetic action recorded as held, replayed through the same hook path a live agent uses, then verified as not-executed. Never reaches your action or guard ledgers.

No probe run yet — it runs automatically at the start of your next Claude Code session once dashclaw install claude has wired it (older installs need a one-time re-run of that command).

Or run it manually now: npm run liveness:probe

Enforcement posture

A block decision is never downgraded, on any surface. Hooks and server-executed capabilities halt the action itself; SDK, MCP, and chat callers honor the decision.

JWT replay protection

required

Verified JWTs must carry a fresh jti; a replay-store outage fails closed. API-key callers are never touched by this knob.

DASHCLAW_JTI_REPLAY_PROTECTION: change it in your deployment env and redeploy.

Action binding

best_effort

A token bound to a different (action, target, goal) blocks; issuers that don’t mint the claim are unaffected.

DASHCLAW_ACT_BINDING: change it in your deployment env and redeploy.

Degraded-evaluation fallback

require_approval

An evaluation that degrades (deadline, dependency failure) holds for a human instead of guessing.

DASHCLAW_GUARD_FALLBACK: change it in your deployment env and redeploy.

Verified agent identity (JWKS)

not configured

No issuer configured. Bearer tokens never reach verified status (fail-closed). Set this to your IdP to enable verified identity.

DASHCLAW_ALLOWED_ISSUER: change it in your deployment env and redeploy.

The per-surface enforced-vs-cooperative table lives in the docs and .

Core Readiness

DashClaw responded to the verification request.

pass

Checked: The /setup page rendered and the server runtime reported process metadata.

Verify surface reachable
The Setup & Verify page rendered successfully.
pass
Runtime metadata
Node.js v24.18.0 running in production.
pass

Database Verification

Database connection and core schema checks passed.

pass

Checked: DATABASE_URL presence, a live connection from this deployment, and all required core tables.

DATABASE_URL
DATABASE_URL is present.
pass
Connection test
Database connection succeeded.
pass
Core schema
All 6 required tables are present.
action_records, guard_decisions, api_keys, users, settings, guard_policies
pass

Configuration

1 recommended setting(s) still missing.

warn

Checked: Presence of required and advisory environment variables. Values are never shown here.

DATABASE_URL
DATABASE_URL is present.
Postgres connection string
pass
NEXTAUTH_SECRET
NEXTAUTH_SECRET is present.
Session signing secret
pass
NEXTAUTH_URL
NEXTAUTH_URL is present.
Public URL of this DashClaw instance
pass
DASHCLAW_API_KEY
DASHCLAW_API_KEY is present.
Default API key for agent authentication
pass
CRON_SECRET
Recommended setting is missing.
Next: Generate with: openssl rand -hex 32, then add it to your deployment environment variables.

Auth Readiness

DashClaw cannot be signed into normally until auth setup is completed.

warn

Checked: Whether at least one complete sign-in method exists and whether agent API authentication has a configured path.

Sign-in readiness
No complete sign-in method is configured yet.
Next: Configure DASHCLAW_LOCAL_ADMIN_PASSWORD for local access, or finish GitHub, Google, or OIDC setup.
warn
Local admin password
Local password login is not configured.
Next: Set DASHCLAW_LOCAL_ADMIN_PASSWORD if you want password-based setup access without OAuth.
warn
Agent API access
A default agent API key is configured.
pass

Deploy Readiness

Deploy configuration has recommendations.

warn

Checked: NEXTAUTH_URL vs current host, realtime backend on serverless.

NEXTAUTH_URL does not match deployment host
Configured: dash-claw.vercel.app — current:
Next: In Vercel, set NEXTAUTH_URL to https:// and redeploy.
warn
Realtime backend: Redis
Approvals live stream is active.
pass

SDK and Integration Verification

Finish core verification first, then run live SDK checks.

warn

Checked: This section does not execute SDK calls. It verifies whether a live validation path is available and documents the exact next commands.

Live validation proof
No live validation proof has been captured yet.
On the Settings page, paste your API key into the "Test your connection" panel and click "Run test" to capture proof and upgrade to verified.
warn
Core verification gate
Core verification is still incomplete, so validation should wait.
Next: Fix the blocked or warning checks above first.
warn
API key available
An API authentication path is available.
pass

Workflow

Core instance verification

pass

DashClaw rendered, required config is present, and database checks completed.

Operator and auth verification

warn

Normal operator sign-in still needs setup.

Next: Finish local password or OAuth setup before relying on dashboard access.

SDK and integration verification

pending

Open the Settings page and use the "Test your connection" panel — paste your API key and click "Run test" — to capture live proof.

Next: On the Settings page, paste your API key into the "Test your connection" panel and click "Run test" to validate and capture proof.

Verification proof artifact

pass

A structured JSON artifact is available for the current verification view.

Next: Download the proof artifact once you are ready to share or archive the current verification state.

Recommended next steps

Configure a sign-in method

warn

Operators need at least one complete sign-in method before normal dashboard access will work.

Write-path health

Live host canary

Enforcement liveness

Enforcement posture

Core Readiness

Database Verification

Configuration

Auth Readiness

Deploy Readiness

SDK and Integration Verification

Workflow

Recommended next steps

Configure a sign-in method

Validate your connection