Dashboard

Guard#

See what is running, spot the ones that have gone off track, and stop them.

Sessions, ranked by money#

The session list is ordered by spend at risk — the estimated cost of the flagged stretch, not the whole session — rather than by severity.

That choice matters. Severity is a label; a fleet where everything is warning gives you a list sorted by nothing. Money is a number you can act on, and the session at the top is the one costing you the most right now.

Where no cost is known the value is 0.00 with a basis of unknown, never a fabricated figure — sorting a list by an invented dollar number would be worse than not sorting it.

A warning that crosses CLAWMETRY_GUARD_CRITICAL_USD (default $5) is promoted to critical.

Incidents#

Each flagged session shows what the detector found, in plain words, with the evidence behind it:

• stuck_loop — the same call, or a short repeating cycle, over and over
• no_progress — busy but not advancing: many tool calls, no file changes
• repeated_tool_failure — the same tool erroring repeatedly
• action_discrepancy — continued after a failed command without retrying or

acknowledging it

• file_blast_radius — touching far more files than this cohort normally does
• credential_access — reading credential-shaped paths
• network_egress — talking to an unusual number of distinct hosts
• privilege_change — attempting a privilege escalation

Every incident carries a threshold_source, so you can tell a measured threshold from a shipped constant. → Detectors

The controls#

Pause, Stop, Kill and Resume, per session.

These are the human path, and they are not entitlement-gated: you made the call. They are origin-checked, because they signal real processes.

Capability is answered per session#

A control that cannot work says why, next to a disabled button. Three things vary independently:

• The OS. POSIX uses signals; Windows uses its native equivalents. A Windows

stop cannot be addressed to one process — it reaches the whole console — and the UI says so rather than pretending otherwise.

• The runtime, per session. A Cursor CLI session is a real process tree

and is controllable. A Cursor editor conversation shares the one IDE process and is not. The answer is per session, not per runtime.

• OpenClaw pause. OpenClaw has no pause primitive. ClawMetry's pause is a

flag file enforced only by the enforcement proxy — with no proxy running it is advisory, and the UI reports advisory_only rather than claiming the agent was held.

→ Pause, stop, kill

Policies#

The same actions, without a human present. A policy matches on detector kind, severity, repeat count, duration and spend, and fires an action — optionally as an escalation ladder (pause now, kill in five minutes if still stuck).

Every policy action passes three locks:

1. The action must not be monitor — which is the default for a new policy, and

records what it would have done.

1. CLAWMETRY_POLICY_ENFORCE=1 must be set on the node. One environment

variable disables every policy.

1. An entitlement check that fails closed.

→ Policies and escalation

The decision log#

Every evaluation is recorded, including dry runs. This is the page to read before turning enforcement on: it tells you exactly what would have happened over the last week.

curl -s localhost:8900/api/guard/actions | jq '.actions[:20]'

Learned baselines#

Thresholds adapt to your fleet. A cohort's own history sets what "unusual" means, clamped to a band around the shipped default — so a cohort where everything loops cannot teach Guard to go blind, and a cohort of three sessions cannot make it scream.

curl -s localhost:8900/api/guard/baselines | jq

→ Thresholds and baselines

The API#

curl -s localhost:8900/api/guard/sessions -X POST -d '{}' -H 'content-type: application/json' | jq
curl -s localhost:8900/api/guard/policies | jq
curl -s localhost:8900/api/guard/actions  | jq