Governance · for CISOs, CTOs, and VPs of Engineering
AI agents do not just answer. They act.
A coding agent edits files, runs shell commands, opens network connections, and spends money. Guardrails on the prompt govern none of that. ClawMetry watches the actions themselves, and gives your security team the inventory, the detection, and the stop button.
Engineering adopted agents bottom-up. The risk landed on you.
Your developers already run coding agents, on laptops and in CI, across 30 agent runtimes and counting. Nobody asked security first, and telling them to stop is not a plan. What you need is the ability to answer three questions at any moment:
- What agents are running in my organization right now, and on which machines?
- What did each one touch: files, credentials, network destinations, money?
- If one goes wrong, who can stop it, and how fast?
ClawMetry exists to make all three answerable, without changing how your engineers work. Observation is read-only. Enforcement is a separate, opt-in step that you control.
Know what is running before you govern it
Every machine running agents, every session on it, live. Shadow agent use shows up here instead of in an incident report.Shipping
30 agent runtimes: Claude Code, Codex, Cursor, Copilot, OpenClaw, self-hosted harnesses and more. The runtime is a detail; the policy surface is the same.Shipping
Full transcripts and tool timelines for any session, so an incident review starts from the record rather than from memory.Shipping
Cost by agent, team, model, and repository. Governance conversations go better when the same screen shows the money.Shipping
Flag the session that is behaving unlike itself
Detectors run over the action stream, not the prose. They ask two questions: is this agent stuck, and is it doing something it does not normally do.
An agent reading key material or secrets stores it has never touched before.Shipping
Connections to destinations outside the session's learned baseline.Shipping
Write activity far beyond the session's normal footprint, caught while it is happening.Shipping
Permission and privilege escalation attempts surfaced as incidents.Shipping
Stuck loops, repeated failures, and no-progress sessions that quietly burn budget.Shipping
Thresholds are calibrated per runtime and learned from your own cohort's baseline, and every incident records which source produced its threshold, so you can tell a measured number from a shipped constant. Incidents are ranked by the estimated spend at risk in dollars. Where no cost is known we say so and rank it accordingly, because sorting a queue by an invented dollar figure is worse than not sorting it at all.
A stop button that actually stops things
Everything in this section ships off by default. A governance tool that silently changes agent behavior is a risk of its own, so turning enforcement on is a deliberate act with locks on it.
Pause, stop, or kill a running agent from the dashboard. OS-level signals to the real process, not a polite request.Shipping
Detector incidents can trigger a pause, stop, or kill. New policies default to monitor, which records what would have happened and changes nothing.Shipping
Pause now, kill in five minutes if still stuck. Each step fires only if the session still matches, and at most once.Shipping
Where a runtime exposes a hook, risky actions are held for approval before the tool runs, not logged after it ran.Shipping
Spend ceilings per node and per team, with alerts before the ceiling and enforcement at it.Shipping
An autonomous policy acts only when three separate conditions hold: the policy itself is set to act rather than monitor, enforcement is enabled on that node, and the license check passes. One setting on the node disables every policy at once. Until all three are open, the engine runs in dry run and produces a decision log you can audit before you trust it.
Enforcement depth also varies by runtime. Some agents expose a hook we can gate on; others only emit telemetry after the fact, so there we can observe and alert but not block. Where a control cannot work we label it advisory instead of letting a button quietly do nothing. Ask for the conformance matrix and we will tell you which of your runtimes fall into which category before you buy.
Prove it happened, or prove it did not
Agent actions recorded with a hash chain. A modified or missing record breaks the chain and is reported as broken.Shipping
CEF or JSON over syslog to Splunk, QRadar, Elastic, or any compliant receiver. Runs on your side, where the plaintext is.Shipping
Generated from your own environment and mapped to NIST AI RMF and SOC 2 control families, with gaps reported as gaps.Shipping
On certifications themselves we publish the honest position rather than a logo wall: see the security and procurement pack for what we have and what we do not.
Scope, stated plainly
ClawMetry is not an EDR, not a DSPM, and not an identity provider. It does one job: visibility and control over what AI agents do and spend, across every runtime your engineers picked. It feeds the tools you already have through the SIEM export instead of asking to replace them.
And it is open source. The collector that reads your engineers' sessions, the detectors, and the enforcement path are public code you can audit before you deploy them. We think the oversight layer should be held to a higher standard than the agents it watches, and that standard starts with being inspectable.
Next step
Thirty minutes, with your platform lead in the room
Bring the engineer who knows what your teams actually run. We will show you your inventory live against real agent traffic, tell you honestly which of your runtimes we can enforce on versus only observe, and leave you with the written material your security review will ask for.
Book a 30-minute briefingPrefer to read first? The security and procurement pack covers architecture, data flows, and deployment. The founding story explains why this layer must be independent of every agent vendor.
Want to try it before talking to anyone? It is open source: run ClawMetry on your own agents today.