Open Source · SOC2 Ready

Secure every agent call.
Before it leaves.

PintaClaw is the security core for enterprise AI agent deployments. Real-time DLP, human-in-the-loop approvals, and immutable audit logging — deployed in under an hour.

<200ms
Added Latency
6
DLP Patterns
<30s
Policy Reload
100%
Audit Coverage

AI agents are powerful. And uncontrolled.

Autonomous agents call external APIs with your data. Without guardrails, one misconfigured agent can leak PII, execute unauthorized transactions, or bypass compliance.

🔒

Data Leakage

Agents send SSNs, credit cards, and API keys to third-party APIs without any inspection or redaction.

Unauthorized Actions

High-risk operations like fund transfers execute automatically with no human oversight or approval gate.

📋

Audit Gaps

No immutable record of what agents did, when, or why. Compliance teams are left blind during audits.

Everything you need to secure agent traffic

Five integrated components that work together to give you full visibility and control over every agent API call.

🛡

Interceptor Proxy

Low-latency reverse proxy that sits between your agents and external APIs. Sub-200ms overhead, zero code changes.

🔍

DLP Redaction Engine

Scans every request and response for SSN, credit cards, IBAN, API keys, email, and phone numbers. Redacts in-place before forwarding.

Approval Bot

High-risk actions pause and surface to Slack for human review. Approve or deny with a single click. Every decision logged.

📜

Policy Store

YAML-based GitOps policies. Define agent permissions, risk levels, and enforcement modes. Live reload in under 30 seconds.

🔒

Immutable Vault

Every intercept, redaction, and approval stored as append-only JSON. S3 WORM-compliant. SOC2 audit-ready from day one.

Shadow Mode

Observe before enforcing. Shadow mode logs everything without blocking traffic — validate your policies risk-free before going live.

Deploy in minutes, not weeks

Point your agent traffic at PintaClaw and get immediate visibility. No SDK, no code changes, no vendor lock-in.

Quick Start

Three commands to get running. PintaClaw starts in shadow mode by default.

# Clone and install
$ git clone https://github.com/pinta-claw/pinta-claw.git
$ cd pinta-claw && npm install
 
# Start in local mode (no AWS/Slack needed)
$ npm run dev
 
🛡 PintaClaw Security Core started
Mode: shadow
Proxy: http://localhost:3100
Vault: ./logs/vault/ (local)
Policies: 6 rules loaded
 
# Point your agents at PintaClaw
$ export TARGET_BASE_URL=https://api.openai.com
$ export HTTP_PROXY=http://localhost:3100

Policy as Code

Human-readable YAML. Git-versioned. Live reload.

policies/default.yaml YAML
version: "1.0"
rules:
  - id: funds-transfer
    risk: critical
    action: "*/transfers/*"
    mode: enforce
    requires_approval: true
 
  - id: customer-data
    risk: medium
    action: "*/customers/*"
    mode: shadow

DLP in Action

Sensitive data is redacted before leaving your network.

// Request body (before)
{ "ssn": "987-65-4321",
  "card": "4532-XXXX-XXXX-1234" }
 
// Forwarded body (after redaction)
{ "ssn": "***-**-4321",
  "card": "****-****-****-1234" }

From zero to secure in four steps

1

Deploy PintaClaw as a sidecar proxy

Point your agent's outbound HTTP traffic at PintaClaw. One environment variable change. No SDK integration or code modifications required.

< 5 minutes
2

Start in shadow mode

PintaClaw intercepts and logs all traffic without blocking anything. See exactly what your agents are sending and receiving — before enabling enforcement.

Zero disruption
3

Define policies in YAML

Write simple, human-readable rules that map agents to actions, risk levels, and approval requirements. Commit to Git. PintaClaw reloads in under 30 seconds.

GitOps native
4

Switch to enforce mode

When you're confident in your policies, flip the switch. DLP redaction activates, approval gates engage, and every action lands in the immutable audit vault.

SOC2 ready

Transparent. Protocol-level. No lock-in.

PintaClaw sits between your agent orchestrator and external APIs. Every request passes through five security layers.

Agent Orchestrator
OpenClaw / Nanoclaw
Security Core
PintaClaw
External
APIs & Services
Interceptor
DLP Engine
Approval Bot
Policy Store
Vault

Trusted by security-first teams

"We deployed PintaClaw in shadow mode on Monday. By Wednesday, we'd caught 47 instances of PII leaking through our agent pipeline. We switched to enforce mode that same day."
JK
Jake Kim
CISO, NeoBank
"The YAML policy engine is a game-changer. Our compliance team can now read, review, and approve security policies without touching a single line of code."
SL
Sarah Lee
Head of Compliance, FinEdge
"As a developer, I love that PintaClaw is protocol-level. I didn't change a single line of agent code. Just pointed traffic at the proxy and everything worked."
MP
Marcus Park
Sr. Engineer, AgentOps
"The audit vault saved us 3 weeks during our SOC2 audit. Every agent action, every redaction, every approval decision — all in one immutable log."
AT
Alex Torres
VP Engineering, TrustLayer

Start securing your agents
in five minutes.

PintaClaw is open source, self-hosted, and requires zero code changes. Deploy locally, validate in shadow mode, and enforce when ready.