Rangehead
Governance

AI agents do not just answer. They act.

A coding agent edits files, runs shell commands, opens network connections, and spends money. Guardrails on the prompt govern none of that. ClawMetry watches the actions themselves, and gives your security team the inventory, the detection, and the stop button.

The situation

Engineering adopted agents bottom-up. The risk landed on you.

Your developers already run coding agents, on laptops and in CI, across 30 runtimes and counting. Nobody asked security first, and telling them to stop is not a plan. What you need is the ability to answer three questions at any moment:

  • What agents are running in my organisation right now, and on which machines?
  • What did each one touch: files, credentials, network destinations, money?
  • If one goes wrong, who can stop it, and how fast?

ClawMetry exists to make all three answerable, without changing how your engineers work. Observation is read-only. Enforcement is a separate, opt-in step that you control.

01 · Inventory

Know what is running before you govern it

Fleet inventoryEvery machine running agents, every session on it, live. Shadow agent use shows up here instead of in an incident report.Shipping
One control plane, 30 runtimesClaude Code, Codex, Cursor, Copilot, OpenClaw, self-hosted harnesses and more. The runtime is a detail; the policy surface is the same.Shipping
Session replayFull transcripts and tool timelines for any session, so an incident review starts from the record rather than from memory.Shipping
Spend attributionCost by agent, team, model, and repository. Governance conversations go better when the same screen shows the money.Shipping
02 · Detection

Flag the session that is behaving unlike itself

Detectors run over the action stream, not the prose. They ask two questions: is this agent stuck, and is it doing something it does not normally do.

Credential accessAn agent reading key material or secrets stores it has never touched before.Shipping
Network egressConnections to destinations outside the session's learned baseline.Shipping
File blast radiusWrite activity far beyond the session's normal footprint, caught while it is happening.Shipping
Privilege changePermission and privilege escalation attempts surfaced as incidents.Shipping
Runaway trajectoryStuck loops, repeated failures, and no-progress sessions that quietly burn budget.Shipping
How the ranking works

Thresholds are calibrated per runtime and learned from your own cohort's baseline, and every incident records which source produced its threshold, so you can tell a measured number from a shipped constant. Incidents are ranked by the estimated spend at risk in dollars. Where no cost is known we say so and rank it accordingly, because sorting a queue by an invented dollar figure is worse than not sorting it at all.

03 · Enforcement

A stop button that actually stops things

Everything in this section ships off by default. A governance tool that silently changes agent behaviour is a risk of its own, so turning enforcement on is a deliberate act with locks on it.

Manual kill switchPause, stop, or kill a running agent from the dashboard. OS-level signals to the real process, not a polite request.Shipping
Autonomous policyDetector incidents can trigger a pause, stop, or kill. New policies default to monitor, which records what would have happened and changes nothing.Shipping
Escalation laddersPause now, kill in five minutes if still stuck. Each step fires only if the session still matches, and at most once.Shipping
Pre-tool gatesWhere a runtime exposes a hook, risky actions are held for approval before the tool runs, not logged after it ran.Shipping
Budget enforcementSpend ceilings per node and per team, with alerts before the ceiling and enforcement at it.Shipping
The locks, in writing

An autonomous policy acts only when three separate conditions hold: the policy itself is set to act rather than monitor, enforcement is enabled on that node, and the licence check passes. One setting on the node disables every policy at once. Until all three are open, the engine runs in dry run and produces a decision log you can audit before you trust it.

Enforcement depth also varies by runtime. Some agents expose a hook we can gate on; others only emit telemetry after the fact, so there we can observe and alert but not block. Where a control cannot work we label it advisory instead of letting a button quietly do nothing. Ask for the conformance matrix and we will tell you which of your runtimes fall into which category before you buy.

04 · Evidence

Prove it happened, or prove it did not

Tamper-evident audit logAgent actions recorded with a hash chain. A modified or missing record breaks the chain and is reported as broken.Shipping
SIEM exportCEF or JSON over syslog to Splunk, QRadar, Elastic, or any compliant receiver. Runs on your side, where the plaintext is.Shipping
Evidence bundlesGenerated from your own environment and mapped to NIST AI RMF and SOC 2 control families, with gaps reported as gaps.Shipping

On certifications themselves we publish the honest position rather than a logo wall: see the security page for what we have and what we do not.

What we are not

Scope, stated plainly

ClawMetry is not an EDR, not a DSPM, and not an identity provider. It does one job: visibility and control over what AI agents do and spend, across every runtime your engineers picked. It feeds the tools you already have through the SIEM export instead of asking to replace them.

And it is open source. The collector that reads your engineers' sessions, the detectors, and the enforcement path are public code you can audit before you deploy them. We think the oversight layer should be held to a higher standard than the agents it watches, and that standard starts with being inspectable.