# dashclaw [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/ucsandman/DashClaw  
**GitHub Stars:** 313  
**npm Downloads (last month):** 784  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/dashclaw

## Description
MCP server for DashClaw governance — guard, record, invoke, and discover capabilities.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "dashclaw": {
    "command": "npx",
    "args": ["-y","dashclaw"],
    "env": {
      "DASHCLAW_BASE_URL": "",
      "DASHCLAW_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `DASHCLAW_BASE_URL`, `DASHCLAW_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What the dashclaw MCP server does

The dashclaw MCP server provides governance around agent capabilities and tool execution. Its core operations cover checking an action before it runs, recording the resulting decision, invoking an approved capability, and discovering available capabilities. The governance layer evaluates actions against policy, assigns a risk level, and can return an allow, warn, or block result.

At supported enforcement points, a blocked operation is stopped before the underlying tool executes. The documented enforcement paths include Claude Code, Codex, and Hermes hooks, the OpenClaw gateway, and `dashclaw_invoke`. Bare SDK, REST, and ordinary MCP callers are cooperative: they must follow the returned decision themselves.

The system is intended for unattended or long-running agent sessions working against real repositories and infrastructure. Examples in the project include recursive deletion, destructive database statements, force-pushing a protected branch, and attempts to extract credentials from an environment file.

## How it works

An agent submits the intended action at the execution boundary. DashClaw classifies the request, checks configured policies, and reports the result before the action is carried out. High-confidence prompt-injection patterns can produce a block, while lower-confidence matches can produce a warning. The action, decision, and eventual resolution are written to a decision ledger.

Pending actions can be resolved from the `/approvals` inbox, CLI, phone PWA, Telegram, or Discord. Standing permissions can be created for eligible requests after reviewing their target and lease; high-risk, expired, self-approved, or otherwise ungrantable requests are rejected. Grants remain visible and can be revoked.

Decision records may include Ed25519 receipts and signed exports where the relevant evidence path issues them. A receipt verifies the signed contents, not whether an external side effect actually occurred. The system also separates authenticated identity from action-payload signing.

## Setup and configuration

The documented local start command is:

```bash
npx dashclaw up
```

For a non-interactive setup, use `npx dashclaw up --yes --no-browser`. The command stores the API key in `~/.dashclaw/instance.json`. A local health check is available at `GET http://localhost:3000/api/health`, and `npx dashclaw doctor` checks the installation. The README identifies Node.js 20+ and Python 3.7+ platform support and provides both npm and PyPI packages.

SDK configuration uses a DashClaw base URL, an API key, and an agent ID. A JavaScript example passes `DASHCLAW_BASE_URL` and `DASHCLAW_API_KEY` to the client, then keeps the real effect inside a governed execution wrapper.

## Tools and capabilities

The dashclaw MCP server supports these documented governance capabilities:

- Guard an intended action and receive a policy verdict.
- Record decisions and outcomes in a ledger.
- Invoke a capability through the governed execution path.
- Discover available capabilities.
- Route pending requests for remote approval.
- Scan for prompt-injection indicators during guarding.
- Report enforcement liveness, runtime versions, and hook fingerprints as diagnostics.
- Score declared agent confidence against reported outcomes.

Approval explanations lead with a plain-language description, identify potentially irreversible effects, and flag possible credential-bearing files. When policy cannot confidently interpret a command, the system reports that uncertainty instead of presenting a confident classification.

## Limitations and notes

Enforcement is not universal. Hooks, the OpenClaw gateway, and `dashclaw_invoke` can cancel a call before execution; ordinary MCP, API, and bare SDK integrations cannot enforce the result unless their caller does so. Liveness diagnostics describe client-reported conditions and are not attestation.

Signed evidence is conditional on the eligible path issuing a receipt, and a valid receipt does not prove that an external effect happened. Hosting and provider usage may have separate plans or limits. The project is MIT licensed and can be run locally or self-hosted.

_Full upstream README: https://allmcps.com/mcp/dashclaw/readme_