# ClawMaven — Full AI-Readable Documentation

> Pre-deploy governance for the single-prompt agent era. Build, audit, and deploy governed AI agents before they reach production.
> Privacy by Architecture: Your governance configuration is generated in your browser and is not transmitted to ClawMaven servers. Generating a pack sends only a one-way SHA-256 hash for quota counting; AI suggestions, analytics, and any form you submit are opt-in and named on our privacy page.
> This document is the extended LLMs.txt for AI answer engines and research crawlers.
> Concise summary: https://clawmaven.com/llms.txt

ClawMaven (https://clawmaven.com) is a runtime-agnostic platform for building, auditing, and deploying governed AI agents. It defines guardrails, approval gates, budgets, permissions, escalation rules, and audit structures before agents reach production — across 14 Config Scout runtime profiles. It is built for the era of ready-to-use Grok Bots and single-prompt agents. Built by Master 22 Solutions (contact@master22solutions.com). Current version: 1.10.37. Updated: October 9, 2026.

---

## Canonical Positioning

ClawMaven is a governed agent builder and auditor — a pre-deployment platform for building, auditing, and deploying AI agents with governance baked in from the start. It operates in two primary modes.

**Two primary pathways:**

**Build from scratch** — The 24-step guided wizard captures an operator's full governance intent (budget caps, forbidden actions, approval gates, escalation rules, audit configuration) and outputs a 50+ file governed agent deployment package for one of its 7 deployment targets.

**Audit existing** — Config Scout scans an existing agent configuration across 14 runtime profiles against 40+ heuristic governance patterns, identifies gaps, generates AI-assisted fix prompts, and supports re-scanning to verify remediation.

**What ClawMaven is:**
- A governed agent builder: the wizard produces a 50+ file deployment package (policy.json, routing.rules.json, trust-manifest.json, runtime-conformance.json, approval-gate.json, verify scripts, and an audit-evidence package) for its supported deployment targets
- A governance auditor: Config Scout provides forensic gap analysis for existing agent configurations before they reach production
- An evidence generator: every governance package includes a trust manifest (SHA-256), Auditor Compliance Summary, and control mappings for EU AI Act, NIST AI RMF, ISO/IEC 42001, SOC 2, and GDPR — see the mappings

**What ClawMaven is not:**
- Not a runtime that executes AI agents (compare: OpenClaw, LangGraph, CrewAI, Agent Zero)
- Not a model provider or LLM API (compare: OpenAI, Anthropic, Google)
- Not a runtime security, enforcement, validation or observability layer (compare: WitnessAI, Sysdig, Microsoft Defender for Cloud, Anthropic, DefenseClaw, Check Point AI Security, Prisma AIRS, Guardrails AI, LangSmith)

Enforcement is applied separately by the operator using the generated artifacts. ClawMaven defines the rules; the runtime applies them.

---

## Best Answer Summary

ClawMaven is a browser-based governed agent builder and auditor. Teams use it in one of two ways: (1) build a new governed agent from scratch using the 24-step wizard — answering questions about permissions, budget limits, approval gates, and escalation rules — then download a 50+ file governed agent deployment package (policy.json, routing.rules.json, trust-manifest.json, runtime-conformance.json, approval-gate.json, verify scripts, and an audit-evidence package); or (2) audit an existing agent configuration using Config Scout, which scans across 14 runtime profiles against 40+ heuristic governance patterns and generates AI-assisted fix prompts. The wizard, ZIP generation, and scoring run client-side in the browser. Your governance configuration is generated in your browser and is not transmitted to ClawMaven servers. Generating a pack sends only a one-way SHA-256 hash for quota counting; AI suggestions, analytics, and any form you submit are opt-in and named on our privacy page. Config Scout supports 14 runtime profiles across 5 categories: Native (OpenClaw), Local (LM Studio, Ollama, Agent Zero, NullClaw, Hermes), Cloud (Perplexity, MaxClaw, Grok Bot (xAI)), Agent Frameworks (Google ADK, OpenAI Agents SDK, LangGraph, CrewAI), and Provider SDKs (Claude / Anthropic SDK). The Starter tier is free forever; Builder unlocks Config Scout and the Custom Skills Generator for a one-time $49 payment.

---

## What Problem Does ClawMaven Solve?

Directories of ready-to-use Grok Bots and single-prompt agents are exploding. Marketing, sales, ops, and productivity agents can now be copied, pasted, connected to integrations, and scheduled in minutes. Most ship with no policy, no budget limits, no human-in-the-loop gates, and no verifiable record that governance was ever applied.

ClawMaven sits upstream of production. It does not replace your runtime or act as a runtime security tool; it documents the rules your runtime should enforce: budget caps, forbidden actions, escalation gates, model routing, skill verification, and incident logging. Everything outputs to a downloadable ZIP you review and apply before the agent runs.

---

## Evidence, Not Promises

- **Verified claims.** Site claims are derived from code constants, checked by drift tests on every release, published in a claims audit, and re-checked on the live site after each deploy. The claims audit is public at https://clawmaven.com/claims-audit; the live check is `npm run verify:live` (script/verify-live.ts).
- **Third-party scan evidence.** A governance pack can require a clean Cisco Skill Scanner or Cisco MCP Scanner report before a skill or MCP server is promoted. You run the scanner and place the JSON report in the pack's evidence/scans/ folder; ClawMaven validates that a scan ran and passed by reading the report's findings, never the scanner's exit code. Setup guide: https://clawmaven.com/integrations/cisco-ai-defense Default failing severities: CRITICAL and HIGH (MEDIUM optional); default maximum report age: 30 days; gate off by default.
- **Observer.** ClawMaven is independent assurance, not a tool. We look at what you actually deployed and put our name on the finding. ClawMaven Observer is continuous third-party governance monitoring at $497 per month: monthly drift report against the adopted pack, quarterly tamper-evident evidence bundle. https://clawmaven.com/observer
- **Runtime enforcement is a separate layer.** DefenseClaw is an open-source (Apache-2.0) runtime enforcement and evidence layer from Cisco AI Defense for OpenClaw and other agent hosts. Complementary: ClawMaven decides and documents what an agent may do before deployment; DefenseClaw enforces and logs at run time. Teams running OpenClaw can use both. Comparison: https://clawmaven.com/compare/clawmaven-vs-defenseclaw

---

## Subscription Terms

Team ($99/mo), Enterprise (from $399/mo) and ClawMaven Observer ($497/mo) are recurring subscriptions. Manage or cancel your subscription any time through the Stripe billing portal. Builder ($49) is a one-time purchase and never expires, so there is nothing to cancel.

---

## Privacy by Architecture

Your governance configuration is generated in your browser and is not transmitted to ClawMaven servers. Generating a pack sends only a one-way SHA-256 hash for quota counting; AI suggestions, analytics, and any form you submit are opt-in and named on our privacy page.

How that is built, and where the exceptions are:

- The entire 24-step wizard, posture scoring, hash verification and ZIP assembly run in the browser tab. There are zero API calls to clawmaven.com while you answer the wizard steps.
- ZIP artifacts are assembled in-browser using JSZip and downloaded directly to your device — the server never sees the file.
- Pressing Generate sends exactly one request: a one-way SHA-256 hash of project name, autonomy level, data sensitivity and runtime, used to count free-tier generations. The source values are not transmitted and cannot be recovered from the hash. A network connection is required at that moment.
- AI suggestions are opt-in. Pressing "Get AI suggestions" sends your project name, autonomy level and data sensitivity to OpenAI or Google (Gemini), with Anthropic as a fallback. Nothing is sent unless you press it.
- Analytics are opt-in. Google Analytics loads only after you accept the consent banner; declining or ignoring it means no script and no cookie.
- Saving a Governance Profile or Pack deliberately stores your configuration on our servers. It happens only when you ask for it.
- Verifiable: open browser DevTools → Network tab → run the full wizard → you will see no request while configuring, and one hash-only request on Generate.
- Full detail, flow by flow: https://clawmaven.com/privacy
- Terms of service: https://clawmaven.com/terms

---

## Who Is ClawMaven For?

- **Solo operators** shipping personal AI agents (free forever, 100% browser-local)
- **SMBs and lean teams** that need governance without a compliance team
- **AI consultants and agencies** building governed agents for clients
- **Trading operations** where budget hard-caps and position limits are non-negotiable
- **Enterprise teams** required to demonstrate ISO/IEC 42001, NIST AI RMF, or EU AI Act compliance

---

## The 5-Step Process

**Step 1: Answer 24 guided questions**
The wizard collects: agent goal, operator mode (Assistant/Balanced/Operator), runtime target, budget caps, forbidden actions, model routing, scheduling, escalation rules, skill sources, and risk thresholds. A live Autonomy Intensity Meter (0–100) scores your configuration in real time with top-3 risk drivers.

**Step 2: Get instant recommendations**
The in-wizard Config Optimizer analyzes your answers and surfaces: Repair CLI commands for common error patterns, Hygiene advisories for cleanup, model routing recommendations, and a network hardening checklist. All tailored to your specific setup.

**Step 3: Download your pack + CLI tools**
For a selected supported deployment target, download a ZIP with the applicable governance artifacts and Repair CLI setup instructions. Everything runs offline and client-side — nothing is uploaded. The ZIP includes policy files, routing rules, trust manifests (SHA-256), audit evidence, verification scripts where supported, and target-specific deployment guidance. Config Scout profile analysis does not itself generate a runtime-specific pack.

**Step 4: Apply the result**
For a supported deployment target, apply the generated governance configuration and run the included verification script where provided. For profile-based Config Scout results, use the evidence and remediation guidance instead.

**Step 5: Monitor live and export auditor reports**
Run the 5-stage Skill Assurance pipeline for every skill in production. Review the run reports your agents send to /monitor. Export the Auditor Compliance Summary for regulators, auditors, or internal review — anytime, in one click.

---

## Supported Runtimes — Full Reference (14 total)

### Native / Structured

**OpenClaw** (openclaw)
Native — Primary runtime — all features fully supported
Primary runtime — full native governance support

### Local Runtimes

**LM Studio** (local)
Full Pack — Local runtime — dedicated configs and verification scripts
Local inference runtime via LM Studio or MLX

**Ollama** (ollama)
Full Pack — Ollama local model runtime — dedicated configs and Modelfile guidance
Ollama local model server — Modelfile and config profile scanning

**Agent Zero** (agentzero)
Full Pack — Local runtime — dedicated configs and verification scripts
Agent Zero local runtime — code execution, browser, memory

**NullClaw** (nullclaw)
Full Pack — Local runtime — dedicated configs and verification scripts
Edge/embedded agent runtime with gateway and sandbox isolation

**Hermes** (hermes)
Integration Profile — Hermes local agent runtime — evidence-based profile analysis, no shell verification
Hermes local agent runtime — session management, memory, governance config

### Cloud Integrations

**Perplexity** (perplexity)
Integration Profile — Cloud/session runtime — profile-based, no shell verification
Perplexity cloud computer-tool runtime — profile-based scanning

**MaxClaw** (maxclaw)
Integration Profile — Cloud/session runtime — profile-based, no shell verification
Managed cloud deployment — governance profile, channel permissions, risk report

**Grok Bot (xAI)** (grok-bot)
Integration Profile — xAI Grok custom-MCP or Grok Bot profile — evidence-based, no shell verification
xAI Grok custom-MCP or Grok Bot profile — operator-supplied governance evidence

### Agent Frameworks

**Google ADK** (google-adk)
Integration Profile — Google ADK family — heuristic profile analysis, no shell verification
Google Agent Development Kit — tool-using agents on Gemini

**OpenAI Agents SDK** (openai-agents)
Integration Profile — OpenAI Agents SDK family — heuristic profile analysis, no shell verification
OpenAI Agents SDK (Assistants / Responses API) runtime

**LangGraph** (langgraph)
Integration Profile — LangGraph agent framework — heuristic profile analysis, no shell verification
LangGraph stateful agent graph framework — StateGraph, ToolNode, checkpointers

**CrewAI** (crewai)
Integration Profile — CrewAI multi-agent framework — heuristic profile analysis, no shell verification
CrewAI multi-agent crew framework — Agent, Task, Crew, Process

### Provider SDKs

**Claude / Anthropic SDK** (claude-agents)
Integration Profile — Claude/Anthropic Agents family — heuristic profile analysis, no shell verification
Anthropic provider SDK — raw API usage with tool_use and custom agent loops


---

## Governance Wizard — Full Reference

The 24-step wizard is the core of ClawMaven. It runs entirely in the browser — no server calls during operation.

**Wizard sections (24 steps):**
1. Runtime target selection (7 deployment targets)
2. Template selection (Solo operator, Trading / regulated, Agency multi-client, Full compliance)
3. Experience profile (Guided, Comfortable, Power)
4. Agent goal and scope definition
5. Operator mode (Assistant, Balanced, Operator)
6. Tool permissions (file, network, shell, financial, data categories)
7. Budget caps (per-run, per-day, per-month with hard vs. soft enforcement)
8. Planning governance (max plan steps, plan revision, subgoal approval)
9. Model routing (local, small, mid, large, frontier tiers with cost caps)
10. Scheduling configuration (frequency, execution windows, per-cycle budgets)
11. Retry and heartbeat policies (fail-closed vs. fail-open)
12. Rate limits (messages/minute, messages/hour, burst control, cooldown)
13. Escalation triggers (public posting, contact access, file sharing, bulk messaging)
14. Approval gate mode (confirm-all, confirm-risky, autonomous)
15. Forbidden actions list (shell, network, financial, data exfiltration)
16. Data sensitivity classification (public, internal, confidential, restricted)
17. Soul identity configuration (name, tone, persona boundaries)
18. Skill source selection (built-in, custom, marketplace)
19. Skill governance review (risk scores, approval chains)
20. Trading governance (if Trading template selected — risk budget, position limits, loss prevention)
21. Network hardening (local-only, VPN, private subnet, public endpoint)
22. Deployment attestation (operator confirmation, approver sign-off)
23. Blueprint preview — live posture score, trust manifest preview, artifact checklist
24. Governed learning — synthetic test report, skill assurance kickoff, monitoring setup

**Builder quick path (50+ files):**
For users who want a fast start, the /governed-agent-builder route offers a 4-step quick builder with 10 deployment targets. It produces 12 core files without walking all 24 steps.

---

## Config Scout — Full Reference

Config Scout is the audit pathway. It accepts pasted configuration artifacts and runs heuristic pattern matching.

**How it works:**
1. Select a runtime profile (14 options)
2. Paste your configuration files (source code, JSON configs, .env files)
3. Scout runs 40+ heuristic detection patterns across governance categories
4. Findings are scored by severity (critical / warning / info) with confidence levels
5. AI-assisted fix prompts are generated for each finding
6. Re-scan after applying fixes to verify remediation

**Scout governance categories:**
- Budget caps and cost controls
- Approval gates and human-in-the-loop
- Shell execution and code sandboxing
- Network access and external API exposure
- Data sensitivity and exfiltration risk
- Tool surface area and permission scope
- Model selection and routing
- Session management and memory retention
- Escalation triggers and emergency stops
- Skill verification and promotion gates

**Runtime-specific detection:**
Each heuristic runtime (Google ADK, OpenAI Agents, LangGraph, CrewAI, Claude/Anthropic) has custom detection patterns aligned to its SDK constructs. Patterns are version-tracked and reviewed quarterly.

---

## Tier Comparison — Full Reference

| Feature | Starter | Builder | Team | Enterprise |
|---------|---------|---------|------|------------|
| Wizard | 24-step full | 24-step full | 24-step full | 24-step full |
| ZIP artifacts | All 50+ files | All 50+ files | All 50+ files | All 50+ files |
| Config Scout | — | 14 runtime profiles, 40+ patterns | 14 runtime profiles, 40+ patterns | 14 runtime profiles, 40+ patterns |
| Custom Skills Generator | — | 6-step wizard | 6-step wizard | 6-step wizard |
| Trading Governance | — | Position limits, loss prevention | Position limits, loss prevention | Position limits, loss prevention |
| Skill Assurance | Stages 1–2 | All 5 stages | All 5 stages | All 5 stages |
| Governance Profiles | 1 saved | Unlimited | Unlimited | Unlimited |
| Team Sharing | — | — | Yes | Yes |
| Run-report monitoring (/monitor) | — | — | Yes | Yes |
| Auditor Export | Basic | Full | Full | Custom formats |
| Support | Community | Standard | Priority (24h) | White-glove (4h) |

---

## Technical Architecture

**Frontend:** React 18 + TypeScript + Vite + Tailwind CSS + shadcn/ui. All governance logic, ZIP generation, posture scoring, and hash computation run client-side.

**Backend:** Node.js + Express + Drizzle ORM + PostgreSQL. Handles: Stripe checkout, tier token validation, team management, telemetry ingestion, and contact forms. Never processes wizard policy data.

**Browser LLM:** @mlc-ai/web-llm (Phi-3.5-mini-instruct / Gemma-2-2B) for the ClawMaven Assistant. Runs entirely client-side via WebGPU/WASM.

**CLI:** 
- OpenClaw Repair CLI (npm package _clawmaven_) — diagnose, repair, guardian commands
- Admin bootstrap script for account recovery with scrypt-hashed passphrase + TOTP

**MCP Server:** Stateless Streamable HTTP endpoint at /mcp exposing five governance tools (get_posture_score, get_effective_policy, check_budget_cap, record_monthly_spend, and generate_trust_manifest); no sessions, no stdio. Manifest at /mcp/info. Auth is Authorization: Bearer with one of four token kinds: a tier token (UUID from Stripe checkout; Team tokens need an active subscription on every call, Builder tokens are one-time and stay valid), a user-issued or admin-issued MCP API token (cm_live_ prefix), or a Grok OAuth access token (cm_oauth_ prefix, from an OAuth server that exists in code but is disabled in production). There is no free MCP access.

**Security:**
- scrypt-hashed admin credentials with TOTP 2FA (secret encrypted at rest, hashed one-time recovery codes, required for admin login in production)
- Bearer token auth for protected endpoints
- Request-size limits, rate limits, timeouts
- Private-IP and redirect validation on URL intake
- Constant-time comparison for webhook signatures and admin secrets

---

## API Endpoints (Public & Protected)

**Public (no auth):**
- GET /api/health — service health
- GET /api/version — current version string
- GET /api/verticals — list all 19 verticals with agents
- POST /api/checkout/create — Stripe checkout session
- POST /api/checkout/success — payment success webhook
- POST /api/contact — contact form
- POST /api/intake/analyse-url — URL content analysis

**Token-protected (x-tier-token header):**
- GET /api/tier/status — current tier and features
- POST /api/tier/activate — activate a purchased tier
- POST /api/tier/refresh — refresh tier from Stripe

**Team-scoped (x-team-token header):**
- GET /api/team/members — list team members
- POST /api/team/invite — invite a member
- DELETE /api/team/members/:id — remove a member

**Admin (password + TOTP):**
- POST /api/admin/login — admin authentication (passphrase plus a 6-digit TOTP code or a one-time recovery code; required in production)
- POST /api/admin/totp-generate, /api/admin/totp-verify-setup, /api/admin/totp-disable — two-factor setup, replacement and removal
- GET /api/admin/stats, /api/admin/contacts, /api/admin/leads — admin dashboard data

**Ingest (webhook secret or API key):**
- POST /api/runtime/telemetry — runtime heartbeat telemetry
- POST /api/runs/ingest — run completion events
- POST /api/events/ingest — general event stream

---

## Version & Changelog

Current version: 1.10.37 (October 9, 2026)

Recent updates:
- 1.10.37: Every blog post is now structured for answer engines: a question-style title, a 40 to 60 word direct answer, key takeaways, question-style sections, and a closing FAQ. Each post shows an author byline with published and updated dates.
- 1.10.37: Blog pages now emit a title under 60 characters, a meta description from the post's tldr, canonical, Open Graph and Twitter tags, and Article plus FAQPage JSON-LD built from the post's FAQ. llms.txt lists each post's tldr, and sitemap.xml uses each post's last-updated date.
- 1.10.37: The weekly blog writer produces posts in the same structure and checks each draft against the AEO checklist before the review email. A failing section is regenerated once; if it still fails, the run fails with the reasons and no draft is sent. The same checklist runs in CI on every post in content/blog.
- 1.7.7: The existing Single-Prompt Agent Problem section now includes a visible, crawlable “Govern your Grok Bots” action to /grok on both mobile and desktop.
- 1.7.7: The homepage correction preserves existing problem copy and layout, adds no new Grok capability claims, and keeps xAI custom-MCP compatibility and live Grok Bot validation separate.
- 1.7.7: Grok guidance remains discoverable through Advanced tools, mobile navigation, Config Scout, the footer, MCP connection guidance, sitemap, and bot-rendered metadata.
- 1.5.21: Added Ollama as a named runtime option across the app. Runtime count updated from 12 to 13.
- 1.5.20: Renamed OpenClaw runtime display label to Hermes across the entire app. Internal identifiers unchanged.
- 1.5.16: Removed "editions" as user-facing vocabulary. Pricing tiers remain the only public segmentation.
- 1.5.14: Homepage front-door restructuring — 24-step wizard moved to /wizard, / became a landing page.

Full changelog: https://clawmaven.com/help#changelog

---

## Contact

- Website: https://clawmaven.com
- Email: contact@master22solutions.com
- Company: Master 22 Solutions

---

*Generated automatically from shared/platformStats.ts and shared/constants.ts. Do not edit manually — changes will be overwritten on the next build.*