The control plane for AI agents at work.
AI agents are spreading faster than the operator model.
The problem is rarely local experimentation. The problem is what shows up when the same agents reach into production, across teams, runtimes, and compliance boundaries — with no shared operational surface.
Fragmented runtimes
Claude Code, OpenAI Agents, LangGraph, internal workflows — disconnected operators, disconnected policy.
Untrusted MCP servers
No allow-listing, approval flow, or audit trail for the capabilities agents are actually reaching.
Shadow AI workflows
Autonomous agents touching production systems without governance — and without anyone tracking which.
No queryable evidence
Security and legal cannot reconstruct what an agent did. Logs are scattered, untyped, and inconsistent.
No containment path
Kill switches and approval flows are scattered across tools — or missing entirely when an incident hits.
Everything flows through policy, approval, audit, and response.
One operator model. One queryable event stream. One containment path. Built so the same surface that ships policy also shows runtime posture and the evidence behind every decision.
Multi-agent fleet inventory
Mixed-runtime view of every connected agent: where it runs, what version, which policy, last heartbeat.
Centralized policy engine
One operator model for permissions, tool scopes, approval thresholds, and audit depth — published once.
MCP governance console
Operator surface for the MCP catalog, approval queue, and audit query — layered on AGT's MCPGateway where present, ClawForge interception elsewhere.
Approval workflows
Operator approvals for tool scopes, MCP servers, policy changes, and shell access — routed and timed-out.
Audit & evidence pipeline
Append-only event store. Query by agent, runtime, policy decision, or operator. Export evidence packs.
Fail-secure kill switch
Heartbeat-bounded propagation with a local fail-secure fallback. Containment that does not require connectivity.
AGT-compatible policy layer
Translate ClawForge policy into Microsoft AGT primitives where the runtime supports it.
Risk signals & anomaly detection
Surface unusual tool-call patterns, policy denials, and approval-rate drift across the fleet.
One operational surface across multiple agent ecosystems.
Policy engagement, queryable audit, MCP governance, and incident response — all reading from the same fleet, all queryable across runtimes.
A layered architecture, vendor-neutral by design.
ClawForge meets each runtime where it lives — local enforcement where supported, MCP proxying where it isn't, and an append-only audit pipeline either way.
Mixed runtimes — what your enterprise actually runs.
Where ClawForge meets each runtime. Local enforcement where supported, proxy where not.
Substrate that enforces policy at agent-edge. Standalone or on top of Microsoft AGT.
Operator surface. Vendor-neutral, self-hosted, append-only.
AGT is the enforcement substrate. ClawForge is the operations layer above it.
AGT enforces policy on every tool call at the runtime layer — including MCP traffic via its own MCPGateway. ClawForge does not duplicate that. It's the operator console, approval workflow, policy distribution, and cross-runtime audit federation that turns a fleet of AGT deployments into one operable thing.
What AGT enforces
- Sub-millisecond per-tool-call policy enforcement
- MCPGateway and MCPSecurityScanner for MCP traffic
- Adapters for 20+ runtimes (LangChain, AutoGen, CrewAI, Semantic Kernel, OpenAI Agents SDK, Google ADK)
- Append-only, hash-chained audit log per deployment
- Four-tier privilege ring model and kill switches
- OWASP Agentic Top 10 coverage at the runtime layer
What ClawForge operates
- Operator console across many AGT deployments and non-AGT runtimes
- Approval queue, routing, SLA, and approver audit — the destination AGT's human-approval hook calls into
- MCP catalog, allow-list, and pending-approval surface above AGT's gateway
- Cross-runtime audit federation (AGT logs + Claude Code, OpenClaw, custom agents)
- Policy authoring, versioning, and fleet-wide distribution
- Incident response with mixed-runtime kill-switch posture
- Evidence packaging for security, legal, and compliance
Open source by design.
Vendor-neutral by intent.
ClawForge is MIT licensed, inspectable, self-hosted, and forkable. The control plane runs in your environment, on your storage, governing whichever agent runtimes you already use. No runtime lock-in, no proprietary policy format.
license MIT
deployment self-hosted-first
runtime-lock none
policy-format open · versioned
audit-store customer-hosted Postgres
contributors community-driven
Built for the teams operating AI agents at production scale.
Platform engineering
Standardize agent rollout, policy, and runtime governance across teams without rebuilding operator tooling per runtime.
- Audit query across runtimes
- Policy publish + propagation
- One operator on call instead of N
Security & compliance
Approval workflows, queryable audit evidence, and operational containment — for AI agents and the MCP servers they reach.
AI platform teams
Govern custom AGT and LangGraph agents alongside Claude Code and OpenAI Agents from one operational surface.
Operate AI agents like production infrastructure.
Open, vendor-neutral, multi-agent operations for enterprise AI systems. Run it where your team already manages risk.