Clawdstrike
An endpoint-detection-and-response system built for AI agents that evaluates an agent's file access, process execution and network activity against the same policy engine as ordinary endpoint events, denying anything a policy does not explicitly allow.
Clawdstrike treats an AI agent's tool call as an event in the same taxonomy as kernel-level file access, process execution or network activity, evaluated by one policy engine and recorded in a signed, causal audit graph. Its defaults deny an action unless a policy allows it.
The same engine ships as a Rust crate, a TypeScript SDK, a Python package, a Go module, a CLI, a desktop endpoint agent for macOS and Linux, and an enterprise control plane. Installation is available through Homebrew, npm, pip, cargo or a Go module, after which a project is scaffolded with generated keys, a policy and a configuration file. A verify command checks that a policy is internally consistent and complete before it is enforced, and a run command wraps an existing agent process so every tool call passes through the engine first, producing a signed receipt for every denial.
A Helm chart supports fleet deployment, with an optional bridge to Tetragon and Hubble telemetry.