Clawdstrike

Clawdstrike is an open source endpoint detection and response engine built for AI agents, published by Backbay Labs. It combines a policy engine, an EDR and a signed audit chain in one binary, so that an agent's tool call is evaluated in the same event taxonomy as kernel level file access, process execution, network flows and persistence events. Every decision is recorded in an Ed25519 signed causal graph, and the defaults fail closed. It is aimed at security and platform teams that let coding agents and autonomous agent swarms run on developer workstations or clusters. The engine ships as a Rust crate, a TypeScript SDK, a Python package, a Go module and a CLI, plus a desktop EDR agent that uses macOS Endpoint Security and Network Extension or Linux Tetragon and Hubble. Developers can block access to sensitive paths, restrict network egress and deny specific MCP tools, run an agent under enforcement with a single command, and formally check that a policy is consistent and complete. A Helm chart deploys the daemon, the Spine audit checkpointer and witness, and bundled NATS JetStream for fleet use. The project is released under the Apache 2.0 licence and installs through Homebrew, npm, PyPI, Cargo and Go at no cost. An enterprise tier adds a managed control plane with a Control API, mTLS enrolment, the Spine audit chain and a Control Console for SOC workflow; no price is published for it. The project describes itself as a pre 1.0 beta: public APIs are stable, but defaults may still tighten before the 1.0 release. The listed website, backbay.io, currently shows only an email sign up page, so the GitHub repository is the working source of documentation.