Backed by Y Combinator

Your agents act.
You stay in control.

Your AI agent needs access to your email, calendar, and code—but not all of it. Clawvisor gives each task only the tools, actions, and data it needs, then revokes access when the work is done.

Source available · Self-host or managed

The problem

Today, every way to run agents is a bad trade.

You get one of three options. Not one of them is fast and safe.

Option one

Run fast, unsafe

Skip the prompts, hand over the keys, and let the agent rip.

One confused agent, and the damage is irreversible.

Option two

Approve everything

Put a human in the loop on every single call the agent makes.

Approval fatigue sets in. You rubber-stamp, so you approve nothing.

Option three

Lock it down

Scope the agent so tightly it can barely touch a thing.

Now it's safe, because it's useless.

The fourth option

Run fast and safe.

Approve the task, not the tools. Access binds to the task, so agents move at full speed and still can't step outside what you approved.

That's Clawvisor.

Why Clawvisor

Your agent doesn’t need the whole account.

MCP and OAuth can give agents broad, standing access. Clawvisor grants only what each approved task requires.

Broad tool access

MCP

The agent can call every tool the connected server exposes.

Boundary
All exposed tools
Lifetime
While connected

Broad account access

OAuth

The agent can use everything the token's scopes allow.

Boundary
All granted scopes
Lifetime
Until expiry or revocation

Need-to-know access

Clawvisor

The agent gets only the tools, actions, and data this task needs.

Boundary
This task only
Lifetime
Revoked when done

Things you can finally hand an agent.

Approve the task once, and every request the agent makes has to match it. That turns each of these from a permission you'd never grant into a capability you can hand an agent today.

Requests must match the task

Hand over a task, not the keys

You approve a task, not a standing permission. Every request the agent makes is checked against the purpose you approved — a calendar read for your morning briefing goes through, an expense audit across all history does not.

Every action on the record

See exactly what your agent did

Every request, every purpose declaration, every decision, every credential injection. A complete record of what your agent asked for and what Clawvisor allowed.

The agent never sees your keys

Connect real accounts, keep your tokens

Your API keys and OAuth tokens live in an encrypted vault. Clawvisor injects credentials server-side and returns sanitized results, so a leaked prompt or transcript can't leak a token.

Scored before it runs

Catch injection before it runs

Every request is scored for risk before execution. Clawvisor flags anomalous parameters, unusual access patterns, scope creep, and prompt-injection attempts hiding in tool arguments.

Usage attribution

See exactly which accounts your agents touched.

Because every call is bound to the task and the person who approved it, activity rolls up to a real unit of work and the team that owns it. Four hundred messages read, each one tied to a task, an agent, and the person who approved it — line by line.

This week · 5 tasks123 calls

How it works

A checkpoint on every agent request.

Your agent

Claude Code

Clawvisor

verify · inject · log

Your services

Gmail

01 · Task

Give your agent a task

Ask for the work you actually want — “check my calendar and summarize this morning's meetings.” The agent declares which services it needs to touch.

02 · Approve

Approve the task once

You see the purpose and the exact scopes it needs, like calendar/list_events and gmail/send_message, and approve it in one action. Not one prompt per call.

03 · Verify

Every request is verified

Each call is checked against the purpose you approved. Off-purpose requests and injected instructions are rejected; approved ones run with credentials the agent never sees.

Read the full mechanism →

The task model

Approve the task,
not the tools.

A task is a purpose plus the tools that purpose needs, whether that's triaging an inbox or shipping a fix with a shell and the repo. Clawvisor binds access to the task: the agent gets exactly what the work requires, for exactly as long as it runs, then it's gone.

With tasks · "Fix failing CI check"Scoped
agent
githubshellfilesystemgmailcalendarpostgresstripeawsslack
access expires when the task ends · ~30m
Without tasksStanding access
agent
githubshellfilesystemgmailcalendarpostgresstripeawsslack

Drop-in adoption

Works with any agent harness.

Clawvisor sits between your agent and the services it reaches for. Install one skill and your agent fetches data through Clawvisor instead of calling Gmail, GitHub, or your calendar directly — purpose checked, credentials injected, every call logged. No SDK, no agent code to touch.

  • purpose verified
  • credentials injected
  • every call logged

Credentials

Agents never hold your secrets.

The agent never receives a credential at all, not even a pointer to one. It names the service and the action it needs, and Clawvisor attaches the real token inside the gateway on an approved call. Go ahead: reveal it. Your agent has no way to.

What the agent sends

no credential
POST /api/gateway/request

{ "service": "github",
  "action":  "create_issue",
  "task_id": "t_4821" }

A service and an action. No key, and nothing that stands in for one, so there is nothing here worth stealing.

↓ Clawvisor attaches ↓

The real GitHub API key

vaulted
ghp_Rk8f2Kd9mPq2RxN4vTb7Lc3Wj••••••••••

Stored in the vault. Attached inside the gateway on an approved call, then stripped from the result.

claude --dangerously-skip-permissions

Stop choosing between fast and safe.

Hand your agents real work and let them run. Clawvisor keeps every call inside the task you approved, so your whole team moves faster.

Get started freeBook a demo