denial-web/ClawGuard
Scan OpenClaw-style skills and MCP configs for security and governance risk, and emit the clawguard.check.v1 decision contract.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Path to scan. | no | . |
| policy | Policy preset to apply. | no | governed |
| fail-on | Risk level that should fail the workflow. | no | critical |
| fail-on-policy | Whether policy decisions should fail the workflow. | no | true |
| policy-fail-on | Policy decision threshold that should fail the workflow. | no | manual_review |
| config | Optional .clawguard.json path. | no | "" |
| sarif | SARIF output path. Set to an empty string to skip SARIF emission. | no | clawguard.sarif |
| check | Emit clawguard.check.v1 JSON alongside SARIF. Set to "false" to skip. | no | true |
| check-output | Path to write the clawguard.check.v1 JSON when check is enabled. | no | clawguard.check.json |
Outputs
| name | description |
|---|---|
| decision | clawguard.check.v1 decision (allow, manual_review, or block). Empty when check is disabled. |
| risk | clawguard.check.v1 risk level (info, low, medium, high, critical). Empty when check is disabled. |
| summary | One-line summary from clawguard.check.v1. Empty when check is disabled. |
| recommended-action | clawguard.check.v1 recommendedAction (auto_install, require_user_approval, reject). Empty when check is disabled. |
| check-json-path | Absolute path the clawguard.check.v1 JSON was written to. Empty when check is disabled. |
| sarif-path | Absolute path the SARIF report was written to. Empty when sarif input is empty. |