# ClawSecure

A scanner that checks AI agent skills, MCP servers and CLI tools (from a GitHub link, ClawHub URL or zip) for malicious code, prompt injection and supply-chain risks before you install them, with a public audit registry and a clearance API; paid runtime monitoring is on a waitlist.

- Category: App and agent security · by ClawSecure
- Website: https://www.clawsecure.ai/
- Live data: no
- Checked on the official pages: 2026-10-24

## API

- Official API: yes, docs https://github.com/ClawSecure/clawsecure-openclaw-security/blob/main/docs/API.md
- Key needed: no
- Price: Free; limits: 100 requests per 15 minutes per client IP across the whole site, plus at most 100 clearance calls per minute per client
- Base URL: https://www.clawsecure.ai/api/
- Formats: json

Example request:

```
https://www.clawsecure.ai/api/v1/clearance
```

## Price and code

- Free tier: Free $0 forever: pre-install scanning, public audit reports, essential AI CISO; no signup needed to scan (https://www.clawsecure.ai/pricing)

## Data and license

- License: ClawSecure Terms of Service (https://www.clawsecure.ai/terms); covers Free scanner, registry and clearance API; terms call scans informational and for educational and research purposes
- Commercial use unclear
- Credit: not stated
- Embedding unclear
- Quote (api_official): "The service includes automated 3-Layer Audit Protocol scanning, an AI CISO™, AI-Powered Runtime Monitoring, real-time Watchtower integrity monitoring, and a Security Clearance API." (https://www.clawsecure.ai/terms)
- Quote (api_usage): "To check a skill, send `POST https://www.clawsecure.ai/api/v1/clearance` with a JSON body that names the skill you are checking in `skill_identifier`." (https://github.com/ClawSecure/clawsecure-openclaw-security/blob/main/docs/API.md)
- Quote (limits): "100 requests per 15 minutes per client IP address (an IPv6 client is counted by its /56 network), shared with every other request that client makes to www.clawsecure.ai: pages, assets and API calls alike" (https://www.clawsecure.ai/api/v1/clearance)
- Quote (registry): "Use the value ClawSecure publishes as contentHash for the audited version: in the skill's Security Audit Report data at GET /api/report/<scan id> (the scan id is the last segment of report_url) or in its entry in GET /api/registry." (https://www.clawsecure.ai/api/v1/clearance)
- Quote (free_tier): "The Pre-Install Scanner is free to use." (https://www.clawsecure.ai/terms)
- Quote (free_scan): "No signup required. No credit card. Results in 30 seconds." (https://www.clawsecure.ai/)
- Quote (paid_from): "SHIELD Most Popular $29/mo $9.99 /mo Founding Member Know what is in your entire agent environment." (https://www.clawsecure.ai/)
- Quote (paid_waitlist): "Founding Member pricing is locked when you join the waitlist. When runtime monitoring launches, you start at your locked rate." (https://www.clawsecure.ai/)
- Quote (commercial): "Security scans are informational assessments provided for educational and research purposes. Scans are not certifications, guarantees, or warranties of security." (https://www.clawsecure.ai/terms)
- Quote (acceptable_use): "Do not abuse the scanning service through excessive automated requests, attempting to exploit the API, or submitting malicious content designed to attack our infrastructure. Rate limits are enforced." (https://www.clawsecure.ai/terms)
- Quote (cli): "npm install -g clawsecure && clawsecure start" (https://www.clawsecure.ai/)

## Rules for an agent

- No key: GET https://www.clawsecure.ai/api/v1/clearance returns the full contract, then POST {"skill_identifier": "github:owner/repo"} (exact case) to get SECURE/CAUTION/DENIED/UNKNOWN; send a User-Agent naming your app; GET /api/registry lists audited skills with contentHash
- Stay under 100 requests per 15 minutes per IP (shared by pages and API) and send a User-Agent naming your app
- UNKNOWN is never a clearance; treat scan scores as informational, not a security guarantee

Human page: https://agentgid.com/resources/clawsecure/
Source: AgentGid (agentgid.com). Facts are quoted from the site's own pages; check the license page before you ship.