Post-Authorization Observability — Fig 0.1
Traditional security
stops at the door.
We watch the room.
A fully containerized, local-first behavioral analysis and kinetic response SOC for Agentic AI infrastructure. Powered by deterministic DRIFT policies and a probabilistic LLM judge.
The Problem With Authorized Agents
Traditional security perimeters fail when an authorized AI Agent is compromised.
An Indirect Prompt Injection or Cross-Site WebSocket Hijack doesn't need to break through your firewall. The agent is already inside, holding your OAuth tokens. ButterClaw acts as an LLM-in-the-middle SOC — watching behavior, not just entry points.
Fig 0.2 — 6-Node Decoupled Architecture
The Sentinel Pipeline
The Watcher
watcher.py
High-speed Python daemon tailing raw OS-level logs. Auto-serializes state on SIGTERM.
The Brain
Gemma 4:e4b
Local reasoning engine. Evaluates a 5-event sliding window for behavioral drift. Temperature: 0.3.
API & Policy
server.py / policy_engine.py
Central nervous system. HMAC-SHA256 auth. 3-scope DRIFT pipeline. 15 operators. No eval().
The ButterVault
buttervault.py
Zero-trust Fernet-encrypted credential store. Fires live HTTP DELETE to revoke OAuth tokens before local wipe.
The Dispatcher
alert_dispatcher.py
Air-gapped alert routing. 6 channels, 9 event types. Alert-then-burn ordering guaranteed.
The UI Suite
Docker + Nginx TLS
Dark mode control panel isolated behind Nginx reverse proxy. Oopsie logs, policy management, payload testing.
Fig 0.7
UI Dashboard Preview
A look inside the Sentinel.
Arsenal live-fire: regex signatures evaluated against the policy engine in real-time.
Routing dashboard — choose local or remote AI brain, select model
ButterVault credential management — active assassination status.
Air-gapped ntfy push notification on verdict_critical event.
25/25 live-fire test suite — 74+ positive and negative regex cases, stdlib only.
Fig 0.3
The Arsenal
7 sanitizer-aware regex signatures, rebuilt in v0.6.7
| ID | Name | Severity |
|---|
All 7 validated against 74+ positive and negative cases. 25/25 live-fire suite — stdlib only, no new dependencies.
Fig 0.4
Adjustable Paranoia
Switch at runtime without restart. The Sentinel scales with your threat model.
Observe
Background scanning. Arsenal signatures fire but kinetic responses are suppressed.
SIGKILL
Arsenal + Guardian Brain verdict → SIGKILL on matched processes. ButterVault remains sealed.
☢️ Gibson
Active OAuth token assassination + Fernet vault shred + mobile alert on external origin detection.
🧈 ButterVault
Zero-trust credential obliteration
Fernet-encrypted at rest. On breach detection, ButterVault doesn't just lock the door — it burns the house down. Live HTTP DELETE/POST requests revoke GitHub OAuth and API tokens globally before the local vault is atomically shredded. The Gibson sequence fires before the local wipe.
Alert-then-burn: the Dispatcher fires before the Gibson, so you know exactly what happened.
Fig 0.5
How It Fits
LangSmith and LangFuse log what your agent did. ButterClaw intervenes.
| ButterClaw | Halo | LangSmith | WAF |
|---|
Fig 0.6
Mission Log
Every release has a codename.
Ready to secure your local agents?
ButterClaw is open-source. Clone the repo, spin up Docker, arm the Vault.
Requires Docker + Ollama on host. Consumer GPU recommended — CPU fallback works.