SecureClaw

What is SecureClaw?

A self-hosted AI assistant built from the ground up in Go. Single static binary. No runtime dependencies. Your secrets never leave your machine unencrypted.

Get running in 60 seconds

curl -sL https://secureclaw-website.pages.dev/releases/latest/secureclaw-linux-amd64 -o secureclaw
chmod +x secureclaw
./secureclaw onboard

curl -sL https://secureclaw-website.pages.dev/releases/latest/secureclaw-darwin-arm64 -o secureclaw
chmod +x secureclaw
xattr -d com.apple.quarantine secureclaw
./secureclaw onboard

curl -sL https://secureclaw-website.pages.dev/releases/latest/secureclaw-linux-amd64 -o secureclaw
chmod +x secureclaw
./secureclaw onboard

The wizard sets up your provider, API key, vault password, and AI personality. Need help? Check the wiki.

Verify your binary

Already have a binary? Check its BLAKE3 hash here.

b3sum secureclaw-linux-amd64

Security at a glance

• BLAKE3 binary attestation — hashes itself on every startup, checks two independent sources before unlocking anything
• 2-source verification — both a Cloudflare Worker and this website must confirm the hash. Compromise one, the other still blocks it
• age-encrypted vault — credentials encrypted at rest, vault key cryptographically bound to attestation
• Tool Call Authorization Tokens — isolated policy engine authorizes every tool call, immune to prompt injection
• No telemetry — no phone home, no tracking. Only outbound calls are attestation on startup

Want the full breakdown? See how it works.