Golden image pipeline
OSV-Scanner, Trivy, and Syft SBOM gates run before any image publishes. One BuildKit build per image — the exact OCI layout scanned is what Cosign signs and pushes to GHCR. Failed scans block push, sign, and tag promotion.
Early access waitlist — self-host free todayRequest access npx clawql-mcp
Anything to MCP. MCP to anything.
ClawQL is agentic infrastructure for production work in regulated industries. Autonomous event-driven agents. Structured institutional knowledge recall. Hardware-verified trusted execution. A WORM audit trail on every action — before every acknowledgment.
$
Apache 2.0 core · Event-driven, not prompt-driven · OpenBench mini-firm proven · TEE-ready from day one
The protocol fabric
Any protocol in. Any protocol out. MCP in the middle.
ClawQL Core turns API surfaces into MCP tools — REST · GraphQL · gRPC · WebSocket · MCP · generated CLI · WebMCP (preview) · QR stream (planned). mcp-api-adapter exposes any MCP server outward — OpenAPI · GraphQL · Streamable HTTP · gRPC · gen-cli · WebSocket · /mcp-ui · QR (planned) (7 surfaces shipped). A gRPC service talks to a GraphQL consumer. QR optical channel is planned as the 8th mcp-api-adapter surface — not shipped yet.
In
ClawQL Core → MCP
REST · GraphQL · gRPC · WebSocket · MCP · generated CLI · WebMCP (preview) · QR stream (planned)
Out
mcp-api-adapter → any surface
OpenAPI · GraphQL · Streamable HTTP · gRPC · gen-cli · WebSocket · /mcp-ui · QR (planned)
ClawQL Streams
Agents that don't wait for you.
Every other agent platform requires a human to start the session. Streams points a subscription at any event source — WebSocket, NATS, webhook, cron, polled API, or QR stream. When an event crosses the significance threshold, an agent session spawns (Lab 5b on celld today; the stream_subscribe MCP package is not shipped — planned). Memory recall, tool execution, and multi-turn inference run under a bind-on-create virtual key; humans review via /mcp-ui. The decision lands in the WORM trail.
OpenBench proof
Memory that closes sets, not approximates them.
Semantic recall returns what looks relevant. Structured ontology recall returns what matches — exactly, with no extras. We rebuilt the Calderwood & Harkness near-miss failure mode as an OpenBench mini-firm harness (B-7), then fixed it structurally with CQE-typed predicates.
| Arm | Score | Matters found | Retrieval path |
|---|---|---|---|
| ClawQL on | 3/3 (1.0) | 5/5 | structured_predicate |
| ClawQL off | 0/3 | 0/5 | could not complete |
| No memory | 0/3 | 0/5 | could not complete |
OpenBench mini-firm (B-7.1) — same notes, same model, different retrieval mechanism.
How it fits together
Recall → search → execute → ingest.
One closed loop for APIs, memory, and documents. Case studies on docs.clawql.com show the same pattern shipping Cloudflare Workers, recalling Cursor roadmaps from OpenClaw, and filing GitHub issues from vault context — without pasting specs into the chat.
- 01
Recall
Pull prior vault notes and structured ontology matches — institutional context, not a blank session.
- 02
Search
Rank API operations by intent. Specs stay server-side; agents get operation IDs and parameter hints.
- 03
Execute
Run validated calls over REST, GraphQL, or gRPC. Lean responses keep results out of your context budget.
- 04
Ingest
Persist decisions with memory_ingest so the next session — Cursor, OpenClaw, or K8s — continues the trail.
MCP tools
Core discovery and execution — always on.
Core discovery and execution — plus skills_list / skills_get — are always on. Memory and documents are default on (opt out). Schedule, notify, workflow, Onyx, sandbox, and IDP tools opt in when you need them — compose with CLAWQL_INSTANCE_SPEC / CLAWQL_TIER in 8.0. Same surface in Cursor, OpenClaw, or your Kubernetes cluster. Document workflows (Nextcloud → OCR → redaction → Onyx → VDR) live on the IDP page. Provider catalog is empty by default in 8.0 — opt in with CLAWQL_PROVIDER=default, Helm providers.pack, or CLAWQL_TIER.
ClawQL Core
Always on — no opt-out
searchRank thousands of API operations by natural-language intent. Specs stay server-side; agents get operation IDs and parameter hints. Provider catalog is empty by default — opt in with CLAWQL_PROVIDER / providers.pack / CLAWQL_TIER.
executeRun one operation with validated args over REST, GraphQL, or gRPC. Lean responses keep tool results out of your context budget.
auditIn-process ring buffer of structured events — append, list, clear. Pair with memory_ingest when you need a durable operator trail.
cacheEphemeral LRU scratch space for the active session. Use memory_* when data must survive restarts.
skills_listDiscover shipped Agent Skills (SKILL.md packs) registered on the server — including handoff and workflow recipes.
skills_getFetch a skill body by name so agents can follow vetted SOPs instead of improvising every workflow.
Security & TEE
Documented, reproducible — and TEE-ready.
ClawQL documents how container images are scanned, signed, and enforced from CI through Kubernetes admission — plus a 32-module curriculum for agentic AI deployments. ATR scoping limits what each agent can call. Panguard fail-closed enforcement is opt-in in 8.0 (set CLAWQL_PANGUARD_PROXY_PLUGIN=1) — not default-on.
Pipeline overview
Admission enforcement
The Helm chart defaults Kyverno verifyImages for clawql-mcp and clawql-website. Unsigned or unverified digests are rejected before scheduling — deployed ClawQL images tie back to the signed artifacts from CI.
Built for agentic AI
32-module security curriculum from supply chain through runtime. MCP gateway ATR scoping limits what agents can do regardless of prompt injection; audit trails, sandbox isolation, and distroless images are documented for self-hosted k3s.
Reproduce it yourself
Security documentation is public: golden-image walkthroughs, deliverables matrix, npm supply-chain hardening, and cosign verify instructions. Operators and reviewers can reproduce CI gates — we document limits as clearly as controls.
Build → registry → cluster
| Layer | What happens |
|---|---|
| GitHub Actions | Failed OSV/Trivy/SBOM or image scan → no push, no sign |
| GHCR + Sigstore | Cosign keyless signatures bind to the digest that passed CI |
| Kubernetes | Kyverno verifyImages rejects unsigned ClawQL images at admission |
clawql-tee
Hardware-verified agent execution.
For regulated environments where the operator itself cannot be trusted: clawql-tee is a DO-compatible runtime with AMD SEV-SNP, Intel TDX, and AWS Nitro Enclaves. Hardware attestation gates secrets; the audit trail can leave via QR optical channel — no network path across the boundary.
Questions & Answers
Pricing
Self-host free forever on Apache 2.0, or request early access for managed hosting. One MCP endpoint on every tier — same URL when you upgrade. Gateway tiers include vault memory; Teams adds Onyx; IDP tiers (Starter $299+) activate document processing on a dedicated tenant.
Self-hosted
$0
The full Apache 2.0 stack runs on your hardware — Helm chart, GHCR images, no license fee, no feature restrictions. Compose plugins via CLAWQL_INSTANCE_SPEC / CLAWQL_TIER (and CLAWQL_ENABLE_* when the instance allows). Provider catalog is empty by default.
search, execute, audit, cache, skills_* (Core — always on)
memory_ingest & memory_recall (default on)
Full IDP pipeline when you opt in (8 vendors)
Apache 2.0 — you pay infra costs only
Gateway + memory · early access
Developer
$29/mo
MCP gateway + agent memory vault for developers connecting Claude Code, Cursor, or Codex to your APIs. Request early access for managed hosting, or self-host free today.
Unlimited MCP executions
Global edge-hosted MCP endpoint
Vault storage — no egress penalties on memory recall
One MCP endpoint on every tier — same URL when you upgrade
Gateway + memory + search
Teams
$99/mo
Full Onyx semantic search + memory vault + MCP gateway for teams building agent workflows. Add Starter when you need document processing.
Unlimited MCP executions
Global edge-hosted MCP endpoint
Vault storage — no egress penalties on memory recall
One MCP endpoint on every tier — same URL when you upgrade
IDP plugin bundle
Starter
$299/mo
Activates the IDP plugin bundle on dedicated tenant infrastructure: Tika, Gotenberg, Stirling, archive layer, classify/extract, Coneshare VDR, sovereign inference. Your MCP endpoint and vault memory stay the same.
Unlimited MCP executions
Dedicated tenant · full IDP pipeline
5,000 documents/month
5 users · 50 GB storage
Enterprise from $3,500/mo
Large enterprises and regulated industries. Dedicated node, custom fine-tune with retraining, multi-region (EU available), DPA/BAA, dedicated CSM. Sovereign Security Pack included.
Request early access or self-host free
Gateway from $29/mo, IDP bundle from $299/mo. Full Apache 2.0 stack, no license fee.