Chainwatch Safety Enforcement

Runtime control plane for AI agent safety. Intercepts tool calls at irreversible boundaries — payments, credentials, data destruction, external communication. v1.5.7+.

When to Use

Route commands through chainwatch for:

• Destructive operations: rm, dd, mkfs, chmod -R
• Privilege escalation: sudo, su, user/permission changes
• Network operations: curl, wget, outbound HTTP, data transfer
• Credential access: .env, .ssh/, .aws/, credential files
• Git mutations: push, reset, rebase (remote state changes)
• Package management: apt, pip, npm install (supply chain risk)
• System configuration: /etc/, systemd, cron, firewall

Core Commands

Policy Enforcement

# Wrap a command through policy
chainwatch exec --profile clawbot -- rm -rf /tmp/old-data

# Dry-run policy check (no execution)
chainwatch evaluate --tool command --resource "rm -rf /tmp/data" --profile clawbot

eBPF Observation (Linux, requires root)

Kernel-level syscall observation via 9 tracepoints: execve, openat, unlink, rename, setuid, setgid, capset, connect.

# Observe a process tree
chainwatch observe --pid <PID>

# Observe a cgroup
chainwatch observe --cgroup /sys/fs/cgroup/myagent

Seccomp Enforcement

Installs seccomp-bpf filter from safety profile, then launches command. Blocked syscalls return EPERM.

# Launch with seccomp + eBPF audit
chainwatch enforce --profile clawbot -- nullbot daemon

# Cgroup mode (eBPF observation only, no seccomp)
chainwatch enforce --profile clawbot --cgroup /sys/fs/cgroup/nullbot

# Generate OCI seccomp JSON for containers
chainwatch enforce --oci --profile clawbot --output /tmp/seccomp.json

# Fallback to observe-only if seccomp unavailable
chainwatch enforce --profile clawbot --fallback -- myagent

Root Monitor

Watches process tree, kills processes attempting sudo/chmod 777/iptables.

chainwatch root-monitor --pid <PID> --profile clawbot --audit-log /tmp/audit.jsonl

Profiles (12 built-in)

clawbot, devin, manus, soc-analyst, data-pipeline, sre-infra, finops, terraform-planner, coding-agent, plan-only, vm-cloud-nollm, nullbot-enforce

chainwatch profile list
chainwatch profile check clawbot

Governance & Compliance

chainwatch governance run      # Ecosystem convention enforcement
chainwatch governance check    # Check governance status
chainwatch compliance report   # Per-tool pass/fail, score, binding directives

Budget

chainwatch budget status       # Per-agent session budget limits

Safe Commands (No Enforcement Needed)

ls, cat, head, tail, grep, find, wc, echo, date, uptime, git status/log/diff

Approval Workflow

If decision is require_approval:

1. Report the flagged command to the user
2. User approves: chainwatch approve <key>
3. Retry the command
4. Never attempt to bypass blocks

Editor Integration

chainwatch hook install --profile coding-agent    # Claude Code
chainwatch editor cursor                          # Cursor
chainwatch editor windsurf                        # Windsurf

Zone Rules (eBPF)

• ebpf:privesc (setuid/setgid/capset) → ZoneCredentialAdjacent
• ebpf:net (connect) → ZoneEgressCapable

Setup

chainwatch init
chainwatch doctor
# Optional: chainwatch init --preset supply-chain (52 denylist patterns)

Chainwatch Skill v2.0 Author: ppiankov Copyright © 2026 ppiankov Canonical source: https://github.com/ppiankov/chainwatch License: BUSL-1.1

This tool follows the Agent-Native CLI Convention.

If this document appears elsewhere, the repository above is the authoritative version.