WardenClaw and agentsh
agentsh, by Canyon Road, is the closest tool in mechanics and the more complete one. It governs what a process does after it starts: files, network, signals, databases. WardenClaw gates one thing, the start of a program, and puts its effort into who says yes.
As of 2026-10-01, agentsh v0.20.5, from their public docs and repository. Something here is wrong or out of date? Open an issue.
In short
Where agentsh is ahead. Scope, platforms, packaging and age. If the agent's danger is a file it may overwrite or a host it may call from inside an allowed process, WardenClaw does not see it and agentsh does. agentsh can also redirect an operation instead of refusing it, runs outside Linux, and has a control plane for many machines.
Where WardenClaw differs. The approval is a signature from a key on your phone over the digest of the exact command, checked by the gate, and the journal is signed so that anyone with the public key can verify it. The phone app with push is part of the open-source project. The machine opens no port to the network. The price is a dependency on a relay: when it is unreachable, commands that need a signature are denied.
Which one to pick. You need rules for files and network, policy across a fleet, macOS or Windows, or audit export for compliance: agentsh. You run a self-hosted agent on a headless Linux machine and want a signed yes or no from your phone before a dangerous command starts: WardenClaw. They do not exclude each other. agentsh has a REST approval mode, but no integration between the two exists.
Row by row
| WardenClaw | agentsh | Ahead | |
|---|---|---|---|
| What is intercepted | Program starts only: execve and execveat in the agent's process tree. A file write or a network connection made by a process that is already running is not gated. | File, network, process and signal activity, including subprocess trees; also Postgres-family database traffic and MCP tool calls. docs: overviewdocs: database proxydocs: MCP security | agentsh |
| Kernel mechanisms | seccomp user notification on exec. Linux 5.19 or newer. | seccomp, eBPF and FUSE in full mode, Landlock or ptrace where those are missing; agentsh detect reports which mode a host can enforce. docs: security modes | agentsh |
| Decisions a rule can make | Run, deny, or wait for a signed approval. | allow, deny, approve, redirect, audit, soft_delete. Redirect steers a command, a path or a connection to an approved alternative instead of failing it. docs: policy modeldocs: steering | agentsh |
| Platforms | Linux in the release. A macOS gate on Endpoint Security is in the repository, unreleased: it needs Apple's entitlement and runs only in development mode for now. | Linux with full enforcement. Windows through WSL2 and macOS through a Lima VM run the Linux build. Native macOS (ESF+NE) scores 90% in their table and their README calls it alpha; native Windows scores 85% and waits for driver signing. docs: platform supportREADME | agentsh |
| Maturity and packaging | A prototype in its first release, by one maintainer, with no independent security audit. One install script and release archives on GitHub. | v0.20.5, Apache-2.0. Packages: .deb, .rpm, .apk, Arch, musl tarballs, a Homebrew cask for macOS. Starter policies, and an SDK (@agentsh/secure-sandbox) with adapters for hosted sandbox providers. release v0.20.5READMEdocs: starter policiesdocs: secure-sandbox | agentsh |
| Fleet management | None. One wardend per machine, configured on that machine. | Watchtower, a separate Canyon Road product: central policies, approval routing to Slack, email and SMS, SIEM export, a kill switch. agentsh itself works standalone. We have not checked Watchtower's terms. docs: scaling with Canyon Road | agentsh |
| Where a human approves | The project's own phone app (Android, iOS): a push wakes it, and before it signs an allow for a dangerous or root command it asks for biometrics or the device passcode. Or wardenctl in a terminal. | Approval modes, quoted from their docs: "local_tty - Terminal prompt (default)", "totp - Authenticator app codes", "webauthn - Hardware security keys (YubiKey)", "api - Remote approval via REST". Routing to Slack, email and SMS is Watchtower. docs: authenticationdocs: scaling with Canyon Road | WardenClaw |
| What an approval is | An Ed25519 signature made by a key stored on the phone, over the sha256 digest of the exact command envelope, with a single-use nonce and a ±60 s window. wardend verifies it before the kernel continues the exec. | A rule with decision: approve pauses the operation until a person answers; a timeout denies by default. Their docs do not describe what a TOTP code or a WebAuthn assertion is bound to, and we have not verified it. docs: policy modeldocs: authentication | Trade-off |
| Audit log | Hash-chained journal, each record signed with the supervisor's Ed25519 key, so a third party checks it with the public key alone. Known gap: records cut from the end pass wardend verify-journal. | "Audit logs can be chained with HMAC signatures for tamper detection": HMAC-SHA256 or SHA512, verified with agentsh audit verify and the HMAC key, which can live in a KMS. Events export through OpenTelemetry. docs: audit log integrity | Trade-off |
| How the approver reaches the gate | wardend keeps one outbound WebSocket to a relay, so the machine needs no public address and no inbound port: wardend has no network listener, only a local unix socket. Messages are encrypted end to end (X25519, XChaCha20-Poly1305); the relay sees ciphertext. The cost: if the relay is unreachable no approval arrives and the command is denied, and the default relay is run by this project. Self-hosting it needs a Cloudflare account. | Local by default (a terminal prompt). Remote approval is the REST api mode of the agentsh server, or Watchtower. Their docs describe no relay service in between. docs: authenticationdocs: scaling with Canyon Road | Trade-off |
| Keeping the agent away from root | The system install takes the agent's user out of the sudo and docker groups; root commands go through wardend rootexec, one command per approved card (read-only docker and systemctl run without one). | Policy rules on commands, files and signals, capability dropping, Landlock deny paths for container sockets. We found no equivalent of a per-command root broker in their docs; that is not a claim that none exists. docs: security modesdocs: policy model | Trade-off |
Sources
Every statement about agentsh comes from its own documentation or repository. agentsh is a project of Canyon Road; WardenClaw is not affiliated with it. The pages behind each row:
- What is intercepted. agentsh docs: overview, agentsh docs: database proxy, agentsh docs: MCP security WardenClaw: site/src/claims.ts (SCOPE: "Only exec is gated"), daemon/seccomp.go
- Kernel mechanisms. agentsh docs: security modes WardenClaw: daemon/README.md, daemon/seccomp.go
- Decisions a rule can make. agentsh docs: policy model, agentsh docs: steering WardenClaw: daemon/policy/rules.go, site/src/docs/cli.en.md (policy modes)
- Platforms. agentsh docs: platform support, agentsh README WardenClaw: site/src/claims.ts (platforms)
- Maturity and packaging. agentsh release v0.20.5, agentsh README, agentsh docs: starter policies, agentsh docs: secure-sandbox WardenClaw: site/src/claims.ts (eyebrow, description), AUTHORS, daemon/install.sh
- Fleet management. agentsh docs: scaling with Canyon Road WardenClaw: daemon/README.md
- Where a human approves. agentsh docs: authentication, agentsh docs: scaling with Canyon Road WardenClaw: app/src/core/safety.ts (needsOwnerCheck), relay/src/push.ts, site/src/docs/cli.en.md
- What an approval is. agentsh docs: policy model, agentsh docs: authentication WardenClaw: site/src/claims.ts (SCOPE: "Forged and replayed approvals"), protocol/README.md
- Audit log. agentsh docs: audit log integrity WardenClaw: daemon/journal/, site/src/claims.ts (SCOPE: "A cut journal tail passes the check")
- How the approver reaches the gate. agentsh docs: authentication, agentsh docs: scaling with Canyon Road WardenClaw: protocol/README.md (section 5), daemon/README.md (relay transport), relay/README.md
- Keeping the agent away from root. agentsh docs: security modes, agentsh docs: policy model WardenClaw: site/src/docs/install.en.md, daemon/rootexec.go
How this was made: we read the agentsh documentation (text generated 2026-06-29) and the repository README, and checked every WardenClaw cell against this repository. Nothing was measured or tested on agentsh. Where their docs are silent the cell says so.