Skip to main content

​
What is Declaw?

Declaw provides secure sandboxes for AI agents. When your agent needs to execute code, run shell commands, or call external APIs, Declaw isolates that execution in a sandbox and can transparently intercept its outbound traffic before it leaves the sandbox. Every sandbox is a full Linux environment with its own filesystem, process tree, and network namespace. When you turn on a security control — PII redaction, injection defense, a domain allowlist, transformation rules or custom policy — the security proxy sits between the sandbox and the internet and scans HTTP and HTTPS requests for PII, prompt injection payloads, and policy violations, without requiring any changes to the code running inside. Isolation is always on; scanning is what you switch on. A sandbox created with no security policy still gets microVM isolation and the platform floor: dangerous commands are refused, cloud-metadata/IMDS endpoints are blocked, and — on Declaw Cloud — privileged syscalls are refused by the guest kernel. What it does not get is PII redaction, injection scanning, or egress filtering beyond that floor — those start when you configure them. See Security Overview for what each control covers.

sandbox MicroVM Isolation

Each sandbox runs in a dedicated VM with an independent filesystem, process tree, and network namespace. No sandbox can see or affect another.

edge proxy Security Proxy

A transparent TLS interceptor sits on the network path out of every sandbox. It inspects both HTTP and HTTPS traffic before it reaches the internet.

PII Redaction

Automatically detect and redact SSNs, credit card numbers, email addresses, phone numbers, API keys, and more in outbound HTTP request bodies.

Prompt Injection Defense

Score outbound LLM API calls against a prompt injection detection model. Block or audit requests that carry adversarial instructions.

Network Policy Engine

Domain allowlists, denylists, and IP CIDR rules enforced at the TCP layer. Block cloud metadata service access (169.254.169.254) by default.

Audit Logging

Record every intercepted request, PII detection, policy violation, and blocked connection. Query audit entries from the SDK.

​
Why Declaw?

AI agents execute code that neither you nor the agent fully controls. The agent might:
  • Receive a prompt injection payload hidden in a web page it scraped
  • Call an LLM API with a user’s SSN or credit card number in the request body
  • Exfiltrate credentials to an attacker-controlled endpoint
  • Access the cloud metadata service to steal instance credentials
Standard process isolation or Docker containers address none of this. They do not inspect outbound traffic, do not detect PII, and do not defend against prompt injection at the network layer. Declaw solves these problems by combining VM-level isolation with a programmable security proxy:

​
Key Concepts

  • Sandbox — a sandbox with its own filesystem, processes, and network namespace. Created on demand, destroyed after use.
  • Security Policy — a single object that composes PII config, injection defense, network rules, transformation rules, and audit settings. Attached to a sandbox at creation time.
  • envd — a lightweight HTTP daemon running inside every VM that exposes the filesystem and process APIs used by the SDK.
  • Security Proxy — the transparent edge proxy interceptor that sits on every packet leaving a sandbox. Only activated when a SecurityPolicy requires TLS interception.
Read the Concepts page for a full mental model, or jump straight to the Quickstart to run your first sandbox in five minutes.