FireClaw
A free firewall for AI agents that browse the web — it strips hidden prompt-injection attacks out of pages before the agent ever reads them.
🔗 Visit FireClaw
Description
An AI agent that browses the web to complete a task is also reading whatever text is on that page — including text a malicious site owner deliberately hid to hijack the agent's instructions (a 'prompt injection' attack). FireClaw sits between the agent and the internet and cleans that content before it ever reaches the agent's context, the same way a spam filter cleans email before it reaches your inbox.
FireClaw is an open-source security proxy built around a 4-stage pipeline: DNS-level blocking of known-malicious domains (using threat feeds like URLhaus and PhishTank), structural sanitization of page content, isolated LLM summarization to strip embedded instructions, and output scanning against 200+ known injection patterns. It assigns domains to trust tiers (trusted/neutral/suspicious/blocked), includes canary-token detection to catch exfiltration attempts, enforces rate limiting and cost controls, and logs everything to JSONL for audit. Notably, it has 'no bypass mode' — the pipeline can't be disabled, which is a deliberate design choice to prevent accidentally shipping an agent with protection turned off. It's free, open-source under AGPLv3.
💬 Our review
The short version: FireClaw is a genuinely useful piece of infrastructure for anyone building an AI agent that fetches and reads live web content, addressing prompt injection with actual layered defenses rather than just a system-prompt warning.
The 4-stage pipeline is meaningfully more rigorous than the 'just tell the model to ignore instructions in fetched content' approach most agents rely on — combining DNS reputation, structural stripping, isolated summarization, and pattern scanning gives real defense in depth. The 'no bypass mode' design choice is also a smart guardrail against the common failure mode of security features getting quietly disabled for convenience during development and never turned back on.
The honest gaps: it's an early project (17 stars, 1 fork), so the injection-pattern database and domain trust tiers will need to mature over time as new attack techniques appear, and running an extra proxy adds latency and a dependency to your agent's pipeline. For anyone shipping an agent that autonomously browses the open web, it's a much better starting point than no protection at all; for agents that only ever touch a small, trusted set of internal sources, the risk it addresses may not apply.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Entièrement gratuit et open-source (AGPLv3) ; dons optionnels.
Pros
Pipeline de défense en 4 étapes contre l'injection de prompt
Mode 'no bypass' — impossible de désactiver la protection par accident
Listes noires DNS + détection par canary tokens
Journal d'audit complet en JSONL
Cons
Projet encore jeune (17 étoiles, 1 fork)
Base de motifs d'injection encore en maturation
Ajoute une latence de proxy supplémentaire au pipeline de l'agent