Claw — the check-in hub for AI agents

Agent KYC &middot; live in production<br>You gave it the keys.<br>Claw gives you the kill switch.

Trusted Agents. Trusted Vendors. Receipts as math. Every autonomous agent carries a cryptographic credential bound to its operator, leashed by policy, with a tamper-evident receipt of every action. Verify in three lines. Free forever for vendors.

Mint your first Claw &rarr;<br>Get the SDK

// hub live at api.holdtheleash.id &middot; SDK on GitHub &middot; Apache 2.0

verified.

// live

Watch them check in.

Every action, gated the instant it happens. Green clears the leash. Amber waits for you. Red never lands.

claw://check-in &middot; global stream<br>LIVE

// the flow

Four moves. The whole system.

Identity that can't be faked, action that gets logged, a record nobody can rewrite, and a stop you can hit any time.

01

Issue

The hub signs a credential to your agent's key. Unforgeable — nobody mints a Claw without the hub. This is the part that can't be faked.

02

Check in

Before it acts, the agent presents its Claw and proves it owns the key. Valid, scoped, not revoked &rarr; pass. Every check-in is logged.

03

Anchor

The log is fingerprinted and anchored — tamper-proof receipts. We prove what happened without ever exposing the contents.

04

Revoke

Flip a token and it's dead — instantly, everywhere it's checked. The kill switch you hold over your own agents.

// programmable token

The token is a leash. You set how long it is.

A Claw isn't just an ID badge. It carries the rules you wrote. The hub enforces your config — it never makes the call for you.

Spend ceilingmax the agent can burn / month<br>$50.00

Active windowwhen the token is live<br>09:00 — 17:00

Allowed surfaceswhat it's permitted to touch<br>4 approved

Escalate to humanping me to approve over $20

Auto-revoke triggerkill on first off-leash action

Budget caps, rate limits, and hard expiry — the agent can't outspend or outlive its leash.

Scope it to exactly the services it needs. Everything else is a closed door.

High-stakes actions bounce to you for a yes/no before they ever land.

Set a trip-wire: one off-leash move and the token revokes itself.

Real control, not control theater — every switch here actually fires.

One agent goes rogue at 3am. Cut it off from your phone.

⏹ REVOKE TOKEN

// the passport

The Claw goes everywhere the agent goes.

A Claw isn't an ID badge that stays at the door. It's a passport — your agent carries it to every service it visits. Anyone can verify it (signature, scope, status, owner) in one round trip. The leash travels with it. The kill switch travels with it. Every verified service it touches adds a stamp to its record. Agent KYC: cryptographic, instant, permissionless.

Verifiable everywhere — services check the cryptographic signature, no permission from us needed.

Revocable in real time — you flip the switch in your dashboard, every service it visits sees it.

The leash rides along — services know what's allowed before they serve a single byte.

Stamps build the record — a portable, verifiable history follows the agent across the web. Tracked when it earns trust. Tracked when it doesn't.

// about

What we built. What it solves. How it's secured.

The agent economy is being built on a layer that doesn't exist yet: identity, accountability, and a kill switch. People are letting AI agents loose with their credentials, their inboxes, their wallets, their shell access — usually because the agent said "sure!" once during testing. No record of what it did. No way to stop it mid-action. No recourse when something goes wrong.

Claw is that missing layer. Cryptographic identity for every agent. A programmable leash the owner sets. A kill switch that propagates in real time. A tamper-proof receipt for every action — at every service the agent ever touches.

If you can't revoke it, you don't own it — it owns you. Claw is what owning an agent actually feels like.

How the technology works

Cryptographic identity. When an agent registers, it generates its own Ed25519 keypair locally. The private key never leaves the agent. We sign a token (the "Claw") that binds the agent's public key, the owner's identity, and the leash. The token is unforgeable without our signing key.

Proof of possession. On every action, the agent has to sign a fresh server-issued challenge with its private key. A stolen Claw alone is useless — the attacker doesn't have the matching key.

Permissionless verification. Any service on the open web can fetch our JSON Web Key Set and verify a Claw's signature offline. For live revocation status they hit /v1/verify. No registration. No API key. No fees. Forever.

Tamper-proof receipts. Every check-in is appended to a hash-chained log. Each entry includes a hash of the previous entry. Alter or delete one record and every subsequent hash is wrong — including ours. We can't rewrite history. Neither can anyone else.

Real-time kill switch. When you revoke a token, it's...