ClaudeClaw
Persistent agent orchestrator plugin for Claude Code. Multi-channel message routing, structured memory, webhook triggers, cost tracking — with OS-level sandbox isolation.
Built on NanoClaw — ported to a Claude Code plugin architecture with a pluggable extension system and Anthropic's sandbox runtime.
What It Does
ClaudeClaw is a Claude Code plugin that provides an always-on message loop. It listens to channels (Slack, WhatsApp, Telegram), routes messages to Claude agents running in isolated sandboxes, and manages ongoing conversations with structured memory.
Core (Orchestrator)
- Always-on message loop — persistent listener, not one-shot
- Multi-channel routing — Slack, WhatsApp, Telegram (pluggable)
- Thread management — auto-create threads, follow-ups without re-mentioning
- Context accumulation — messages batch between triggers
- Structured memory — daily logs, topic files, searchable archive with QMD upgrade path
- Webhook triggers — HTTP POST with HMAC-SHA256 auth for CI/CD, GitHub, monitoring
- Per-group agent config — model, tools, system prompt, cost limits per group
- Cost tracking — token usage and estimated cost per agent run
- Extension system — plug in triage, SWE queue, or custom capabilities
- Dual runtime — OS-level sandbox (default) or container isolation
Triage Extension
- First-level support agent — investigates bugs, analyzes feature requests
- Answers users in plain language (no code in user threads)
- Creates GitHub issues when code changes are needed
- Posts to dev channel for technical visibility
- SWE task queue for sequential coding work
Quick Start
git clone https://github.com/sbusso/claudeclaw.git
cd claudeclaw
claude
# type: /setup
/setup handles everything interactively: dependencies, runtime selection (sandbox is the default), channel authentication via platform APIs, group registration, and service startup.
Runtime Options
ClaudeClaw supports two agent execution runtimes. Set RUNTIME in .env:
| Sandbox (default) | Container |
|---|
| Cold start | <10ms | ~2-5s |
| Memory overhead | None | VM per container |
| Network isolation | OS-level allowedDomains | Full outbound (credential proxy mitigates) |
| Credential model | Direct credentials + restricted network | Proxy service |
| Setup | npm install | Container daemon + image build |
| Filesystem isolation | Kernel-enforced read/write boundaries | Volume mounts |
Sandbox Runtime (Recommended)
Uses Anthropic's @anthropic-ai/sandbox-runtime for OS-level process sandboxing. On macOS it uses Apple's Seatbelt framework; on Linux, bubblewrap. No containers, no VMs — kernel-level restrictions on an ordinary process.
# .env
RUNTIME=sandbox
Security model: Real credentials are passed to the agent, but network is restricted to api.anthropic.com and localhost only. There's nowhere to exfiltrate credentials to. Filesystem access is kernel-enforced per the generated settings file — the agent for a family chat literally cannot read files from a work channel's directory.
Agents run with permissionMode: 'bypassPermissions' — the sandbox IS the trust boundary, not application-level permission checks.
Container Runtime
Uses Apple Container (macOS) or Docker for container-based isolation. Agents run in Linux VMs with volume mounts. A credential proxy on localhost injects real API keys — containers never see actual credentials.
# .env
RUNTIME=container
Per-group override: set "runtime": "sandbox" in the registered group config to use sandbox for specific groups while others use containers.
Agent Triggers
ClaudeClaw agents can be triggered three ways:
