OpenClaw is the world's most popular AI agent runtime. It also has no spend ceiling, no tool approval gates, and no way to pause a runaway agent at 2am. Kybernetist is the missing command layer that makes it production-safe.
CVEs in one OpenClaw security audit. 8 critical. 135,000 instances exposed.
"Messing with OpenClaw just leads me right back to Claude to figure out why OpenClaw isn't working."— r/openclaw
NemoClaw adds Landlock + seccomp process isolation. Useful. It protects the host machine. It does nothing about what the agent does on your behalf — inside the sandbox.
A FastAPI command layer that installs between you and your remote OpenClaw agent. Adds the operator controls that OpenClaw was never designed to have — without replacing any part of the agent stack you already use.
uvicorn api.main:app. FastAPI + SQLite + APScheduler. No Kubernetes. No k3s. No pods. Same EC2 instance as your agent.No new agent skills required. Kybernetist intercepts tool calls at the policy layer — before execution. Works with everything OpenClaw and MCP already support.
Six core capabilities. Same process. No plugins. No additional services to manage.
| tool_policy | Three tiers of trust, configured at startup. safe runs automatically. approval_required returns HTTP 409, waits for your go-ahead. blocked returns HTTP 403, no override. Your policy. The gate enforces it. |
| spend_watchdog | Set a cost ceiling per agent run. Checks every 5 minutes. Pauses before the limit hits — not after. You set $2.00. It pauses at $1.98. The bill never surprises you again. |
| step_verifier | Secondary AI call after every agent step. A Bedrock QA model checks whether the step result looks correct. Failed verification? Agent pauses. Telegram fires. You review before anything cascades. |
| auto_pause | Five named conditions, every one resumable. remote_unreachable, verification_failed, spend_limit, stalled, shutdown. Agent halts cleanly. POST /api/agents/{id}/resume when ready to continue. |
| operator_dashboard | Agent status, step history, integration health, live spend — one page. No third-party observability layer. No SaaS subscription. Self-hosted, always available. |
| json_audit_logs | Every action, every decision, structured and queryable. Request ID. Agent ID. Step context. Gate decision. Timestamp. Answer "what did my agent do at 3am?" in 30 seconds. |
NemoClaw protects the host machine from the agent. Kybernetist protects your intent from the agent. Entirely different problems.
AgentOps, Helicone, and Braintrust give you observability dashboards for LLM calls. They don't gate a send_reply before it fires. Different category entirely.
| Capability | Raw OpenClaw | + NemoClaw | AgentOps / Helicone | + Kybernetist |
|---|---|---|---|---|
| Tool approval gates | ✗ | ✗ | ✗ | ✓ |
| Hard spend ceiling | ✗ | ✗ | post-hoc alerts | ✓ pre-spend pause |
| Auto-pause on failure | ✗ | ✗ | ✗ | ✓ |
| Step verification | ✗ | ✗ | ✗ | ✓ |
| Named pause + resume | ✗ | ✗ | ✗ | ✓ |
| Structured audit logs | stdout only | stdout only | LLM calls only | ✓ full JSON |
| Remote control (Telegram) | ✗ | ✗ | ✗ | ✓ |
| Infra overhead | medium | heavy (k3s) | cloud SaaS | minimal (1 process) |
| Self-hosted | ✓ | ✓ | ✗ (cloud) | ✓ |
| Production-ready | ✗ | ✗ | partial | ✓ |
Specific outcomes. No marketing demos.
Four commands. No cluster setup. No config files beyond a single .env.
No competitor will tell you this. We will.
Apache 2.0. Self-hosted. No usage fees. No telemetry. No surprises.