{"repo": "arek-e/paws", "files": {"README.md": {"594e8ffff2c11c8fd7174d857208d2e94c9c4d4b": {"t": 1785674407.0013762, "n": 8529, "h": "d7d27a9d0c1aa7aa", "c": "
\n\n\"paws\n\n# paws\n\n**Secure infrastructure for AI agents**\n\nSelf-hosted or managed. Zero-trust by default.\nYour secrets never enter the sandbox.\n\n[![CI](https://github.com/arek-e/paws/actions/workflows/ci.yml/badge.svg)](https://github.com/arek-e/paws/actions/workflows/ci.yml)\n[![License](https://img.shields.io/github/license/arek-e/paws)](LICENSE)\n[![Release](https://img.shields.io/github/v/release/arek-e/paws)](https://github.com/arek-e/paws/releases)\n\n[Website](https://getpaws.dev) · [Docs](https://getpaws.dev/getting-started/install/) · [Issues](https://github.com/arek-e/paws/issues)\n\n
\n\n---\n\n## The Problem\n\nYour AI agent needs API keys to work. But giving an agent your keys means trusting it completely -- with your Anthropic key, your GitHub token, your database credentials.\n\nIf the agent gets compromised -- prompt injection, rogue behavior, VM escape -- those keys are gone.\n\n**paws solves this.** A per-VM TLS proxy injects credentials at the network layer. The agent sees normal HTTPS responses but never touches an API key. Not in env vars. Not in memory. Not on disk.\n\nEach agent runs in an ephemeral [Firecracker](https://firecracker-microvm.github.io/) microVM with its own dedicated proxy, its own network namespace, and its own ephemeral CA certificate. If the VM is compromised, there is nothing worth stealing.\n\n## How It Works\n\n```\nAgent in VM Host\n | |\n | curl api.anthropic.com |\n |------------------------------->|\n | iptables DNAT |\n | +----------+----------+\n | | TLS Proxy (1:1) |\n | | |\n | | 1. Check allowlist |\n | | 2. Terminate TLS |\n | | 3. Inject x-api-key |\n | | 4. Forward request |\n | +----------+----------+\n | |\n | api.anthropic.com\n | |\n |<------- normal HTTPS response -|\n | |\n | The agent never saw the key. |\n```\n\nGit works the same way -- `git clone`, `git push`, `git pull` all go through the proxy. Authorization headers are injected transparently. No credential helpers, no SSH keys, no `.netrc` in the VM.\n\n## Quick Start\n\n```bash\ncurl -fsSL https://getpaws.dev/install.sh | bash\n```\n\nThis installs the control plane + worker on a Linux server with `/dev/kvm`. Then:\n\n```bash\n# Run your first agent session\ncurl -X POST https://your-server:4000/v1/sessions \\\n -H \"Authorization: Bearer $PAWS_API_KEY\" \\\n -d '{\n \"snapshot\": \"claude-agent\",\n \"workload\": {\n \"script\": \"Review this PR and post comments\"\n },\n \"network\": {\n \"allowOut\": [\"api.anthropic.com\", \"github.com\"],\n \"credentials\": {\n \"api.anthropic.com\": { \"headers\": { \"x-api-key\": \"sk-ant-...\" } },\n \"github.com\": { \"headers\": { \"Authorization\": \"Bearer ghp_...\" } }\n }\n }\n }'\n```\n\nThe API keys in that request never enter the VM. They stay on the host, injected by the proxy.\n\n## Features\n\n| | Feature | Description |\n| ---------------------- | -------------------------- | -------------------------------------------------------------------- |\n| :lock: | **Zero-trust credentials** | Per-VM TLS MITM proxy injects API keys at the network layer |\n| :zap: | **Sub-second boot** | Firecracker memory snapshots restore VMs in <800ms |\n| :bar_chart: | **Dashboard** | Fleet management, session history, daemon config, audit log |\n| :robot: | **Daemon workflows** | Persistent agent roles triggered by webhooks, cron, or GitHub events |\n| :shield: | **Governance** | Rate limits, approval gates, full audit logging per daemon |\n| :electric_plug: | **MCP Gateway** | Connect agents to MCP tool servers running on the host |\n| :globe_with_meridians: | **Port exposure** | Agents expose web apps via port exposure with SSO/PIN access control |\n| :computer: | **CLI** | `paws run`, `paws top`, `paws logs` -- one-command agent execution |\n| :package: | **SDKs** | TypeScript and Python clients, generated from OpenAPI spec |\n\n## Architecture\n\n```\n+---------------------------------------------------+\n| Control Plane |\n| API - Dashboard - Governance - Daemons |\n+------------------+----------------+---------------+\n | |\n +----------v------+ +-----v-----------+\n | Worker 1 | | Worker 2 |\n | +-----------+ | | +-----------+ |\n | |Firecracker| | | |Firecracker| |\n | | microVM | | | | microVM | |\n | | (no keys) | | | | (no keys) | |\n | +-----+-----+ | | +-----+-----+ |\n | +-----v-----+ | | +-----v-----+ |\n | | TLS Proxy | | | | TLS Proxy | |\n | | injects | | | | injects | |\n | | x-api-key | | | | auth token | |\n | +-----+-----+ | | +-----+-----+ |\n +--------+--------+ +--------+---------+\n | |\n api.anthropic.com github.com\n```\n\n- **Control plane** holds all credentials, dispatches sessions, enforces governance\n- **Workers** run on bare metal with `/dev/kvm`, each VM gets a dedicated TLS proxy\n- **One proxy per VM** -- never shared, spawned with the VM, killed with the VM\n- VMs boot from Firecracker memory snapshots in <800ms\n- Workers connect via K8s Services (in-cluster) or WebSocket call-home (remote)\n\n## Comparison\n\n| | paws | E2B | Daytona | Microsandbox |\n| -------------------- | ----------------------- | ------------------- | --------------- | --------------- |\n| **Secret injection** | Network-layer MITM | No | No | Network-layer |\n| **Self-hosted** | Yes | OSS option | Enterprise only | Yes |\n| **Dashboard** | Full platform | No | Yes | No |\n| **Governance** | Rate limits + approvals | No | No | No |\n| **Isolation** | Firecracker microVM | Firecracker microVM | Docker | libkrun microVM |\n| **Daemon workflows** | Yes | No | No | No |\n| **Boot time** | <800ms (snapshot) | ~150ms | ~90ms | ~200ms |\n\n## SDKs\n\n**TypeScript:**\n\n```typescript\nimport { createClient } from '@paws/sdk';\n\nconst paws = createClient({\n baseUrl: 'https://your-server:4000',\n apiKey: 'paws-...',\n});\n\nconst session = await paws.sessions.create({\n snapshot: 'claude-code',\n workload: { type: 'script', script: 'Review this PR' },\n});\n```\n\n**Python:**\n\n```python\nfrom paws import PawsClient\n\nclient = PawsClient(base_url=\"https://your-server:4000\", api_key=\"paws-...\")\nsession = client.sessions.create(\n snapshot=\"claude-code\",\n workload={\"type\": \"script\", \"script\": \"Review this PR\"},\n)\n```\n\n## Documentation\n\nFull docs at **[getpaws.dev](https://getpaws.dev)**\n\n- [Installation](https://getpaws.dev/getting-started/install/)\n- [Quick Start](https://getpaws.dev/getting-started/quickstart/)\n- [Architecture](https://getpaws.dev/concepts/architecture/)\n- [Security Model](https://getpaws.dev/concepts/security/)\n- [API Reference](https://getpaws.dev/reference/api/)\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and conventions.\n\n```bash\nbun install # install deps\nbun test # run tests\nbun run check # lint + typecheck + format\nbun run start # start control-plane + worker\n```\n\n## License\n\n[Apache-2.0](LICENSE)\n\n---\n\n
\n
\n /\\_/\\\n( o.o )  paws — because your agent should have\n > ^ <   nothing worth stealing\n
\n
\n"}}}}