Declaw

Most agent security stacks are assembled from parts: a sandbox vendor, a guardrails vendor, DIY network filtering, and a separate audit log — none of which share context. Declaw replaces that with a single SDK wrapping Firecracker microVMs. You create a sandbox, attach a security policy, and your agent runs inside a hardware-isolated VM whose outbound traffic is inspected by a proxy it cannot circumvent. PII is redacted and optionally rehydrated, prompt injection attempts are blocked, and every event — boot, egress decision, redaction, credential injection — lands in a structured audit log.

The differentiating feature is that the network controls and guardrails are not layered on top of the sandbox after the fact — they are enforced at the egress proxy as a condition of the VM’s execution context. The vendor states that API keys stored in the credential vault are injected into outbound requests at the proxy layer, so the secret value is never visible inside the VM. L3/L4 filtering handles IP and CIDR ranges at the kernel level; L7 inspection adds domain and SNI matching with exact, wildcard, and regex patterns, giving you fine-grained control over what an agent can reach.

Declaw fits teams shipping agents where a prompt injection or credential leak would be a production incident: financial data pipelines, customer-facing agents with access to external APIs, or any workflow where you need a tamper-evident record of what the agent did and what it touched. It integrates drop-in with OpenAI, Anthropic, LangChain, CrewAI, and any OpenAI-compatible API — the docs describe no code changes required for existing agent code. The ceiling appears for teams that cannot route traffic through a third-party cloud proxy under any circumstances: Declaw offers no self-hosted deployment path, so air-gapped environments and strict data-residency requirements are out of scope.

The SDK ships in Python, Node, and Go. Snapshots freeze the full guest state — memory, CPU registers, and disk — so long-running agents can be paused to stop compute billing and resumed exactly where they left off. Volumes provide up to 64 GiB of persistent storage attachable across sandboxes in either copy-on-boot or live-mount mode, covering agent workflows that need to read and write shared datasets across executions.