Shibaclaw
🐕 Self-hosted security-first AI agent · 22 providers · 11 chat channels · WebUI · 3-level memory · cron · heartbeat · skills · MCP
Last verified:
What is Shibaclaw?
ShibaClaw is a security-first AI agent framework designed for terminal, desktop, and browser use, with support for 11+ messaging channels including Telegram, Discord, Slack, and WhatsApp. Built on three pillars—Simplicity, Security, and Privacy—it integrates security defenses directly into its core rather than relying on external proxies. The agent provides multi-session chat, long-term memory consolidation, scheduled automation via cron, and compatibility with the Model Context Protocol (MCP) for extensibility.
Key features include a built-in WebUI with live streaming of tool calls, cross-provider model search merging 22+ LLM providers into one searchable picker, per-session model switching, and Agent Profiles (Hacker, Builder, Planner, Reviewer, Default) that override system prompts without losing context. The system supports a Windows Desktop Launcher with system tray integration, auto-login, and embedded WebUI, plus voice capabilities via speech-to-text and browser-native TTS.
ShibaClaw is designed for developers, security professionals, and AI workflow enthusiasts who need a reliable, self-hosted AI agent that 'just works' without babysitting. It appeals to users who value privacy (self-hosted), security (CVE auditing, prompt-injection wrapping), and flexibility (multi-provider support, MCP ecosystem, 8 built-in skills). The 3-level memory system (USER.md, MEMORY.md, HISTORY.md) with proactive learning makes it suitable for long-term project continuity.
Shibaclaw pricing
Pricing model: Freemium
ShibaClaw is completely free and open-source under the Apache-2.0 license. No paid tiers exist. Installation is free via pip (pip install shibaclaw), Docker Compose (pulls from Docker Hub), or pre-built Windows executable from GitHub releases. The tool itself has no costs, but users must provide their own LLM API keys. Free options include OpenRouter's free models (nvidia/nemotron-3-super-120b-a12b:free, gemma-4-31b-it:free) and GitHub Copilot OAuth integration which provides unlimited premium model access (raptor/oswe-vscode-prime) at zero additional cost beyond existing Copilot subscription.
Shibaclaw pros
- Install-time CVE auditing for pip, npm, and apt packages
- Prompt-injection wrapping with randomized XML boundaries on every tool result
- Built-in SSRF and DNS-rebinding protection
- Shell hardening with 20+ deny patterns and escape normalization
- Workspace sandboxing for file tools
- Bearer token authentication with constant-time checks
- 22 native LLM provider supports without LiteLLM proxy
- 11 chat channel integrations including Telegram, Discord, Slack, WhatsApp
- Built-in WebUI requiring no separate Node.js frontend
- Per-session model switching with cross-provider search
- 5 built-in Agent Profiles with dynamic system prompt overrides
- 3-level memory system with proactive learning and auto-compaction
- Windows Desktop Launcher with system tray integration
- MCP ecosystem compatibility for instant extensibility
- Timezone-aware cron service with persistent job storage
- Native WebSocket streaming for real-time tool call visibility
- Automated update system checking GitHub releases every 12h
- Free model access via OpenRouter including nemotron-3-super-120b
- GitHub Copilot OAuth gives unlimited premium model access at zero cost
Shibaclaw cons
- Windows Desktop Launcher only available for Windows, not macOS/Linux
- Docker localhost connections require host.docker.internal for local servers
- WhatsApp channel requires Node.js bridge (Baileys) for QR linking
- Notification Center still marked as WIP (work in progress)
- Some security features like rate limiting are optional not default
- Memory consolidation requires separate model configuration for optimal results
- Large repositories may take 30-120 seconds for DeepWiki queries
- WebUI authentication bypass for desktop only works locally not remotely
Frequently asked questions about Shibaclaw
What makes ShibaClaw different from other AI agent frameworks?
ShibaClaw integrates security defenses directly into its core architecture rather than relying on external proxies or glue code. It is the only framework with install-time CVE auditing for pip/npm/apt, prompt-injection wrapping with randomized boundaries on every tool result, and built-in SSRF/DNS-rebinding protection. It also offers 22 native provider supports, 11 chat channels, a built-in WebUI, and a 3-level proactive memory system—all without requiring LiteLLM proxy or separate frontend setup.
How do I install ShibaClaw?
You can install via pip (pip install shibaclaw, then shibaclaw web --with-gateway), Docker Compose (download docker-compose.yml and run docker compose up -d), or download the pre-built Windows executable from GitHub releases. First-time setup includes an onboard wizard (shibaclaw onboard for CLI or WebUI wizard at http://localhost:3000) to configure a provider, enter API key, and choose a model.
What LLM providers does ShibaClaw support?
ShibaClaw supports 22 providers natively including OpenAI, Anthropic, DeepSeek, Google Gemini, Groq, Moonshot, MiniMax, Zhipu AI, and DashScope via API keys. It also supports gateway/proxy providers like OpenRouter, AiHubMix, SiliconFlow, VolcEngine, and BytePlus. Local models work via Ollama, LM Studio, llama.cpp, vLLM, or any OpenAI-compatible endpoint. OAuth is available for GitHub Copilot, OpenAI Codex, and OpenRouter.
How does the 3-level memory system work?
The system has USER.md (identity & preferences storing durable personal facts and communication styles), MEMORY.md (operational state tracking environment details and project state), and HISTORY.md (append-only searchable session archive). A proactive learning loop silently extracts new facts every N messages and updates USER.md/MEMORY.md without interrupting conversation. Auto-compaction summarizes MEMORY.md when it grows too large, and TF-IDF + recency scoring searches HISTORY.md for older context.
What is prompt-injection wrapping and why does it matter?
ShibaClaw wraps every tool result in a dynamically generated XML-like boundary with randomized nonce (e.g., <tool_output_a1b2c3d4>). This prevents attackers from injecting fake system instructions inside tool outputs like web page content. The randomized boundary is generated per-iteration, and closing tags inside content are automatically sanitized. This standalone defense is also packaged as a zero-dependency library called Muzzle for use with other agent frameworks.
Can I use ShibaClaw without paying for API keys?
Yes. ShibaClaw itself is free and open-source. You can use OpenRouter to access powerful free models like nvidia/nemotron-3-super-120b-a12b:free or gemma-4-31b-it:free. Additionally, GitHub Copilot OAuth integration provides unlimited access to premium models like raptor (oswe-vscode-prime) at zero additional cost beyond your existing Copilot subscription.
What are Agent Profiles and how do I use them?
Agent Profiles are per-session personas (Default, Builder, Planner, Reviewer, Hacker) that override the system prompt (SOUL.md) while keeping model, memory, and tools shared. The Hacker profile is a security expert with 50+ tool recommendations and OWASP/MITRE/NIST methodologies. You switch profiles per session in the WebUI footer, allowing you to run a security audit in one tab and plan architecture in another. You can also create custom profiles interactively—the agent walks you through defining the persona.
How does MCP (Model Context Protocol) integration work?
ShibaClaw is fully compatible with MCP, allowing you to connect any MCP-compliant server (stdio, SSE, or streamable HTTP). Tools from MCP servers auto-register as mcp_<server>_<tool>. You configure MCP servers directly in the Settings panel. This enables instant extensibility with community-made MCP servers for Google Drive, Slack, GitHub, PostgreSQL, and more, transforming ShibaClaw into a plug-and-play AI hub without modifying core code.
What automation features does ShibaClaw include?
ShibaClaw has a timezone-aware cron service storing persistent scheduled jobs in jobs.json, supporting every, cron, and at schedules with overdue jobs firing on startup. It also has Heartbeat—a periodic wake-up that reads HEARTBEAT.md with frontmatter for session/profile/targets, skipping the LLM entirely when Active Tasks is empty and only asking the model when real work exists. Both are configurable via the WebUI Settings panel.
How do I troubleshoot connection or provider issues?
Run shibaclaw status for general provider, workspace, and OAuth health checks. For Docker users, check container logs with docker logs shibaclaw-gateway or docker logs shibaclaw-web. If WebUI won't connect, verify the token with shibaclaw print-token and check port binding. Provider errors show API key and OAuth state in shibaclaw status. For security policy details, refer to SECURITY.md in the repository.