ClawQL is infrastructure for agents that do real work in production. Protocol translation, memory, documents, security, streaming, and fine-tuning — one system.
This is the short map. Deeper cuts live in Seven Surfaces, One Catalog, Memory Finds. Ontology Decides., The Session Nobody Started, Correctness by Construction, and When Rubrics Become Rewards.
Protocol Fabric — both directions
The protocol layer runs both ways.
ClawQL Core takes any API surface and makes it callable as an MCP tool — REST / OpenAPI, GraphQL, gRPC, WebSocket, native MCP servers, a generated CLI, a QR stream from an air-gapped system.
mcp-api-adapter runs the other direction. It takes any MCP server and exposes its tool catalog as whatever surface a consumer needs: REST, GraphQL, gRPC, WebSocket, native MCP, a generated CLI, a QR stream for maximum-security environments.
A gRPC service talks to a GraphQL consumer. A WebSocket stream becomes a REST endpoint. Protocol to protocol, any direction, with MCP as the common layer. Seven surfaces. One catalog.
Memory
ClawQL vault memory persists decisions, findings, and runbooks across sessions and agents. memory_ingest writes structured Markdown with wikilinks. memory_recall retrieves with keyword search, wikilink graph traversal, vector search, and structured predicate filters for exact field matching.
The ontology layer goes further. Domain schemas define typed fields for entities in your industry — legal matters, lending applications, government programs. Queries run as predicate evaluation against a typed index without reading every document in sequence.
Documents
The IDP pipeline processes documents before agents touch them. Multiple vendors in the stack: pdf-inspector classifies PDFs and routes scanned pages to OCR; Docling handles layout-aware extraction for forms and complex layouts; Gotenberg normalizes files to PDF; Stirling redacts PII and splits or merges files; Onyx indexes the results for hybrid search. Agents that read processed documents get structured, redacted, indexed content — not raw files.
Streams
A ClawQL Streams stream_subscribe call points at any event source: a WebSocket feed, a NATS subject, a webhook, a cron schedule, an API polled on an interval, a QR stream from an air-gapped system. When an event arrives, a significance filter decides whether to wake an agent. The agent runs, uses the full ClawQL tool surface, writes findings to the WORM audit trail, and goes back to listening. The event source fires. The agent acts. No human starts the session.
Security
ATR scoping limits what each agent can call. An agent declared with access to memory and search cannot call execute regardless of what the prompt says. Panguard enforces this at tool-call time. Fail-closed: a policy deny is the default when scope is unclear.
Cosign-signed container images. Kyverno Kubernetes admission enforcement. OSV-Scanner and Trivy gates in CI. A working system with verifiable controls.
For regulated environments there is clawql-tee: a Durable Objects–compatible runtime that supports AMD SEV-SNP, Intel TDX, and AWS Nitro Enclaves. Hardware attestation proves what software is running. Vault only releases secrets after attestation verification. GPU confidential computing keeps model weights and inference inputs away from the host. The audit trail can leave the trusted execution environment through a QR optical channel — fountain codes, ChaCha20 encryption, HMAC per symbol, Merkle verification of the reconstructed payload. A camera outside scans what the screen inside shows. No network path crosses the boundary.
The training flywheel
Every agent session produces a trace. ClawQL captures these as RTP records — structured, schema-typed, provenanced training data. Passing traces become SFT data. Paired passing and failing traces on the same task become DPO pairs. Verifiable reward functions feed GRPO directly.
Better sessions produce better traces. The dataset grows. The next fine-tune starts from a larger, higher-quality base. The agents that run on ClawQL generate the data that makes them better.
Open source
Apache 2.0. Self-host free. The full stack runs on your hardware with no license fee.
Start free trial · Self-host free · GitHub
Further reading
- Seven Surfaces, One Catalog — Protocol Fabric bidirectional
- Memory Finds. Ontology Decides. — vault + CQE
- The Session Nobody Started — event-triggered Agent cells
- Correctness by Construction — Erlang · OxCaml · SPARK → cellrt / TEE
- When Rubrics Become Rewards — RTP → SFT / DPO / GRPO
- The $150,000 Invoice — IDP cost reality
- Hardened Agentic Stack — defense-in-depth curriculum