daemonaudit

Who can hurt your AI agent — and how badly.

daemonaudit is a red/blue security audit for self-hosted AI agent daemons. It finds the secrets, the open doors and the weak policies on the machine your agent runs on, then tells you the attack paths and the blast radius: what an attacker gets, from where, and which single fix kills the whole chain.

Supports Hermes Agent and OpenClaw (v0.2). Both are found automatically; a box running both gets one report. Generic MCP configs are on the roadmap.

(above: daemonaudit scan --red against a deliberately-broken demo home — build your own with python scripts/demo_home.py)

Why not just the built-in audit?

Framework auditors ask "is my config right?". daemonaudit asks "what does an attacker standing here actually get?" — and it looks at the host, not just the config: backups, transcripts, sqlite state, process environments, listening sockets, and the skills you installed. Then it chains the findings: an exposed port plus an unsandboxed backend plus keys in the environment is one attack path, and it names the one hop whose fix breaks it.

Install

uvx --from git+https://github.com/TLLABS-dev/daemonaudit daemonaudit scan     # zero-install run
# or
pipx install git+https://github.com/TLLABS-dev/daemonaudit

From a clone:

python -m pip install -e '.[dev]'
daemonaudit scan

Requires Python ≥ 3.10. Dependencies: psutil, rich, pyyaml. Linux, macOS and Windows.

Use

daemonaudit scan                       # passive audit (safe anywhere): secrets, perms, policy, skills, listeners
daemonaudit scan --red                 # + active probes against THIS host, attack paths, blast radius
daemonaudit scan --html report.html    # a self-contained HTML report (also --json)
daemonaudit scan --home /path/to/.hermes      # or /path/to/.openclaw — the framework is recognised from the directory
daemonaudit checks                     # list every check (and which framework each implementation covers)

--red adds three probes that only ever touch localhost: it connects to the daemon's own listeners to see which answer without a password, reads the daemon's process environment, and reads the vault the way any process running as you could — to measure the real local blast radius.

What it checks

The same check ids mean the same class of weakness on every framework; each framework has its own implementation where the config differs.

Where OpenClaw's own openclaw security audit has a matching checkId, the finding names it. daemonaudit adds what that audit does not look at: the host (transcripts, sqlite, backups, process environments, listeners), the skills you installed, and the chaining into attack paths.

Each finding says why it matters, the exact fix, and a command to verify it.

Principles

• Read-only. It never changes your system.
• Zero network egress. Nothing leaves the box. The active probes connect to localhost only, and refuse any target that isn't this host.
• Redacted by construction. The report can show you sk-ant-…4f2a; it cannot show you the key. Nothing that leaves the process — terminal, JSON, HTML — contains a raw credential.
• No false passes. A check that can't run says skipped, never ok. A scan that couldn't complete exits non-zero.

Exit codes (for cron / CI)

Precedence 2 > 1 > 4 > 0. INFO-only findings don't affect the exit code.

Roadmap

• v0.1 — Hermes: secrets, permissions, policy, skills, exposed services, localhost red probes, attack-path report. Linux · macOS · Windows.
• v0.2 — OpenClaw adapter (this release): same checks, same attack-path rules, both daemons in one report.
• next — generic MCP config adapter, traversal-aware permission grading, the framework's own executable tree, canary-injection probe, local-LLM (Ollama) semantic skill review, guided remediation with rollback, richer Windows ACL model, continuous monitoring / drift alerts.

Development

pytest runs the suite (Linux/macOS/Windows in CI). The design invariants live in AGENTS.md; the plan and history in BUILD.md. Built with a two-model workflow — one model builds, another reviews and writes adversarial fixtures; the review rounds are under reviews/.

License

MIT — see LICENSE.