daemonaudit

Who can hurt your AI agent — and how badly.

daemonaudit is a red/blue security audit for self-hosted AI agent daemons. It finds the secrets, the open doors and the weak policies on the machine your agent runs on, then tells you the attack paths and the blast radius: what an attacker gets, from where, and which single fix kills the whole chain.

Supports Hermes Agent and OpenClaw. Both are found automatically; a box running both gets one report. Generic MCP configs are on the roadmap.

Install

uvx daemonaudit scan --red          # zero-install run
pipx install daemonaudit            # or: pip install daemonaudit

Requires Python ≥ 3.10. Dependencies: psutil, rich, pyyaml. Linux, macOS and Windows. From a clone: python -m pip install -e '.[dev]'.

What it looks like

Hermes demo home	OpenClaw demo home

Both are daemonaudit scan --red against a deliberately-broken demo home with fake credentials — build your own with python scripts/demo_home.py [--openclaw].

Why not just the built-in audit?

Framework auditors ask "is my config right?". daemonaudit asks "what does an attacker standing here actually get?" — and it looks at the host, not just the config: backups, transcripts, sqlite state, process environments, listening sockets, and the skills you installed. Then it chains the findings: an exposed port plus an unsandboxed backend plus keys in the environment is one attack path, and it names the one hop whose fix breaks it.

Use

daemonaudit scan                       # passive audit (safe anywhere): secrets, perms, policy, skills, listeners
daemonaudit scan --red                 # + active probes against THIS host, attack paths, blast radius
daemonaudit scan --html report.html    # a self-contained HTML report (also --json)
daemonaudit scan --home /path/to/.hermes      # or /path/to/.openclaw — the framework is recognised from the directory
daemonaudit checks                     # list every check (and which framework each implementation covers)

--red adds three probes that only ever touch localhost: it connects to the daemon's own listeners to see which answer without a password, reads the daemon's process environment, and reads the vault the way any process running as you could — to measure the real local blast radius.

What it checks

21 checks in seven areas — SEC secrets outside the vault · PERM file permissions · NET listeners and sockets · POL policy (approvals, sandbox, who may talk to the agent, exposure, webhooks, debug leaks, content guards, credential passthrough, literal secrets) · SKILL risky skills and context files · ADV freshness · RED localhost probes. The same check id means the same class of weakness on every framework; each framework has its own implementation where the config differs.

Where OpenClaw's own openclaw security audit has a matching checkId, the finding names it. daemonaudit adds what that audit does not look at: the host (transcripts, sqlite, backups, process environments, listeners), the skills you installed, and the chaining into attack paths.

Each finding says why it matters, the exact fix, and a command to verify it.

Principles

• Read-only. It never changes your system.
• Zero network egress. Nothing leaves the box. The active probes connect to localhost only, and refuse any target that isn't this host.
• Redacted by construction. The report can show you sk-ant-…4f2a; it cannot show you the key. Nothing that leaves the process — terminal, JSON, HTML — contains a raw credential.
• No false passes. A check that can't run says skipped, never ok. A config file that doesn't parse skips every check that reads it — it never evaluates defaults and calls them a pass. A scan that couldn't complete exits non-zero.

Exit codes (for cron / CI)

Precedence 2 > 1 > 4 > 0. INFO-only findings don't affect the exit code.

Roadmap

• v0.1 — Hermes: secrets, permissions, policy, skills, exposed services, localhost red probes, attack-path report. Linux · macOS · Windows.
• v0.2 — OpenClaw adapter: same checks, same attack-path rules, both daemons in one report. v0.2.1 closes the "config doesn't parse → pass" hole on both frameworks and aligns $include, config-path and per-agent sandbox handling with OpenClaw's own rules (CHANGELOG).
• next — generic MCP config adapter, traversal-aware permission grading, the framework's own executable tree, canary-injection probe, local-LLM (Ollama) semantic skill review, guided remediation with rollback, richer Windows ACL model, continuous monitoring / drift alerts.

Development

pytest runs the suite (Linux/macOS/Windows in CI). The design invariants live in AGENTS.md; the plan and history in BUILD.md; releases in CHANGELOG.md. Built with a two-model workflow — one model builds, another reviews and writes adversarial fixtures; the review rounds are under reviews/.

License

MIT — see LICENSE.