claw machine

Works with Claude Code, Cursor, GitHub Copilot, VS Code, Gemini, and any MCP-compatible client.

AI agents that manage Docker need access to the Docker socket — which means full root on the host. One wrongdocker rmand production data is gone.

- Scope-gated tools— If the API key doesn't havecontainers:delete, thedelete_containertool doesn't exist. The AI literally can't call it.
- Audit trail— Every API call is tracked per-key in WAGMIOS.
- Multi-machine— One MCP server, multiple WAGMIOS instances, each with its own key and scopes.

The AI never touches the Docker socket. The AI never gets sudo. The enforcement is in the key, not the prompt.

┌──────────────┐ MCP (stdio/SSE) ┌──────────────┐ REST (scoped key) ┌──────────────┐ Docker API ┌────────┐ │ AI Client │ ───────────────────────→ │ ClawMachine │ ──────────────────────→ │ WAGMIOS │ ────────────────→ │ Docker │ │ (Claude,etc) │ │ MCP Server │ │ REST API │ │ Daemon │ └──────────────┘ └──────────────┘ └──────────────┘ └────────┘

curl -O https://raw.githubusercontent.com/mentholmike/wagmios/main/docker-compose.yaml docker compose up -d

WAGMIOS runs athttp://localhost:5179(API) andhttp://localhost:5174(UI).

In WAGMIOS UI → Settings → Agent Permissions:

- Name:my-agent
- Enable:containers:read,containers:write,images:read,marketplace:read,system:read
- Leavecontainers:deleteoffunless you want the AI to be able to remove containers
- Copy the key:wag_live_abc123...

go install github.com/mentholmike/clawmachine/cmd/clawmachine@latest

docker run -i itzmizzle/clawmachine -api-url http://host.docker.internal:5179 -api-key wag_live_abc123

Claude Code(~/.claude/claude_desktop_config.json):

# Build docker build -t itzmizzle/clawmachine . # Run (stdio) docker run -i itzmizzle/clawmachine -api-url http://host.docker.internal:5179 -api-key wag_live_xxx # Run (SSE) docker run -p 8080:8080 itzmizzle/clawmachine \ -api-url http://host.docker.internal:5179 -api-key wag_live_xxx \ -transport sse -sse-addr :8080 -sse-base-url http://localhost:8080

Multi-arch images (amd64 + arm64) are built and pushed toitzmizzle/clawmachineon Docker Hub via GitHub Actions on every push to main and on version tags.

git clone https://github.com/mentholmike/clawmachine.git cd clawmachine go build ./cmd/clawmachine/ go vet ./...

Read-only MCP server inside a self-hosted homelab dashboard — explore hosts, Docker containers, GPU/VRAM, systemd services, AI models, alerts and disk.

MCP servers for managing homelab infrastructure through Claude Desktop. Monitor Docker/Podman containers, Ollama AI models, Pi-hole DNS, Unifi networks, and Ansible inventory.

A daemon to orchestrate MCP servers as Docker containers and configure AWS ALB path-based routing.

Manage Docker containers through the Portainer API.

The Fabric MCP server exposes the following MCP tools that allow AI assistants to interact with your Equinix Fabric resources. Each tool corresponds to a specific Fabric API endpoint.

Secure Zero-Trust SSH Gateway for AI Agents. A Go-based Model Context Protocol (MCP) server featuring runtime Regex Command Firewalls and multi-host isolation.

Secure every MCP server with one governed gateway. Give each AI agent its own scoped MCP access, contain credentials at the gateway, and audit every MCP tool call without wiring agents directly to each server.

Civilian situational awareness for AI deployments — real-time risk dashboards, multi-source threat correlation, anomaly detection, and automated alerting for critical infrastructure and enterprise AI systems.

MCP server to Automate Exposure Management