Security Overview: PocketPaw’s 7-Layer Protection
PocketPaw implements defense-in-depth with multiple security layers. Every message is checked before processing, every action is logged, and tools are governed by a policy system.
Security Layers
Guardian AI
Secondary LLM evaluates every message for safety concerns. Messages classified as HIGH or CRITICAL are blocked.
Injection Scanner
Two-tier detection (regex + LLM) catches prompt injection in both user messages and tool outputs.
Tool Policy
Profiles and allow/deny lists control which tools are available.
Dangerous Command Blocking
PreToolUse hooks intercept and block dangerous shell commands.
Audit Log
Append-only JSONL log records every significant action.
Security Components
Guardian AI
Secondary LLM safety check on every incoming message.
Injection Scanner
Two-tier prompt injection detection for messages and tool outputs.
Audit Log
Append-only action recording in JSONL format.
Security Audit CLI
7 automated security checks with auto-fix option.
Self-Audit Daemon
12 continuous background checks with JSON reports.
PII Detection
Detect and mask personal data (SSNs, emails, credit cards) before storage.
Streaming Redaction
Automatic API key and credential redaction in agent output.
PocketPaw is designed for self-hosted, single-user deployments. If exposing to multiple users, add authentication middleware to the web dashboard.