Secure agent workspace

Everything is
end-to-end encrypted.

MirrorClaw is the secure agent workspace in the Mirror stack. The primary AI path runs on the Mirror-protected route, longer work moves into an isolated runtime, and proof shows up inside the product as a receipt chain on every turn.

AES-256-GCM via per-request CEK Receipt chain on every turn Release-gated by MirrorArena

Three ideas, one secure workspace

Built around three product ideas, not a list of backend features.

Protected route

The primary AI path runs on the Mirror-protected route. AES-256-GCM via a request-scoped CEK. Request encrypted, response encrypted, end to end.

Isolated runtime

Long or risky work moves into a delegated runtime boundary instead of widening the main chat trust zone. Jobs and Stack stay reviewable.

Visible proof

Every turn carries a receipt chain in the workspace: Enc in → Route → Enc out → Decrypt. Proof lives in the product, not in backend claims.

The receipt chain on every turn

Four sections, attached to the chat surface. The same chain an operator can inspect inline with Show proof.

Enc in
Request encrypted

Prompt is wrapped with a per-request CEK before transport. The gateway sees ciphertext.

Route
Mirror-protected route

Request is forwarded over the Mirror inference path. Route, policy, and runtime lane all logged for the operator.

Enc out
Response encrypted

Model response returns on the encrypted lane. Same CEK reference, same boundary.

Decrypt
Trusted workspace render

Decryption happens inside the trusted workspace. Operators can inspect the proof chain for any turn.

Six trust boundaries, all operator-visible

MirrorClaw separates the product into distinct trust boundaries. Each one has a surface in the workspace.

Protected access

Token-gated /app and onboarding gate

The workspace doesn't default to a public unauthenticated chat surface. Onboarding and app entry are separate so the authenticated workspace stays operator-focused.

Mirror inference route

Request, route, response, and decrypt receipts

Encrypted prompt and response transport on the main model path. Live evidence exposed in the product and status surfaces.

Workspace thread

Chat lane, proof rail, Show proof affordances

Conversation, memory, and proof in one operator surface. Proof attached to the chat surface rather than buried in backend logs.

Delegated runtime

Jobs, Stack, and delegated task receipts

Long-running or tool-heavy work moves off the main thread. Reviewable through Jobs and Stack instead of trusting hidden backend behavior.

Connector boundary

Readiness, extensions, and setup posture

Custody and readiness made visible instead of implying trust. Hosted blockers and dependency gaps surfaced before they bite.

Release gate

Security page and MirrorArena release lanes

Hosted builds are pressure-tested through MirrorArena before they ship. Release gating uses security evaluation as part of the product process.

What MirrorArena covers

MirrorArena is the security validation harness in the Mirror stack. Seven scan families, all in the release loop before a hosted build ships.

205 cases

Lifecycle bench

End-to-end runtime misuse across input, planning, tool use, persistence, and exfiltration stages.

75 scenarios

Workspace bench

ClawSafety-style domain harm: destructive actions, secret leakage, unsafe destination changes, config tampering.

15 cases · 12 families

Trust-gap bench

Ingress auth, replay, compaction poisoning, subagent trust, memory drift, identity bleed, secure defaults, attestation claims, tool-risk guards, permission integrity, and context-judge decisions.

Native red-team

SkillAttack

Skill injection, prompt seeding, exploit refinement, and seeded-vs-baseline attack deltas.

Translated corpora

PromptSecurity

Jailbreak-style attacks, transformed prompt corpora, and operator-scenario prompt-defense evaluation.

Repo + workflow

Agent scan

Static and agentic scanning of repo trust boundaries, provider config, MCP exposure, and skill provenance.

Live target

Infra scan

HTTP target fingerprinting, version matching, and advisory-driven exposure analysis on the deployed surface.

The Claw ecosystem, broken down by attack surface

Same threat classes, every Claw variant. Severity columns are how heavily each variant exposes the surface today; the last column is how MirrorClaw narrows it.

Threat class
OpenClaw / BYOO
Hermes
Nano / Pico
IronClaw
MirrorClaw
How MirrorClaw narrows it
Prompt, skill, and bootstrap poisoningWorkspace prompt files and skill content steer the agent
OpenClaw / BYOOHigh
HermesHigh
Nano / PicoMed-High
IronClawMedium
MirrorClawNarrowed
Review-gated extensions, lower-trust skill posture, release-gated PromptSecurity and SkillAttack
Host tool misuse and filesystem abuseDirect shell, file read/write, persistence
OpenClaw / BYOOHigh
HermesHigh
Nano / PicoMed-High
IronClawMedium
MirrorClawNarrowed
Protected planning route, delegated runtime split, pre-execution risk guard, reserved env protections, lifecycle bench
External content to tool chainWeb search, MCP, connectors laundering into action
OpenClaw / BYOOHigh
HermesHigh
Nano / PicoMed-High
IronClawMedium
MirrorClawNarrowed
Hosted alpha keeps web access narrow, explicit connector posture, content-chain release coverage
Ingress auth and source spoofingChannels, webhooks, WebSocket edges underprotected
OpenClaw / BYOOHigh
HermesHigh
Nano / PicoMed-High
IronClawMedium
MirrorClawNarrowed
Token-gated app edge, fail-closed webhook hardening, explicit auth posture in product
WebSocket misuse, replay, event leakageDuplicate delivery, target override, event flow attacks
OpenClaw / BYOOHigh
HermesMed-High
Nano / PicoHigh
IronClawMedium
MirrorClawNarrowed
Trust-gap bench includes ws_auth and event_replay; deeper live harness in progress
Session fixation, identity bleed, route hijackSource-string identity and loose routing
OpenClaw / BYOOHigh
HermesHigh
Nano / PicoMedium
IronClawMedium
MirrorClawNarrowed
Thread-scoped approvals, owner-scoped secrets, route receipts, identity-affinity bench
Memory poisoning and compaction driftPlaintext history, summary laundering, recall corruption
OpenClaw / BYOOHigh
HermesHigh
Nano / PicoMedium
IronClawMedium
MirrorClawNarrowed
Memory seam + product proof, compaction and memory-integrity bench coverage
Subagent trust launderingHelper agents inherit broad trust silently
OpenClaw / BYOOMed-High
HermesHigh
Nano / PicoMedium
IronClawMedium
MirrorClawNarrowed
Delegated work explicit in Jobs and Stack; subagent trust-gap bench coverage
Secure-defaults drift, unsafe modesCompat modes and dev shortcuts persist into prod
OpenClaw / BYOOMed-High
HermesMed-High
Nano / PicoMed-High
IronClawHigh
MirrorClawNarrowed
Trust-gap bench includes secure-defaults regression; product docs use precise claims only
Attestation or confidential-runtime overclaimClaims of enclave or attested compute that don't hold
OpenClaw / BYOOLow
HermesLow
Nano / PicoLow
IronClawMed-High
MirrorClawNarrowed
Treats proof as a product surface; benchmarks attestation overclaim as its own class
Guard bypass and permission tamperApproval stores, protected paths, risky commands, context-judge decisions
OpenClaw / BYOOMed-High
HermesMed-High
Nano / PicoMedium
IronClawMedium
MirrorClawNarrowed
Pre-execution guard in the shared tool path plus trust-gap coverage for protected paths, permission integrity, and high-risk context decisions
High heavy exposure todayMed-High common concernMedium partial mitigationLow not a primary surfaceNarrowed MirrorClaw treats as release-gated

Bring any model

Mirror-hosted route is the strongest transport story. Customer-managed inference and fully-local stacks keep MirrorClaw's trust-boundary and proof story intact.

Mirror gatewayAnthropicOpenAIGeminiMistralNVIDIA NemotronOllama (local)vLLM / OpenRouter

Three deployment shapes

Hosted alpha, workspace tier, dedicated tier. Same product story, different boundary separation.

Recommended

Hosted alpha

Invite onlyMirror-hosted route
  • Protected /app + onboarding gate
  • Encrypted route + visible proof
  • Per-job delegated runtime
  • Hosted Gmail / Calendar / GitHub
Open workspace

Workspace tier

Per workspaceSmall teams
  • Encrypted inference included
  • Readiness and connector policy visible
  • Audit bundle export
  • Release-gated by MirrorArena
See deployment shapes

Dedicated tier

CustomStronger isolation
  • Dedicated VM or confidential runtime
  • Per-workspace boundary separation
  • Custom OPA policies
  • Long retention + audit export
Read security model

Security as a visible product surface.

Other agent workspaces ask you to trust their backend. MirrorClaw shows you the receipt.