ZeroClaw: setup and governed scope
Limited coverage · Runtime family · Reviewed 2026-09-07
Authenticated instance management, durable delivery and a native restricted MCP tool profile are implemented.
Set up ZeroClaw in your workspace Choose your first outcome
What is validated
Authenticated instance lifecycle
Tested profile
Protected surfaces:
- management status, pair, bind, repair, rotate and revoke
Authentication: device pairing code, per-instance sealed bearer. Evidence capability: none; inspect each action's actual grade.
Authenticated delivery and durable polling bridge
Limited coverage
Protected surfaces:
- same-tenant direct task delivery
- live execution-context admission and durable polling outbox
Authentication: sealed per-instance gateway bearer, separate operator-owned polling credential. Evidence capability: none; inspect each action's actual grade.
Setup instructions for this profile come from the SDK documentation your deployment operator provides.
Native restricted agent and managed MCP action
Limited coverage
Protected surfaces:
- native same-agent capability gate
- fixed registered target through managed MCP companion
Authentication: operator-owned user-backed API credential, live runtime installation. Evidence capability: none; inspect each action's actual grade.
Setup instructions for this profile come from the SDK documentation your deployment operator provides.
Start free, then install and connect
After the sample, use the local SDK installation guide. Obtain a matching source checkout or release artifact from your deployment operator; these pages do not assert that a package or marketplace entry has been published.
- Create a free workspace and verify your email. In your dashboard, choose Run free sample. Review the local rule’s allowed and blocked texts, saved audit ID, and reported signature availability. No model key or external target is needed. This sample does not connect an agent or create a target receipt or verified proof bundle.
- Return to your saved runtime setup and register an agent. Use separate runtime and personal review credentials; keep credentials outside source control.
- Choose an explicitly supported managed tool path. An administrator must configure a registered HTTP target or managed MCP connection and confirm your access.
- In a disposable workflow, exercise allow, deny, and revoked-authority cases. Record the actual action ID; a configured connection alone is not execution evidence.
- Inspect the event sequence, outcome, and evidence grade in the workspace. Use the evidence guide for SDK reads and independent verification.
Start free with the local rule sample, registration, and the controls available to your plan. Protected actions require proof.actions and the corresponding permission; exports require additional access. Ask your workspace administrator if these are unavailable. Provider usage may have its own charges.
Limits to test
- Official 0.8.4 management API was tested on Linux ARM64; native model/tool execution is outside that management profile.
- Direct delivery and polling bridge fixtures cover authentication, live authority and recovery. They do not prove native before-tool interception or that an opaque in-flight effect was stopped.
- A browser never receives the sealed gateway token; operator-owned NAT bridge credentials are a separate installation profile.