arifOS: A $15 MCP Governance Kernel for OpenClaw Tool Security
What arifOS Does
arifOS is a tiny MCP governance kernel that sits between OpenClaw models and their tools/skills. The creator, Arif (a geologist, not a coder), built it to prevent AI agents from "free-styling" his tools without proper security checks.
Core Architecture
The system uses a simple metaphor: treat the LLM like a "brain in a jar," treat tools like "hands," and put a "$15 VPS in the middle as the bouncer." Every OpenClaw tool call goes through this chain: jar → MCP server → scoring → security check.
Security Implementation
Each tool call gets scored 000-999 and must pass 13 hard Floors including:
- Amanah
- Truth
- Safety
- Injection
- Sovereignty
If a call fails any Floor, it returns "VOID" and nothing touches your filesystem, API, or database. The blocking logic is straightforward:
if verdict == "VOID":
return "Action Blocked by Floor 1: Amanah"As Arif puts it: "That's the whole joke: billion-dollar model, $15 lock."
Installation and Availability
Available via pip: pip install arifos
Repository: https://github.com/ariffazil/arifOS
The creator invites testing: "If you're running OpenClaw agents and want a paranoid bouncer in front of your skills, feel free to break this and tell me where it leaks."
Development Context
Arif notes that all Python code was written by AI agents, and he doesn't "even know how to spell phython"—highlighting the paradox of non-coders building security tools with AI assistance.
📖 Read the full source: r/openclaw
👀 See Also
Ward: Open-source tool intercepts npm installs to block supply chain attacks for Claude Code users
Ward is an open-source tool that hooks into package managers to check every package before install scripts run. When Claude Code executes npm install, Ward automatically screens packages for malware, typosquats, suspicious scripts, and version anomalies.
CodeWall AI Agent Discovers Critical Vulnerabilities in McKinsey's Lilli Platform
CodeWall's autonomous offensive AI agent gained full read/write access to McKinsey's internal Lilli AI platform database within 2 hours, exposing 46.5 million chat messages, 728,000 files, and sensitive system configurations through SQL injection and IDOR vulnerabilities.
Three open-source alternatives to litellm after PyPI supply chain attack
litellm versions 1.82.7 and 1.82.8 on PyPI were compromised with credential-stealing malware. Three open-source alternatives include Bifrost (Go-based, ~50x faster P99 latency), Kosong (agent-oriented from Kimi), and Helicone (AI gateway with analytics).
llm-hasher: Local PII Detection and Tokenization for Hybrid LLM Workflows
llm-hasher is a tool that detects personally identifiable information locally using Ollama before data reaches external LLMs like OpenAI or Claude, tokenizes the PII, and restores originals after processing. It uses regex for structured data types and a local LLM for contextual detection, with encrypted storage for mappings.