Configuration

Configuration is stored in ~/.clauth/config.json. It is created by clauth init and can be edited manually.

Full Schema

{
  "transport": "tcp",
  "host": "127.0.0.1",
  "port": 4317,
  "socketPath": "/home/user/.clauth/clauth.sock",
  "skillTokenSalt": "<auto-generated>",
  "vaultSalt": "<auto-generated>",
  "kdf": {
    "memory": 65536,
    "parallelism": 1,
    "iterations": 3,
    "tagLength": 32
  },
  "firewall": {
    "minWarmupRequests": 10,
    "rateSpikeMultiplier": 3,
    "burstWindowMs": 10000,
    "burstLimit": 20,
    "offHoursStart": 1,
    "offHoursEnd": 5
  },
  "alertChannels": [],
  "advisoryFeeds": [
    {
      "name": "github",
      "url": "https://api.github.com/advisories",
      "type": "github"
    }
  ],
  "advisoryPollIntervalMs": 3600000,
  "hardening": {
    "enforceHttps": true,
    "maxRequestBodyBytes": 1048576,
    "sessionTtlSeconds": 3600,
    "challengeTtlSeconds": 600,
    "identityMaxVerifyAttempts": 5,
    "identityVerifyPerSkillPerMinute": 30,
    "identityVerifyPerIpPerMinute": 60,
    "requireAdminTokenForIdentity": false
  }
}

Transport

TCP Mode (default)

{
  "transport": "tcp",
  "host": "127.0.0.1",
  "port": 4317
}

Unix Socket Mode

{
  "transport": "unix",
  "socketPath": "/home/user/.clauth/clauth.sock"
}

Socket is created with 0o600 permissions (owner only).

Authentication

Proxy and identity endpoints require either a valid x-clauth-skill-token header or Authorization: Bearer session token.

KDF (Key Derivation Function)

Clauth prefers Argon2id when the runtime provides crypto.argon2Sync. On runtimes without Argon2id support (including Node.js 22), Clauth uses scrypt.

These parameters affect vault unlock time. Higher values increase security but slow down daemon startup.

Behavioral Firewall

Tuning Examples

High-throughput skill:

{
  "firewall": {
    "burstLimit": 100,
    "rateSpikeMultiplier": 5,
    "minWarmupRequests": 50
  }
}

Strict mode:

{
  "firewall": {
    "burstLimit": 5,
    "rateSpikeMultiplier": 2,
    "minWarmupRequests": 5
  }
}

Alert Channels

{
  "alertChannels": [
    {
      "type": "webhook",
      "url": "https://hooks.slack.com/services/T00/B00/xxx",
      "minSeverity": "warning"
    },
    {
      "type": "webhook",
      "url": "https://your-pagerduty-endpoint.com/alerts",
      "minSeverity": "critical"
    }
  ]
}

Severity ordering: info < warning < critical

Webhooks receive POST with JSON body:

{
  "severity": "warning",
  "category": "firewall",
  "message": "Rate spike detected (15/min vs baseline 3.2/min).",
  "timestamp": "2025-01-15T10:05:00.000Z",
  "metadata": {
    "skillId": "my-agent",
    "provider": "github",
    "allowed": true
  }
}

Advisory Feeds

{
  "advisoryFeeds": [
    {
      "name": "github",
      "url": "https://api.github.com/advisories",
      "type": "github"
    }
  ],
  "advisoryPollIntervalMs": 3600000
}

On critical advisory, clauth auto-revokes grants and deletes credentials for the affected provider.

Hardening

{
  "hardening": {
    "enforceHttps": true,
    "maxRequestBodyBytes": 1048576,
    "sessionTtlSeconds": 3600,
    "challengeTtlSeconds": 600,
    "identityMaxVerifyAttempts": 5,
    "identityVerifyPerSkillPerMinute": 30,
    "identityVerifyPerIpPerMinute": 60,
    "requireAdminTokenForIdentity": false
  }
}

Identity Email Delivery

Email proof delivery is configured via environment variable, not config.json:

Vault Salt

Generated at clauth init. Do not change after vault creation — the vault will become unreadable.

State File Locations

All state files are in the directory specified by CLAUTH_HOME (default: ~/.clauth/):