Configuration

Configuration is stored in ~/.clauth/config.json. It is created by clauth init and can be edited manually.

Full Schema

{
  "transport": "tcp",
  "host": "127.0.0.1",
  "port": 4317,
  "socketPath": "/home/user/.clauth/clauth.sock",
  "requireSkillToken": true,
  "skillTokenSalt": "<auto-generated>",
  "vaultSalt": "<auto-generated>",
  "kdf": {
    "memory": 65536,
    "parallelism": 1,
    "iterations": 3,
    "tagLength": 32
  },
  "firewall": {
    "minWarmupRequests": 10,
    "rateSpikeMultiplier": 3,
    "burstWindowMs": 10000,
    "burstLimit": 20,
    "offHoursStart": 1,
    "offHoursEnd": 5
  },
  "alertChannels": [],
  "advisoryFeeds": [],
  "advisoryPollIntervalMs": 3600000,
  "hardening": {
    "enforceHttps": true,
    "maxRequestBodyBytes": 1048576,
    "sessionTtlSeconds": 3600,
    "challengeTtlSeconds": 600,
    "requireAdminTokenForIdentity": false
  }
}

Transport

TCP Mode (default)

{
  "transport": "tcp",
  "host": "127.0.0.1",
  "port": 4317
}

Unix Socket Mode

{
  "transport": "unix",
  "socketPath": "/home/user/.clauth/clauth.sock"
}

Socket is created with 0o600 permissions (owner only).

Authentication

When requireSkillToken is true, every proxy request must include a valid x-clauth-skill-token header or Authorization: Bearer session token.

KDF (Key Derivation Function)

These parameters affect vault unlock time. Higher values increase security but slow down daemon startup.

Behavioral Firewall

Tuning Examples

High-throughput skill:

{
  "firewall": {
    "burstLimit": 100,
    "rateSpikeMultiplier": 5,
    "minWarmupRequests": 50
  }
}

Strict mode:

{
  "firewall": {
    "burstLimit": 5,
    "rateSpikeMultiplier": 2,
    "minWarmupRequests": 5
  }
}

Alert Channels

{
  "alertChannels": [
    {
      "type": "webhook",
      "url": "https://hooks.slack.com/services/T00/B00/xxx",
      "minSeverity": "warning"
    },
    {
      "type": "webhook",
      "url": "https://your-pagerduty-endpoint.com/alerts",
      "minSeverity": "critical"
    }
  ]
}

Severity ordering: info < warning < critical

Webhooks receive POST with JSON body:

{
  "severity": "warning",
  "category": "firewall",
  "message": "Rate spike detected (15/min vs baseline 3.2/min).",
  "timestamp": "2025-01-15T10:05:00.000Z",
  "metadata": {
    "skillId": "my-agent",
    "provider": "github",
    "allowed": true
  }
}

Advisory Feeds

{
  "advisoryFeeds": [
    {
      "name": "github",
      "url": "https://api.github.com/advisories",
      "type": "github"
    }
  ],
  "advisoryPollIntervalMs": 3600000
}

On critical advisory, clauth auto-revokes grants and deletes credentials for the affected provider.

Hardening

{
  "hardening": {
    "enforceHttps": true,
    "maxRequestBodyBytes": 1048576,
    "sessionTtlSeconds": 3600,
    "challengeTtlSeconds": 600,
    "requireAdminTokenForIdentity": false
  }
}

Vault Salt

Generated at clauth init. Do not change after vault creation — the vault will become unreadable.

State File Locations

All state files are in the directory specified by CLAUTH_HOME (default: ~/.clauth/):