Quickstart
First run in two minutes. Pick init for the guided wizard or quickstart for the zero-prompt scripted equivalent — both call the same first-run backend and end with a working guardrail.
After the install, DefenseClaw is on disk but not yet configured. You then run one first-run command. There are two of them — they do the same work, with different UX.
defenseclaw init
Interactive wizard. Asks about connector, profile, scanner mode, judge, HITL. Recommended the first time.
defenseclaw quickstart
Zero-prompt equivalent with safe defaults. Recommended for CI, scripts, and demos.
You do not need to run init before quickstart. Both invoke
the same run_first_run backend (cli/defenseclaw/bootstrap.py)
that writes config, seeds the audit DB, configures guardrail, and
starts the gateway. Pick one.
Path A — Interactive (defenseclaw init)
The recommended first run for a human at a terminal. The wizard walks you through every choice, shows defaults, and explains the trade-offs.
defenseclaw initThat's it. On a TTY this runs the guided path (_prompt_first_run) and asks you which connector to wire up, whether to start in observe or action mode, whether to enable the LLM judge, and so on. Every prompt has a sensible default — pressing Enter through them gives you the same result as quickstart.
To skip the wizard inside a session that is a TTY (CI on a pty, scripted demos):
defenseclaw init --non-interactive --yes --connector codex--non-interactive skips prompts; --yes accepts every confirmation; --connector pre-selects the agent.
Path B — Zero prompts (defenseclaw quickstart)
The scripted equivalent. Same backend, no prompts ever, safe defaults baked in: observe profile, local scanner, no LLM judge, no HITL.
Run it
defenseclaw quickstart --connector claudecodeReplace claudecode with codex, cursor, windsurf, geminicli, copilot, hermes, openclaw, or zeptoclaw to target the agent you actually use. If you skip --connector, quickstart consults ~/.defenseclaw/picked_connector (written by the installer when you passed --connector to it) and falls back to codex.
Watch the report
The command emits a one-screen first-run summary:
DefenseClaw — first run report
──────────────────────────────────────────────
status ok
connector claudecode (Claude Code)
profile observe
scanner_mode local
judge disabled
hilt disabled
gateway running on 127.0.0.1:18970
audit DB ~/.defenseclaw/audit.dbIf status is needs_attention the command exits non-zero and lists the gaps (missing API key, gateway port in use, …) with the exact next command to run.
Drive the agent
Open Claude Code (or whichever connector you picked). Every prompt and tool call now flows through DefenseClaw. Watch decisions land in the live dashboard:
defenseclaw tuiOr tail the JSONL fan-out from a script:
tail -f ~/.defenseclaw/gateway.jsonl | jq .What both paths do
All quickstart flags
Prop
Type
When to use which
| Situation | Use |
|---|---|
| First-time setup at a terminal | defenseclaw init |
| You want to be asked questions and shown defaults | defenseclaw init |
| Installer hand-off / unattended provisioning | defenseclaw quickstart --connector <x> |
| CI pipeline (no TTY, deterministic config) | defenseclaw quickstart --connector <x> --non-interactive --yes --json-summary |
| Scripted demo / repeatable test fixture | defenseclaw quickstart --connector <x> --force |
Next
Install
Install DefenseClaw with one curl command or build it from source. Covers macOS and Linux; pins Python 3.10+ and Go 1.26+ for source builds.
First guardrail in 5 minutes
An end-to-end walkthrough — install, pick Claude Code, switch to action mode, and watch DefenseClaw block a destructive shell command before it runs.