Show HN: phpClaw – AI agent runtime for PHP with tools, memory and guards

phpClaw is an open-source AI agent runtime for PHP applications, designed to provide more than a basic connection to an LLM API. Its core has no framework dependency and can detect seven providers from environment variables, with support for custom OpenAI-compatible endpoints. Developers register tools such as shell commands, HTTP requests, file access, database queries, and code search; the agent uses a built-in ReAct loop to choose and sequence tool calls, subject to an iteration limit. The project also provides swappable memory, on-demand skills, streaming, and prompt caching. Pipelines and graphs let developers combine agents and other steps, branch or retry work, and pause for human input.

A major emphasis is operational security: eight guards are enabled by default, covering risks such as prompt injection, personal data, code injection, and destructive SQL. Tool outputs are sanitized, shell access uses an allowlist and fixed blocklist, HTTP requests check resolved IPs to guard against DNS rebinding, and file tools are confined to a workspace while excluding sensitive paths. Optional rate limiting and output sanitization are also available. Adapters integrate the runtime with Laravel, Symfony, and several CMS platforms, while a bundled MCP server exposes tools to compatible clients. phpClaw is not a retrieval-augmented generation system: it does not provide embeddings or vector stores, focusing instead on connecting language models to application tools, memory, and controls.