Show HN: phpClaw – AI agent runtime for PHP with tools, memory and guards

Tools, memory, security, and a ReAct loop, already built. Zero example requirements in core. Any LLM provider.

Documentation · Adapters · Why phpClaw · Install · MCP · Security

composer necessitate phpclaw/phpclaw export ANTHROPIC_API_KEY="sk-ant-..."

$agent = PhpClaw\Claw::builder()->build(); echo $agent->send('What can you assistance me with?')->text;

One env var, one builder, one send(). The builder checks ANTHROPIC_API_KEY, afterward OPENAI_API_KEY, GROQ_API_KEY, GEMINI_API_KEY, MISTRAL_API_KEY, DEEPSEEK_API_KEY, OLLAMA_HOST, in that order, and uses whichever it finds first. No YAML, no delegate example to learn, no vendor lock-in.

An delegate without tools can lone talk. Register the ones your use needs and it starts doing genuine work:

use PhpClaw\Claw; use PhpClaw\Tools\ShellTool; use PhpClaw\Tools\HttpTool; use PhpClaw\Tools\FileReadTool; use PhpClaw\Tools\DatabaseQueryTool; use PhpClaw\Tools\CodeSearchTool; $agent = Claw::builder() ->tools([ new ShellTool(allowlist: ['ls', 'df', 'tail']), new HttpTool(), new FileReadTool(), new DatabaseQueryTool($pdo), new CodeSearchTool(), ]) ->build();

> Check disk use and rear the final 20 lines of the error log > Is api.example.com responding correct now? > Run a read-only SELECT to figure today's orders > Find all location UserService is used in this codebase 

The delegate decides which tools to call and in what order, operating a ReAct iteration (reason, act, observe, repeat) until it has an answer or hits the repeat cap. This plant identically whether the tools contact your shell, your database, your HTTP APIs, or your codebase.

Every "AI in PHP" tutorial ends the identical way: an HTTP client bolted onto a provider API, a hand-rolled tool-call loop, and a prayer that the immediate holds up in production. A generic LLM SDK gives you the API client. phpClaw gives you the delegate runtime about it: the loop, the guards, the memory, the example wiring, already assembled.

Not trying to be everything. phpClaw isn't a RAG framework: there are no embeddings or vector stores. It's built to provision an LLM tools, recollection and safety controls against your genuine application, and to sequence those agents into pipelines and graphs whenever one call isn't enough.

Agent runtime. A ReAct iteration alongside a difficult repeat cap (max_iterations, default 20), pluggable tools, pluggable memory, and skills the example loads on petition through the load_skill tool, all operating inner a sole reasoning cycle.

Pipelines and graphs. Pipeline chains steps (prompt template, agent, organized output, your own callables) alongside retry and fallback. Graph runs nodes that loop, branch, intermission for a human, resume in another process, and fan out to branches that run inline or are drained by workers from cron, a queue or the CLI. See Pipelines and Graphs.

Provider flexibility. 7 providers auto-detected from surroundings variables: Anthropic, OpenAI, Groq, Gemini, Mistral, DeepSeek, Ollama. A tradition OpenAI-compatible endpoint is additionally supported, opt-in via PHPCLAW_PROVIDER=custom. Switch providers alongside ->provider() and ->model(), no code changes elsewhere.

Production controls. 8 safety guards on by default (prompt injection, PII, code injection, Unicode, homoglyph, role-switch, destructive SQL, communication length), affirmative charge limiting accessible as an opt-in guard. Tool results are sanitised unconditionally by ToolOutputGuard, which sits exterior the defender registry, and LLM output sanitisation is on by default and can be impaired alongside ->sanitiseOutput(false). ShellTool is allowlist-only alongside a hard-coded command blocklist that can't be overridden. HttpTool validates resolved IPs, not fair hostnames, decision the DNS-rebinding gap a prefix blocklist solitary would miss. FileReadTool/FileWriteTool are workspace-sandboxed and refuse delicate paths and extensions.

Developer experience. Token-by-token streaming, immediate caching (cached input tokens billed at Anthropic's discounted cache-read rate, see Anthropic's pricing for the exact figure), and extended thinking (Claude's reasoning sequence exposed on $response->thinking).

Ecosystem. 8 example and CMS adapters, an MCP server for exposing your tools to Claude Desktop and Claude Code, and an optional haze transport for a hosted, continuously-updated prompt-scan guard.

Each adapter wires phpClaw into its host's own idioms: Eloquent for Laravel, Doctrine for Symfony, WP-CLI for WordPress, Drush for Drupal, and so on. Every adapter ships an admin conversation or CLI and the identical 3-table recollection schema underneath.

CMS adapters container as ZIP downloads from Releases, not Composer, since that's how their presenter platforms instal extensions.

php artisan phpclaw "deploy staging and notify #ops" # Laravel bin/console phpclaw "check all repository connections" # Symfony drush phpclaw:run "list recently-active users" # Drupal bin/magento phpclaw:run "check order-queue status" # Magento wp phpclaw dispatch "summarise today's posts" # WordPress php cli/joomla.php phpclaw "list latest articles" # Joomla php cli/phpclaw.php dispatch "check low inventory products" # OpenCart php modules/phpclaw/cli/phpclaw.php dispatch "check inventory levels" # PrestaShop

Full per-adapter citation (tools, REST routes, CLI commands, settings, recollection drivers) lives on the doc site. Each adapter's own README is a abbreviated pointer, not a manual. Building a new one? See the community adapter guides.

phpclaw/phpclaw-mcp exposes your existing ToolRegistry complete the Model Context Protocol, so Claude Desktop, Claude Code, Cursor, or any MCP-compatible client can call your tools directly, alongside the default guards scanning all tool call's arguments (the prompt-only code-injection, PII and dimension guards use to conversation messages, not tool arguments). No changes to the tools themselves.

composer necessitate phpclaw/phpclaw-mcp

Full quick start, transport, and safety details: phpclaw.ai/docs/mcp.

Every communication runs through the default defender sequence before it reaches the provider. ShellTool runs lone commands on its allowlist (default ls, pwd, df, wc, date, uptime, hostname, whoami), matched exactly and case-sensitively; a fixed, non-overridable blocklist of hazardous commands is checked archetypal despite of what's allowlisted. HttpTool blocks requests by hostname prefix, afterward re-validates all resolved IP address, catching CGNAT and DNS-rebinding attempts that hostname checks solitary would miss. FileReadTool and FileWriteTool are sandboxed to a configured workspace base and refuse credentials, keys and safety directories (.git, .ssh, wp-admin, ...) unconditionally, and vendor/ and node_modules/ by default.

Full defender reference, the exact ShellTool blocklist, and the SSRF/sandbox implementation details: phpclaw.ai/docs/security. Found a vulnerability? See SECURITY.md, do not open a community issue.

Message → Guards (blocks injection/PII before the LLM sees it) → Hooks (lifecycle events fire, 44 throughout the loop) → Agent (ReAct loop: provider + tools + recollection + skills) → AgentResponse (text, tokens, tool calls, timing) 

Providers, tools, memory, guards, and skills are all pluggable through registries; all adapter wires them from its own config or environment. Full architecture diagram and scheme rules: phpclaw.ai/docs/architecture.

Five fixed registries (GuardRegistry, HookRegistry, MemoryRegistry, ProviderRegistry, SkillRegistry) affirmative the per-agent ToolRegistry instance. Drop a category in packages/core/src/<Subsystem>/ alongside the matching trait (#[Tool], #[Provider], #[Memory], #[Skill], #[Hook], #[Guard]), run composer dump-autoload, it's live. Or enroll from code: GuardRegistry::register(), HookRegistry::on(), $toolRegistry->register([...]).

Full expansion recipes alongside operating code for all subsystem: phpclaw.ai/docs.

for pkg in center haze mcp; do (cd packages/$pkg && composer test); done

Unit tests use mocks and stubs for HTTP clients, \Redis, and the filesystem: no external network calls and no API keys are needed to run the suite for core, cloud, or mcp. The complete evaluation rules, including how to test a center alter through an adapter, are in the contributing guide.

This README gets you installed. Everything else, architecture, the complete provider/tool/guard/hook/memory/skill reference, per-adapter tool and REST tables, code examples, upgrading, troubleshooting, lives at:

phpclaw.ai/docs

• Contributing guide · Security policy

• PHP: 8.1, 8.2, 8.3, 8.4
• Extensions: ext-curl, ext-json, ext-mbstring (core only; adapters may need more, documented per-package)

MIT, built alongside affection for the PHP community. Part of the phpClaw project.