clawbox-server

HTTP API server for the clawbox sandboxed agent execution service.

Overview

clawbox-server is the Axum-based HTTP server that ties all clawbox components together. It exposes REST endpoints for tool execution, container management, agent orchestration, health checking, and Prometheus metrics. The server manages shared application state including the WASM sandbox engine, container manager, credential store, output scanner, and audit log.

Usage

use clawbox_server::{ClawboxConfig, AppState, build_router};
use std::sync::Arc;

let config = ClawboxConfig::load("config/clawbox.toml")?;
let state = Arc::new(AppState::new(config).await?);
let app = build_router(state);

let listener = tokio::net::TcpListener::bind("127.0.0.1:9800").await?;
axum::serve(listener, app).await?;

API Routes

Features

• Axum HTTP framework — Async, tower-based middleware stack
• Bearer token auth — Constant-time token comparison via subtle::ConstantTimeEq
• Concurrency limiting — Tower ConcurrencyLimitLayer on protected routes (max 10)
• Request size limiting — 10 MB body limit on protected endpoints
• Prometheus metrics — Request counts, durations, container gauges, execution histograms
• Graceful shutdown — SIGTERM/Ctrl+C handling with container cleanup
• TOML configuration — Layered config for server, sandbox, proxy, credentials, containers, and logging

Architecture

License

MIT