FinAIOSby FinoGeeks

Product · Agent layer

FinClaw

The multi-tenant agent runtime

Many agent runtimes are built for one person on one machine. FinClaw is a cloud-native runtime built to serve many users from one shared deployment. Every request is scoped to a tenant and a user, quotas apply per user and per tenant, and tool calls run in a sandbox when the platform runs it. You don't have to reserve a machine for every user.

Free download · Open source coming soon

Talk to FDETry the FinClaw CLISee in the stack

On GitHub: finogeeks/finclaw-cli →

FinClaw hero: many tenants, one runtime, peers and self-learning

Try the FinClaw CLI

One command installs the CLI on macOS or Linux. It updates itself from GitHub Releases with `finclaw update`.

macOS and Linux

curl -fsSL https://raw.githubusercontent.com/finogeeks/finclaw-cli/main/install.sh | sh

Put `$HOME/.local/bin` on your PATH, then check the install:

finclaw --version

Download the Windows build from GitHub Releases, or use WSL2.

Release notes and all downloads: GitHub Releases →

Where it sits

The runtime of FinAI OS

FinClaw is where agents run; FinHub is what turns them into a managed service. FinClaw is the runtime core: the agent loop, tool execution, memory, skills and quotas. It runs on its own with nothing beyond a model provider, or as the default runtime FinHub manages, behind one runtime contract. It has no built-in OS sandbox: FinSAFE provides the boundary, and in the platform tool calls run confined by default. The same runtime also runs as a CLI on a staff computer, and that is how it runs inside FinDesk.

Sold on its own or integrated with the other FinAI OS products.

FinAI OSThe managed agent platform · on-prem or your private cloud
Layer 4
Experience
Where clients, advisors and staff meet the agents.
FinDeskPlugin-based white-label AI desktopFinClipMini-program runtime for your apps
Layer 3
Agent
Manage, run and contain agents per tenant.
FinHubManaged agent platformFinClawMulti-tenant agent runtime
FinClaw is here
Layer 2
Knowledge
What agents know, and how it is structured.
FinLoreKnowledge baseFintologyOntology + knowledge graph / distillery
Layer 1
Control
Every agent runs contained; FinGuard decides each write that goes through it.
FinGuardAction gatewayFinSAFESandbox
Your infrastructure  Models · data · identity · core systemsHighlighted: Agent layer

Capabilities

What FinClaw does

Five things a platform team needs before many agents can safely share one runtime.

  1. 1

    Tenant and user scoping

    Every request carries a tenant and a user. There is no single-user mode. Workspaces, sessions, memory and scheduled jobs are partitioned by tenant, so one client's context stays in its own lane.

    Tenant-scopedPer-user workspaces
  2. 2

    Quotas and concurrency

    Concurrency and requests per minute can be capped per process and per user. Per-tenant quota defaults (iterations, token budget, cost) are set in config, and per-user overrides come from the identity service.

    Per-user limitsToken budgets
  3. 3

    Isolation from FinSAFE

    FinClaw has no sandbox of its own, by design. In the platform, each tool call runs in a FinSAFE cell by default. On a desktop, FinSAFE confines the whole process. Deployments can step up from one shared runtime to a runtime per tenant, and to stronger boundaries where the infrastructure supports them.

    FinSAFE cellsDeployment tiers
  4. 4

    Tool policy and approvals

    Tool calls run under a read-only, supervised or full policy. Under supervised, writes and commands wait for a person, and the approval comes back through a separate channel with its own token, so an agent can't approve itself. FinClaw is designed to route its writes to enterprise systems through FinGuard.

    Tool policyApprovals
  5. 5

    Scheduled and long-running

    Scheduled agents run inside FinClaw, so an agent can act at a set time instead of waiting to be asked. Runs can resume from durable checkpoints when that's enabled, and each agent run leaves an audit record.

    Scheduled agentsCheckpointsAudit

Standalone · better with

Useful alone. Stronger in the stack.

FinClaw runs on its own, against the model provider you choose. Paired with other FinAI OS products, it gets a managed platform, a sandbox and a desktop you would otherwise build yourself.

FinClaw alone

FinClaw on its own

  • Runs standalone with a model provider; no other services required
  • Tenant- and user-scoped workspaces, sessions and memory
  • Per-user and per-tenant quotas
  • HTTP and SSE API defined by a runtime contract with a conformance suite
  • Cloud-native containers, on-prem or in your private cloud
  • A free-to-download CLI for macOS, Linux and Windows

Better with

+ FinHubManaged agent platform
A platform that manages the rest

Identity, orchestration, the conversation record, models, skill review and delivery are already wired around the runtime, so FinClaw only has to do agent work.

+ FinSAFESandbox
Every tool call in its own cell

In the platform, tool calls run in FinSAFE cells by default, outside the FinClaw process, with network access set per policy and tenant allowlists on top.

+ FinDeskWhite-label AI desktop
The same runtime on the desktop

FinDesk ships FinClaw as one of its local runtimes, sandboxed in FinSAFE by default, so the same runtime works on staff computers.

In the wealth solution

The runtime behind every personal advisor

In Personal Wealth Agents, FinClaw runs each client's advisor agent. Each client's sessions, memory and workspace are scoped to their own user, so one client's context never reaches another's.

Per-client isolation

Each client's sessions, memory and workspace are scoped to their own user, so one client's context never reaches another's.

Moments of truth, on schedule

Scheduled agents let the advisor act at a moment of truth, such as tuition due, instead of waiting to be asked. The message reaches the client through the platform's delivery, inbox and push.

See Personal Wealth Agents →

Client app and licensed advisor console shown on the solution page.

Deploy with FDE

A runtime sized to your environment

Forward Deployed Engineers help you choose the deployment tier, wire FinClaw to your identity and model providers, and leave you with a runtime your platform team can operate.

Talk to FDE
A typical FinClaw engagementTypical sequence · scope varies
  1. Step 1

    Assess

    Choose a shared or per-tenant runtime, and the isolation tier your infrastructure supports.

  2. Step 2

    Ground

    Connect identity, model providers and FinSAFE cells, and set quotas and egress allowlists.

  3. Step 3

    Hand over

    Run the conformance and confinement checks, tune capacity, and hand runbooks to your platform team.

Next step

Run many agents for many clients, from one runtime

Talk with a Forward Deployed Engineer about FinClaw on its own or as part of FinAI OS.

Talk to FDEExplore FinAI OS