Before you start

Requirements

clawee is a client — it runs on top of burrowee, the transport that carries your connection to the remote box. You need two things:

burrowee installed — get it at burrowee.com. clawee talks to the local burrowee daemon over a unix socket and will auto-start it when needed (it never replaces or supervises it).
a paired gateway — your device must be bootstrapped against at least one burrowee gateway (see pairing below). Without a gateway binding there's no route, and clawee will tell you so.

Why burrowee? clawee deliberately owns no transport of its own. burrowee handles pairing, gateways, relays, and the encrypted tunnel; clawee focuses on the terminal — sessions, the picker, uploads, the composer. Learn more at burrowee.com.

Supported clients: macOS and Linux. A box that hosts sessions also runs claweed (the session broker).

Setup

Get running

Two components, each installed with a one-liner (fetched over TLS and signature-verified from release.clawee.org). On a fresh setup, install the daemon on each box that hosts sessions first, then the client on the machines you drive them from.

Install the daemon — boxes that host sessions

$ curl -fsSL https://release.clawee.org/claweed/install.sh | sh

$ claweed setup            # first run: doctor --fix, then bootstrap YOUR tenant keys from ~/.ssh/authorized_keys (consent-gated, idempotent)

Install the client — your laptop / workstation
$ curl -fsSL https://release.clawee.org/clawee/install.sh | sh
Bind to a gateway — the route
In your burrowee console, mint a one-time blob + PIN, then on the client:
```
$ burrowee bootstrap <blob> <pin>
```
This is transport only — it carries no trust on its own.
Pair the device — trust
claweed setup already bootstrapped trust for your own login — every key already listed in the host's ~/.ssh/authorized_keys, the same keys your ssh-agent offers when you SSH into that box. If the device you're pairing from holds one of those keys, it's already trusted and you can skip ahead to attach. A device with no matching key — or a host where claweed setup never ran — enrolls by hand instead; see pairing a device for that first-device walkthrough. Enrolling an additional device from the picker is two steps: knock, then approve.

On the new device, run clawee — an untrusted key can't open a session, so the picker opens as a pairing form instead. Press Enter on the pair row to send the knock:
```
gateway   workshop (SHA256:a1b2c3d4)
status    not paired
key       SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

⏎ pair · r re-check · l relays · q quit
```
From a device that's already enrolled, approve the pending fingerprint:
```
$ clawee devices approve [<#>|<fp>] [--label <x>]  # bare = first asking, #N = pending index
```
The new device's form re-checks itself every 10 seconds and drops into the ordinary picker once the key is trusted.
Attach
Back on the client, open the picker and attach:
```
$ clawee
```

Where next

Once you're attached, here's the rest of the surface:

Sessions & keysAttach flags, the session picker, views & keys, locking, the composer, slash commands.

Gateways & usersThe multi-user gateway model, the tree chooser, and the gateway verbs.

RelaysRelay preference order, LAN auto-rank, and the relays verbs.

Devices & pairingThe full trust model — every pairing-form state, knock/approve, revocation.

The daemonclaweed operations — setup, doctor, update, tenants, troubleshooting.

clawee CLI referenceEvery clawee verb, generated verbatim from the binary's own help renderer.

claweed CLI referenceEvery claweed verb, generated verbatim from the binary's own help renderer.

Docs synced 2026-08-21 against clawee v0.2.12 · claweed v0.2.4.