Cisco DefenseClaw is an open-source security governance framework for agentic AI systems that enforces a strict principle: nothing runs until it has been scanned, and anything dangerous is blocked automatically.
While MCP-Scan focuses specifically on MCP server vulnerability scanning and Agentic Radar audits agentic workflows across frameworks, DefenseClaw provides a broader governance layer that adds skill scanning, static code analysis, runtime inspection, and sandbox isolation.
Open-sourced by Cisco AI Defense in March 2026, DefenseClaw provides pre-execution scanning of AI agent skills and MCP servers, static code analysis, runtime inspection of LLM interactions, and enterprise-grade audit logging.
Besides OpenClaw, an open-source agent framework, it connects to AI coding agents such as Claude Code, Codex, GitHub Copilot CLI and Cursor. Its scanning components also work on their own.
The project is part of Cisco’s broader AI Defense portfolio, which addresses security across the AI application lifecycle from development through deployment.
What is Cisco DefenseClaw?
As AI agents gain the ability to execute code, call external APIs, and interact with production systems, the attack surface expands dramatically. A compromised agent skill can exfiltrate data, a poisoned MCP server can hijack agent behavior, and insecure code patterns can introduce vulnerabilities that traditional security tools miss.
DefenseClaw addresses this by inserting a mandatory security gate between AI components and execution. Every skill, MCP server, and code artifact is scanned before it runs.
Runtime interactions between agents and LLMs are inspected for secrets, PII, and injection patterns. All decisions are logged to an immutable audit store.
| Capability | Details |
|---|---|
| Component Scanning | Skill Scanner analyzes AI agent skills before execution. MCP Scanner inspects MCP servers for vulnerabilities. AI Bill of Materials (AIBOM) generates a unified component inventory with severity-ranked findings across all scanned components. |
| CodeGuard Static Analysis | Detects hardcoded credentials, dangerous code execution patterns (eval, subprocess with shell=True), unsafe deserialization, SQL injection, weak cryptography, and path traversal. Purpose-built for the patterns that appear in AI agent code. |
| Runtime Inspection | Message Inspection examines LLM prompts and completions for secrets, PII, and injection patterns. Tool Inspection evaluates six threat categories: secrets, commands, sensitive paths, C2 hostnames, cognitive file tampering, and prompt injection disguises. |
What are Cisco DefenseClaw’s key features?
| Feature | Details |
|---|---|
| Skill Scanner | Pre-execution analysis of AI agent skills |
| MCP Scanner | Vulnerability scanning for MCP servers |
| AIBOM | AI Bill of Materials with severity-ranked findings |
| CodeGuard | Static analysis for credentials, injection, unsafe patterns |
| Message Inspection | Prompt/completion scanning for secrets, PII, injection |
| Tool Inspection | Six categories: secrets, commands, paths, C2, tampering, injection |
| Sandbox Mode | NVIDIA OpenShell sandbox: container or MicroVM on Linux, VM on Mac |
| Policy Enforcement | Go gateway with REST API and WebSocket bridging |
| Audit Logging | SQLite store with full decision history |
| SIEM Integration | Splunk HEC real-time event forwarding |
| Observability | OTLP export (logs, spans, metrics) to Jaeger, Grafana, Datadog |
| Build System | make build (all), make pycli, make gateway, make plugin |
| Cross-compile | make gateway-cross GOOS=linux GOARCH=arm64 (DGX Spark) |
| Requirements | Python 3.10–3.13, Go 1.26.4 for source builds; installer otherwise |
| License | Apache 2.0 |
Architecture
DefenseClaw combines a Python operator CLI, a Go gateway, connector hooks, policy, scanners and observability exporters:
The Python CLI is the operator-facing tool for scanning and policy management. Security teams use it to run Skill Scanner, MCP Scanner, and CodeGuard against their AI components.
The Go Gateway is the central daemon that handles REST API requests, WebSocket bridging, policy enforcement, and audit logging.
Every security decision flows through the gateway, which writes to a SQLite audit store and can forward events to Splunk HEC or OTLP-compatible collectors in real time.
Connectors are written for each agent rather than inside it: Claude Code’s hooks, the hooks in Codex’s config.toml, Cursor’s hooks.json and OpenCode’s plugin. Each one routes tool calls through the gateway for a policy decision before they run.
Sandbox isolation
On its own, DefenseClaw judges what an agent does but does not isolate it: on the host, the agent keeps the user’s file and network access.
For isolation, defenseclaw sandbox run starts the agent in an NVIDIA OpenShell
sandbox. On Linux that is a container or MicroVM, on Apple-silicon Macs a small VM, and the agent sees only the project folder.
Enterprise observability
All security decisions flow through the Go gateway and are written to a SQLite audit store.
For enterprise environments, DefenseClaw can forward events to Splunk HEC in real time for SIEM integration, or export logs, spans, and metrics via OTLP to collectors like Jaeger, Grafana, or Datadog. This means every scan result, runtime inspection outcome, and policy enforcement decision is captured in your existing observability stack.
LLM guardrail proxy
DefenseClaw includes a built-in guardrail proxy that inspects all LLM traffic in real time, operating independently of plugin installation. The proxy runs in two modes: observe mode logs findings without blocking, while action mode actively blocks flagged prompts and responses. Severity thresholds are configurable in ~/.defenseclaw/config.yaml.
Tool inspection categories
The runtime tool inspection engine evaluates six specific threat categories: secret (API keys in arguments), command (shell commands like curl/wget/nc), sensitive-path (system files), c2 (command-and-control hostnames), cognitive-file (memory/instruction tampering), and trust-exploit (prompt injection disguised as arguments).
OWASP, NIST, and MITRE alignment
DefenseClaw’s six tool-inspection categories map directly to the OWASP Agentic AI Threats and Mitigations taxonomy: secret and command cover T7 Tool Misuse; sensitive-path and c2 cover T6 Excessive Agency and T8 Communication Poisoning; cognitive-file covers T1 Memory Poisoning; and trust-exploit covers T15 Human Manipulation plus indirect prompt injection scenarios from OWASP Top 10 for LLM Applications LLM01: Prompt Injection.
The pre-execution scan + runtime gateway model is a textbook Policy Enforcement Point (PEP) pattern, which is what NIST AI RMF Manage recommends for high-risk agentic deployments. SIEM forwarding to Splunk HEC and OTLP-compatible collectors gives the Measure function structured evidence, and tool-call traces map onto MITRE ATLAS techniques such as AML.T0011 Command and Scripting Interpreter and AML.T0051 LLM Prompt Injection for shared red-team and detection vocabulary.
How do I get started with Cisco DefenseClaw?
- Install DefenseClaw — Run the one-line installer:
curl -LsSf https://raw.githubusercontent.com/cisco-ai-defense/defenseclaw/main/scripts/install.sh | bash. Requires Python 3.10+, Go 1.25+, and optionally Node.js 20+ for the TypeScript plugin. - Initialize the framework — Run
defenseclaw init --enable-guardrailto set up the Go gateway, configure the SQLite audit store, and enable guardrail functionality. The gateway starts listening for policy enforcement requests. - Scan your AI components — Use the CLI to run Skill Scanner on your agent skills, MCP Scanner on your MCP servers, and CodeGuard on your codebase. The AIBOM generator creates a unified inventory with severity-ranked findings.
- Configure runtime inspection — Enable Message Inspection and Tool Inspection to scan LLM interactions in real time. Define policies for what should be blocked, alerted, or logged for each threat category.
- Connect enterprise observability — Forward audit events to Splunk HEC for SIEM integration or export logs, spans, and metrics via OTLP to your existing observability stack (Jaeger, Grafana, Datadog). Set
OTEL_EXPORTER_OTLP_ENDPOINTfor OTLP collectors.
When to use Cisco DefenseClaw
Ideal for organizations deploying agentic AI systems in enterprise environments that need governance controls matching their existing security standards.
The framework covers the full lifecycle — pre-execution scanning, runtime inspection, and audit logging — which makes it a strong fit for regulated industries where every AI component interaction needs to be auditable.
The Cisco backing and enterprise integrations (Splunk, OTLP) make it a natural fit for organizations already in the Cisco security ecosystem, though the open-source license means it works independently of any Cisco product.
For a broader overview of AI security tools, see the AI security tools guide. For MCP-specific vulnerability scanning without the full governance framework, see MCP-Scan . For security analysis of agentic workflows across multiple frameworks, consider Agentic Radar .
DefenseClaw alternatives
DefenseClaw is a young project (open-sourced in March 2026), so most teams evaluate it alongside narrower or commercial alternatives.
MCP-Scan is the closest component-scope alternative. It focuses on MCP server vulnerability scanning — prompt injection, tool poisoning, configuration weaknesses — without the broader skill scanning, static analysis, or runtime gateway. MCP-Scan is the better pick when MCP servers are the only concern and a governance gateway is overkill.
HOL Guard is an open-source alternative for coding agents on developer machines. It integrates with 16 agents, with event coverage varying by agent, and adds a package firewall for npm and PyPI installs.
Agentic Radar widens the lens to multi-framework agentic workflow scanning, supporting LangGraph, CrewAI, AutoGen, and similar orchestrators that DefenseClaw does not natively cover. It is a strong fit for teams running agents across multiple frameworks who need a workflow-level static audit rather than a runtime PEP.
Akto is the closest commercial alternative, with API and agentic AI security testing in a hosted SaaS package. Akto suits enterprises that want managed scanning, dashboards, and ticketing integration rather than running a self-hosted CLI + gateway.
Cerbos is complementary rather than competitive — it handles fine-grained authorization for AI agents and MCP tool access. Many teams pair Cerbos (deciding which tools an agent is allowed to call) with DefenseClaw (deciding whether a tool call is safe to execute) for layered policy + safety controls.
For broader runtime AI security, see Lakera Guard (acquired by Check Point in September 2025) and Prompt Security (acquired by SentinelOne in May 2025) — both are AI firewall products that overlap with DefenseClaw’s runtime inspection layer.