____         ____                       ____  _
    / __ \  ___  / __/___   ___   ___  ___  / ___|| | __ _ __      __
   / / / / / _ \/ /_// _ \ / _ \ / __|/ _ \| |    | |/ _` |\ \ /\ / /
  / /_/ / /  __/ __//  __/| | | |\__ \  __/| |___ | | (_| | \ V  V /
 /_____/  \___/_/   \___/ |_| |_||___/\___| \____||_|\__,_|  \_/\_/

DefenseClaw combines a Python operator CLI, a Go gateway sidecar, and an OpenClaw TypeScript plugin. Together they enforce a simple operating rule: untrusted agent capabilities are scanned, governed, logged, and blocked when policy says they are unsafe.

• Admission control - scan skills, MCP servers, plugins, and code before they run.
• Runtime guardrails - inspect prompts, completions, and tool calls with regex rules, policy, optional LLM judge, and Cisco AI Defense inspection.
• CodeGuard - built-in static checks for secrets, dangerous execution, unsafe deserialization, weak crypto, injection patterns, and risky file access.
• OpenShell sandbox support - Linux sandbox setup with network, filesystem, syscall, and policy controls.
• Registries - ingest external skill / MCP catalogs (corporate HTTPS YAML, smithery.ai, skills.sh, git, ClawHub) with SSRF guards, scanner-driven verdicts, and auto-promotion into asset policy. See docs/REGISTRIES.md.
• Audit and observability - SQLite audit store, JSONL gateway logs, OTLP export, Splunk HEC, webhooks, and local Grafana/Splunk bundles.
• Operator UX - a CLI and TUI for setup, health checks, alerts, block/allow lists, scanner results, and policy workflows.

DefenseClaw is an enforcement and evidence layer for agentic AI deployments. It improves safety by combining scanner results, runtime inspection, policy decisions, sandbox controls, and audit trails, but it does not prove that an agent, skill, plugin, or model interaction is risk-free.

High-risk deployments should pair DefenseClaw with human review, least-privilege credentials, sandboxing, CI gates, and production monitoring. In observe mode, findings are logged without blocking. In action mode, configured HIGH and CRITICAL findings can block prompts, tool calls, or component admission.

Project Markdown documentation is centralized under docs/. Package-local READMEs stay beside bundles or examples that need local context.

git clone https://github.com/cisco-ai-defense/defenseclaw.git
cd defenseclaw
make all

curl -LsSf https://raw.githubusercontent.com/cisco-ai-defense/defenseclaw/main/scripts/install.sh | bash
defenseclaw init --enable-guardrail

For platform-specific steps, see docs/INSTALL.md.

# Check the local install and dependencies
defenseclaw doctor

# Initialize config, scanner defaults, and guardrail plumbing
defenseclaw init --enable-guardrail

# Scan installed agent capabilities
defenseclaw skill scan all
defenseclaw mcp list
defenseclaw plugin scan extensions/defenseclaw

# Start the Go gateway sidecar
defenseclaw-gateway start

# Open the operator dashboard
defenseclaw tui

Run the guardrail in observe mode while tuning:

defenseclaw setup guardrail --mode observe --restart

Switch to action mode when the policy is ready to block:

defenseclaw setup guardrail --mode action --restart

See docs/QUICKSTART.md for the full walkthrough.

The gateway exposes local REST APIs for the CLI and plugin, connects to OpenClaw over WebSocket, inspects LLM traffic through a local proxy, and records decisions in a durable audit store.

Agent runtime -> OpenClaw plugin -> DefenseClaw gateway -> policy + scanners + audit
                                    |
                                    +-> guardrail proxy -> LLM provider
                                    +-> OTLP / Splunk / webhooks / JSONL

For diagrams and detailed flows, read docs/ARCHITECTURE.md.

DefenseClaw wraps Cisco AI Defense scanners and local policy into a single admission flow:

Scanner policies live in policies/scanners/. Guardrail rule packs live in policies/guardrail/.

DefenseClaw records enforcement and runtime evidence across several channels:

Start local observability with:

defenseclaw setup local-observability up
defenseclaw gateway
defenseclaw setup local-observability status

See docs/OBSERVABILITY.md and docs/SPLUNK_APP.md.

# Build all components
make build

# Run primary test suites
make test

# Run lint checks
make lint

Focused test and development guidance lives in docs/TESTING.md and docs/CONTRIBUTING.md.

Contributions are welcome. Start with CONTRIBUTING.md, docs/CONTRIBUTING.md, and the focused docs for the area you are changing.

Please report vulnerabilities through the process in SECURITY.md.

Apache 2.0 - see LICENSE.

Copyright 2026 Cisco Systems, Inc. and its affiliates.