Skip to content

Back to the catalog

DefenseClaw
github.comrepo

DefenseClaw

DefenseClaw is a Cisco AI Defense open-source project providing security governance for OpenClaw and other agentic AI runtimes. It combines a Python operator CLI, a Go gateway, connector hooks, policy engine, capability scanners, and observability exporters to scan agent capabilities before use, inspect runtime traffic, and export durable audit evidence — positioned explicitly as an enforcement/evidence layer, not a guarantee of risk-free agent behavior.

TL;DR Cisco's open-source gateway/scanner/policy stack for governing OpenClaw and agentic AI runtime traffic.
Open original ↗
Document

What it is

DefenseClaw is an Apache-2.0 project from Cisco AI Defense (copyright 2026) that governs AI coding agents and agentic runtimes. It has a Python operator CLI, a Go gateway, connector hooks, a policy engine, scanners and observability exporters. The README says it is an enforcement and evidence layer and does not prove that an agent, a model interaction or a third-party capability is risk-free.

Preconditions / Affected

  • Source builds need Python >=3.10,<3.14 (pyproject.toml) and Go 1.26.4 (go.mod). CI exercises the TypeScript components with Node.js 24.
  • Native Windows has its own install guide. The page does not describe it.
  • The documentation website is the source of truth for installation, configuration, commands and workflows. Repository Markdown covers contributor guidance, implementation contracts, schema references and design history.

What to do

Install the latest release and start setup:

curl -LsSf https://github.com/cisco-ai-defense/defenseclaw/releases/latest/download/install.sh | bash
defenseclaw quickstart

Upgrade a release install with defenseclaw upgrade, which runs the latest release's installer.

To build from source for contribution or evaluation:

git clone https://github.com/cisco-ai-defense/defenseclaw.git
cd defenseclaw
make build
make test
make check
make lint
  • make build produces checkout artifacts without publishing them or changing managed installation state. Its pycli step may create or update the repository-local .venv.
  • All source targets share one locked .venv. There is no separate production environment.
  • make test, make check and make py-lint bootstrap that environment when needed.
  • Run make help before using state-changing targets. make all rebuilds and activates the current checkout. make install, make dev-install and scripts/install-dev.sh enforce source-ownership rules and are not an upgrade path.
  • Source targets are contributor tooling and should not be used to install or upgrade a release-managed host.

Caveats

Hooks fail closed by default. Cisco Secure Client deployments are the exception: hook delivery defaults to fail-open when no policy is specified. In that case an explicit fail-closed setting and valid policy denials still apply. The page points to a "Fail modes" doc for the Secure Client scope, and that doc was not part of the fetched text.

The README gives no detail on which agent runtimes are supported beyond OpenClaw, what the scanners detect, or how the policy language works. Private vulnerability reports go through SECURITY.md.

Technologies named here

Related in AI Security