AI Defense Stack

Agent & MCP security

Cisco DefenseClaw: open-source governance layer for coding agents

DefenseClaw is an open-source governance layer for coding agents from Cisco. It is released under the Apache-2.0 license and is offered as: CLI, Self-hosted.

  • Last reviewed
Visit DefenseClaw (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 7: Agent and tool access

Best for

Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Consider instead if

  • You want a sandbox with kernel-level isolation as the main control. See OpenShell.
  • You want a gateway for MCP traffic rather than hooks on coding agents. See Docker MCP Gateway.

What DefenseClaw does

Cisco DefenseClaw is an open-source (Apache-2.0) governance layer for AI coding agents, published in Cisco's AI Defense organization on GitHub. A Python command-line tool and a local Go gateway connect to 12 listed agents, including Claude Code, Codex, GitHub Copilot CLI and Cursor, through hooks or plugins. It scans skills and MCP servers before an agent loads them, inspects prompts and tool calls in observe or action mode, can pause risky calls for human approval, and records each decision in a local audit database with OpenTelemetry and Splunk export. The docs also describe an Enterprise edition for managed fleets, and say DefenseClaw does not prove an agent is safe.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Cisco Source, checked October 21, 2026: blogs.cisco.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
888 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 22, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
CLI, Self-hosted Source, checked October 21, 2026: cisco-ai-defense.github.io (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: cisco-ai-defense.github.io (opens in a new tab)
Website
cisco-ai-defense.github.io Source, checked October 21, 2026: cisco-ai-defense.github.io (opens in a new tab)
Documentation
cisco-ai-defense.github.io Source, checked October 21, 2026: cisco-ai-defense.github.io (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
cisco-ai-defense.github.io Source, checked October 21, 2026: cisco-ai-defense.github.io (opens in a new tab)
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Reports go through GitHub private vulnerability reporting, with a Cisco open source security email as fallback Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where DefenseClaw fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that DefenseClaw covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L2 Discovery Discovery and posture Also covers Inventories agents, MCP servers, skills, AI packages and local models on a machine. AI discovery inventories agents, MCP servers, skills, AI SDK dependencies, local models and IDE extensions on a machine
L3 Supply chain Model and supply chain Also covers Scans skills and MCP servers before an agent loads them and quarantines critical and high findings. Scans skills and MCP servers before an agent loads them, wrapping Cisco's skill and MCP scanners; critical and high findings quarantine a skill by default

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to DefenseClaw, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Inspects prompts, completions and tool calls for injection attacks and can block at a set severity in action mode. Inspection engine checks LLM prompts, completions and tool invocations for injection attacks, data exfiltration and command-and-control patterns
LLM02 Sensitive Information Disclosure The same inspection looks for data exfiltration patterns in prompts, completions and tool calls. Inspection engine checks LLM prompts, completions and tool invocations for injection attacks, data exfiltration and command-and-control patterns
LLM06 Excessive Agency Blocks or asks a person to approve risky tool calls, and can run an agent in a sandbox. Guardrail rule packs with an optional LLM judge run in observe mode (blocks nothing) or action mode (blocks at a set severity); Human approval can pause high-severity tool calls for an operator, but only on agents that expose a native approval prompt; Can run an agent inside an NVIDIA OpenShell sandbox, which the docs label a preview on Linux and Apple-silicon Macs

Not mapped in our analysis: LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

NeuralTrust

NeuralTrust

Open sourceApache-2.0 Freemium
  • SaaS
  • Self-hosted
  • On-prem

Routes agent traffic through a gateway with per-agent tool access, prompt inspection and audit trails.

Best for: Teams that want a gateway in front of agents, models and MCP tools with per-tool access and audit, and that can start on a free plan or self-host the gateway

Coverage Score 68 out of 100
  • LLM01 Prompt Injection
  • LLM06 Excessive Agency

Reviewed

DefenseClaw FAQ

Does DefenseClaw block anything by default?

No. The quickstart sets up observe mode, which logs findings and blocks nothing. Blocking starts only when you switch an agent to action mode, and human approval is a separate opt-in.

Which agents does it support?

The docs list 12 agents: Claude Code, Codex, GitHub Copilot CLI, Cursor, Devin, Antigravity, Kiro, OpenCode, Amp, Hermes, OpenHands and OmniGent. Each connector uses the strongest control its agent exposes, so blocking and approval differ by agent.

Is there a paid edition?

The docs compare an Open source edition with an Enterprise edition for managed fleets, with controls such as machine policy and MDM deployment. The pages we read state no price for either edition.

Key facts you can cite

We have no commercial relationship with Cisco.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.