cisco-ai-defense/defenseclaw

Security Governance for Agentic AI

What it solves

DefenseClaw provides security governance for agentic AI runtimes and OpenClaw. It addresses the risk of AI agents performing unauthorized or unsafe actions by providing a layer for scanning capabilities before they are used, inspecting runtime traffic, and exporting audit evidence for compliance and security monitoring.

How it works

The project implements an enforcement and evidence layer using a combination of a Python operator CLI, a Go-based gateway, connector hooks, and a system of policies and scanners. It monitors and controls the agentic AI runtime environment to ensure that interactions and capabilities are governed by defined security policies.

Who it’s for

This tool is designed for security engineers and operators who need to manage the risk and security governance of AI agents in production or development environments.

Highlights

  • Capability Scanning: Scans AI agent capabilities before they are executed to prevent risks.
  • Runtime Inspection: Inspects traffic during the agent's runtime to ensure ongoing security.
  • Audit Evidence: Exports durable audit evidence for security auditing and auditing purposes.
  • Polyglot Architecture: Combines Python for the CLI/TUI and Go for the high-performance gateway implementation.

Related

  • Project
    ucsandman/DashClaw

    A safety and governance layer for unattended AI agents that intercepts destructive tool calls and requires human approval via a signed decision ledger.

  • Dispatch
    Securing the Agentic Frontier: Inside OpenClaw's Defense-in-Depth Strategy

    OpenClaw outlines its approach to securing powerful AI assistants through filesystem boundaries, network egress control, and rigorous plugin provenance.

  • Project
    GoPlusSecurity/agentguard

    A real-time security layer for AI agents that blocks destructive commands, scans plugins for malicious code, and performs daily security audits to prevent data theft and system damage.

  • Project
    canyonroad/agentsh

    A secure, policy-enforced execution gateway for AI agents that intercepts and governs file, network, process, and database activity at runtime.

  • Project
    Netw0rkNoob/VulnClaw

    VulnClaw is an AI‑driven penetration‑testing CLI that lets you describe a target in natural language. An LLM‑controlled agent runs a self‑directed loop, calling built‑in tools (HTTP fetch, nmap, shell commands, crypto helpers, etc.) and optional MCP services (Chrome‑DevTools, Burp) to gather evidence, discover vulnerabilities, exploit them, and finally produce a markdown report and Python PoC. It supports many LLM providers, a plugin system, skill reference libraries, and offers CLI, REPL, TUI, and web UI front‑ends.