Skill and MCP scanning

Scanning and admission

DefenseClaw scans skills, MCP servers and plugins when they appear, then allows, warns about or blocks them by severity.

DefenseClaw scans every skill, MCP server and plugin before an agent can use it. A scan gives a severity. Your admission settings turn that severity into an action: allow it, warn, or block and quarantine it. Block and allow lists you write always come first.

Guided example · Synthetic skill bundle

Catch a malicious skill and quarantine it

The watcher scans a new skill where it landed; static and optional intent checks feed the skill admission policy, which quarantines it.

Deterministic
{  "skill": "workspace-helper",  "severity": "critical",  "findings": ["path_escape", "external_exfiltration_intent"],  "file": "quarantined",  "runtime": "disabled",  "install": "blocked"}{  "skill": "workspace-helper",  "severity": "critical",  "findings": ["path_escape", "external_exfiltration_intent"],  "file": "quarantined",  "runtime": "disabled",  "install": "blocked"}
DecisionQuarantine
Reason

CRITICAL skill findings

Action

Move to quarantine, disable runtime, block install, write audit event

07

RecordThe final action and reason enter the audit trail.

Step 7 / 7
What DefenseClaw did — and did not do

What it did

  • Scan the skill where it was installed
  • Combine deterministic checks with optional LLM analysis
  • Quarantine on the admission.skill.actions verdict

What it did not do

  • Hide the skill from the agent while the scan runs
  • Treat LLM analysis as mandatory or sufficient alone
  • Skip the audit trail for a manual allow

How a decision is made

checks
denied
allowed
no rule
matches
no match
off
on
decides
A skill, MCP serveror plugin appears
On a list?asset_policy rules
Blockedno scan
Allowedno scan
First party?admission list
Scan on install?admission setting
Scan, then applythe severity action
Clean, warning,allowed or rejected

List view for small screens. Use the expand button to open the drawing.

  1. A skill, MCP serveror plugin appears
    • checksOn a list?
  2. On a list?asset_policy rules
    • deniedBlocked
    • allowedAllowed
    • no ruleFirst party?
  3. First party?admission list
    • matchesAllowed
    • no matchScan on install?
  4. Blockedno scan
  5. Scan on install?admission setting
    • offAllowed
    • onScan, then apply
  6. Scan, then applythe severity action
    • decidesClean, warning,
  7. Allowedno scan
  8. Clean, warning,allowed or rejected
The admission check for one asset, from policies/rego/admission.rego. Your block and allow lists (asset_policy) are checked first and a denied rule beats an allowed one. The first-party list skips the scan only while allow_list_bypass_scan is true. With no scan result yet, scan_on_install decides between a scan and an immediate allow. A scanner that fails counts as rejected.
  • When it runs. The gateway's install watcher checks a skill, plugin or MCP server when it appears in a watched folder or when an agent adds it. A rescan runs every 60 minutes and whenever the asset or the scanner settings change. The CLI runs the same check on demand.
  • What a verdict does. The defaults quarantine CRITICAL and HIGH skills, warn on MEDIUM, and allow the rest. A rejected skill or plugin moves to a quarantine folder and is disabled. A rejected MCP server stays where it is and its tool calls are refused.
  • When the scanner fails. A scan that errors or cannot run counts as rejected. Admission fails closed.
  • Blocked tool calls. Agent hooks refuse a denied skill, plugin or MCP tool even if the install watcher never saw it.
  • A judge reads what the rules flag. Both scanners use the LLM judge when a model and key are set (DEFENSECLAW_LLM_KEY). Set one up; the rules alone miss most malicious assets.

Skills

A skill is a bundle of instructions an agent follows. The skill scanner checks SKILL.md and bundled files for prompt injection, dangerous shell and Python calls, and untrusted binaries. Findings at HIGH or above quarantine the skill. Findings from MEDIUM up to that line warn and go to the review queue.

defenseclaw skill scan --path ~/code/risky-skill

See Skill scanner for the commands and settings.

MCP servers

An MCP server lists tools an agent can call. The MCP scanner reads each tool's name, schema and description, and flags tools whose behavior does not match what they claim. DefenseClaw scans a server when you add it with defenseclaw mcp set, when an agent adds it, and on every rescan. Until a new server has a verdict, the Claude Code and Codex hooks refuse its tool calls.

See Scan an MCP server.

Plugins

Plugins go through the same admission check. Plugin scanning runs from defenseclaw plugin scan and from the install watcher. Settings use admission.plugin and the plugin-scanner override key. Block and allow lists work the same way as for skills.

What it does not do

  • It does not scan tools. Nothing installs a tool, so tools have name lists only.
  • It does not stop a process that is already running. A block stops tool calls and new installs; use disable or quarantine for a running asset.
  • A local MCP scan starts the server as you. Scan only servers you would run.
  • Admission belongs to the device. Rules can be scoped to a connector, not to a user or group.

Next

Skill scanner

One-shot scan, install watcher, read the verdict.

MCP scanner

Local npx and uvx servers and private URLs.

Block or allow an asset

Lists and which rule wins.

Registries

Approved catalogs.

Reference

Admission, the scanners, registries and AI Discovery in full detail.

Admission

Every admission and asset_policy key in config.yaml, with defaults, the scanner gate, overrides, first-party assets, tool lists and managed-device behavior.

Skill scanner

Skill scanner settings, analyzers, judge, gate, custom policy and pinned version.

MCP scanner

MCP scanner settings, analyzers, judge, action mapping, pinned version and removed keys.

Registries

Registry source kinds, all twelve registry subcommands, entry lifecycle, flags and sync schedules.

AI Discovery

Discovery categories, local model inventory, continuous-scan knobs, signature packs, IDE plugin inventory, AIBOM, runtime planes per OS and data destinations.

Regex cookbook

RE2 regex patterns for DefenseClaw guardrails, quoted from the shipped strict pack — secrets, prompt injection, exfiltration endpoints and enterprise data — with what makes each one precise.

Skill scanner

Scan connector skills on demand and whenever one is installed or changed. DefenseClaw wraps cisco-ai-skill-scanner with the recommended quiet policy and an LLM judge, and writes its verdicts into the same admission policy as the watcher.