Skip to content
Cisco AI Defense logo
CiscoAI Security

Scanner catalog — DefenseClaw

Overview

A scanner in DefenseClaw is anything that produces an internal/scanner.ScanResult on an artifact or content. The policy engine consumes those results through admission, guardrail, firewall, audit, and skill-action Rego modules.

ScannerTargetTimingInvoked by
Skill scannerSkill manifests + tool definitionsInstall-time or on demanddefenseclaw skill scan
MCP scannerMCP server config + exposed toolsInstall-time or on demanddefenseclaw mcp scan
Plugin scannerOpenClaw pluginsInstall-time or on demanddefenseclaw plugin scan
CodeGuardSource files and directoriesOn demanddefenseclaw-gateway scan code
ClawShieldReadable skill/code contentInternal scanner implementationsGo scanner constructors
AIBOMLive OpenClaw inventoryOn demanddefenseclaw aibom scan
CustomUser-definedIn-process registryplugins.Registry.Register

Every scanner result carries a scanner name, target, timestamp, findings, and duration. The policy engine decides what to do with the resulting severity and finding set.

The result shape

{
  "scanner": "codeguard",
  "target": "./src",
  "timestamp": "2026-04-23T00:00:00Z",
  "findings": [
    {
      "id": "CG-EXEC-001",
      "severity": "HIGH",
      "title": "Unsafe command execution",
      "scanner": "codeguard",
      "tags": ["codeguard"]
    }
  ],
  "duration": 125000000
}

defenseclaw-gateway scan code --json emits the v7 wire shape from internal/cli/scan_v7.go, which includes additional schema, scan ID, provenance, and optional agent identity fields.

Local vs remote

Scanners run in one of three modes, set by guardrail.scanner_mode:

  • local — everything runs in-process / out-of-process on this machine. No network.
  • remote — verdicts are requested from the Cisco AI Defense cloud scanner.
  • both — local runs first; if severity=NONE the remote scanner is consulted for a second opinion.

Most deployments start local and add both once the remote scanner is integrated.

Related