Ken Huang - CEO of Distributedapps.ai
Idan Habler, PhD - Senior Tech Lead @ Cisco
Ruchika Pandey - Principal Engineer @ CiscoVineeth Sai Narajala - Senior Tech Lead @ Cisco
OpenClaw is a free, open-source autonomous AI agent that runs locally as a personal assistant. That local-first design is powerful, but it also means the agent can end up operating near your most sensitive data: private files, credentials in developer environments, internal chats, and connected apps such as WhatsApp or Discord.
This is the core tension in agentic AI today: the same capabilities that make personal agents useful also expand the attack surface. Skills can be added quickly, often autonomously by the agent, MCP servers can introduce third-party execution paths, and plugins can influence runtime behavior in ways that are hard to keep up with, and to validate manually.
DefenseClaw was engineered to close this gap by serving as a comprehensive governance and security control plane for OpenClaw. Instead of requiring teams to assemble disparate point tools, DefenseClaw offers a cohesive, ready-to-use security layer. It natively orchestrates intelligence from the Cisco AI Defense ecosystem to deliver:
**Comprehensive Asset Security:**Native, automated scanning for skills and MCPs.**Built-in Transparency:**Automated AI Bill of Materials (AIBOM) generation to track all components.**Continuous Governance:**Centralized policy enforcement and real-time plugin validation.**Advanced Runtime Protection:**Optional integration with NVIDIA OpenShell sandboxing for kernel-level isolation.
By centralizing these capabilities, DefenseClaw abstracts the complexity of AI security, giving teams a practical, turnkey control plane from day one.
DefenseClaw was built to solve that gap. It provides a governance and security layer for OpenClaw using scanning tools and threat intelligence from the Cisco AI Defense ecosystem applied and extended specifically to meet OpenClaw the way it operates. It applies protections to both the supply chain so only trusted skills, tools, plugins and MCP servers are used, as well as to the runtime so guardrails are applied as OpenClaw operates. It includes:
skill-scanner (Cisco AI Defense)
mcp-scanner (Cisco AI Defense)
aibom generation (Cisco AI Defense)
Secure code generation skill and plugin for agent generated code (
project-codeguard)Built-in plugin scanning, a file watcher, and admission controls
Runtime Guardrails on all LLM conversations and Tool calls
Policy enforcement
Optional integration with NVIDIA OpenShell sandboxing for kernel-level runtime isolation
Telemetry for all actions
With all these functions, teams get a practical control plane rather than isolated point tools.
MAESTRO (the CSA threat-modeling framework for agentic AI) is a useful way to explain exactly why this matters. It gives a 7-layer view of risk. DefenseClaw gives a practical implementation path across those layers.
Github Repo: https://github.com/cisco-ai-defense/defenseclaw
Traditional app security assumes stable release cycles and predictable interfaces. Agentic systems violate both assumptions:
Capabilities are composable and frequently changing.
Tool calls can become command execution surfaces.
Prompt-level manipulation can trigger real-world actions.
Supply chain risk extends beyond packages into skills, MCP servers, and plugins.
DefenseClaw addresses this with a simple operating principle:
Nothing runs until it is scanned, and risky behavior is enforced at runtime.
In practice, that means:
Admission control for skills, MCP servers, and plugins
Runtime inspection of prompts, responses, and tool calls
Severity-based allow/warn/block actions
Auditable records and SIEM/OTel export for investigation and compliance
DefenseClaw does not claim to “secure model internals” at provider level. Instead, it secures the usage boundary:
LLM traffic is inspected through the guardrail flow.
Prompt injection and sensitive-pattern risks are detected before damage propagates.
Teams can run in observe mode first, then enforce blocking in action mode.
Boundary you get: control of model I/O paths in your runtime, not provider-side training stack controls.
MAESTRO highlights poisoning and leakage risks in data flows. DefenseClaw contributes via pre-execution and write-path controls:
CodeGuard detects hardcoded credentials, weak crypto usage, unsafe deserialization, risky exec patterns, SQLi-like constructs, and path traversal indicators.
Tool-argument inspection catches sensitive file access attempts and suspicious destinations.
Boundary you get: guardrails on agent-handled data and generated code paths, with explicit policy decisions.
This is one of the most critical layers for OpenClaw deployments, and a core DefenseClaw strength.
Before capabilities run, DefenseClaw can scan and evaluate:
Skills via Cisco AI Defense skill-scanner
MCP servers via Cisco AI Defense mcp-scanner
Plugins via DefenseClaw’s plugin scanning flow
Component inventory context via aibom outputs
DefenseClaw unifies scanner findings into policy decisions, so operators can apply consistent thresholds and automated actions.
Boundary you get: a real admission gate on extension surfaces that are typically unmanaged in agent stacks.
MAESTRO emphasizes runtime hardening, isolation, and infrastructure abuse prevention. DefenseClaw supports this with optional sandboxed operation on Linux through NVIDIA OpenShell:
Namespace-based isolation
Landlock filesystem restrictions
seccomp syscall filtering
Network policy controls and controlled egress paths
DefenseClaw then layers governance on top: scan-before-run, runtime inspection, and auditability.
Boundary you get: defense-in-depth from infrastructure isolation + agent policy enforcement, especially strong in Linux sandbox deployments.
Security controls without evidence are hard to trust and harder to operate. DefenseClaw includes operational telemetry primitives:
Local SQLite audit store
Alert visibility through CLI workflows
Splunk HEC (HTTP Event Collector) forwarding
OTLP (Open Telemetry) export for logs/metrics/traces
This supports detection, triage, and post-incident reconstruction.
Boundary you get: consistent security telemetry for agent operations, ready for SOC workflows.
MAESTRO treats this as cross-cutting by design, and DefenseClaw aligns well:
Policy-based decisions (allow/alert/block) across scans and runtime events
Clear enforcement semantics in observe vs action modes
Centralized evidence of what was blocked, why, and when
Boundary you get: enforceable governance and auditability across the full OpenClaw operational lifecycle.
At ecosystem level, the question is whether teams can move fast without losing control. DefenseClaw’s value here is consistency:
One governance layer across skills, MCP servers, plugins, and tool execution
Shared policy and scanner outputs
Operational workflows that map to real team behavior, not theoretical controls
Boundary you get: standardized security posture across the parts of the agent stack that evolve fastest.
If your team is using OpenClaw in development or production, DefenseClaw gives you a clear and immediate upgrade in security posture:
It reduces pre-execution risk with admission controls.
It reduces runtime risk by inspecting and enforcing on live agent behavior.
It gives security teams traceable evidence and integration into existing observability stacks.
It supports stronger isolation in Linux environments through OpenShell integration.
Most importantly, it introduces a security boundary that matches how agentic systems actually behave: dynamic, composable, and high-consequence.
DefenseClaw is a practical way to implement protection across those layers in real OpenClaw environments.
OpenClaw gives you capability velocity.
DefenseClaw gives you governance velocity.
That combination is what responsible agentic AI operations should look like.
