DefenseClaw
Copyright 2026 Cisco Systems, Inc. and its affiliates

This product includes software developed at Cisco Systems, Inc.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

DERIVED WORK: SHADOWCLAW

The AI Discovery runtime planes (internal/sensor/) are a derivative work of
ShadowClaw -- Universal Shadow AI Detector.

    Copyright (c) 2026 Mike Storm. All rights reserved.
    Author: Mike Storm, Distinguished Engineer, CCIE Security 13847
    https://github.com/gatekeeper454/ShadowClaw
    Licensed under the Apache License, Version 2.0
    Upstream revision: 16eac806b3bdfc6ca32252b840284646cb7a3c59 (v1.4.1, 2026-09-09)

Material modifications made by Cisco Systems, Inc.:

  - The detection engine was reimplemented in Go and absorbed into the
    DefenseClaw gateway sidecar. It is no longer a standalone Python sensor,
    a separate process, or a separately installed service.
  - The upstream official-build identity block -- the authorship module, the
    attribution digest and its verification, the CLI banner, and the
    "shadowclaw.*" telemetry resource attributes -- was removed. This build
    does not assert ShadowClaw project provenance and is not an official
    ShadowClaw release.
  - The Kinetic Trust Protocol (KTP) implementation, the KTP oracle sidecar,
    the hand-written OTLP exporter, the standalone tamper-evident ledger
    store, the redaction layer, and the macOS/Linux/Windows installer
    packaging were removed in favor of the existing DefenseClaw equivalents.
  - Cross-product corroboration against DefenseClaw's inventory JSON file was
    replaced by an in-process correlation join.

This NOTICE preserves the attribution required by Apache License 2.0 section 4.

VENDORED SOURCE: TETRAGON API

third_party/tetragon/ carries the gRPC API definitions of Tetragon, which the
Linux sensor helper uses to read a customer-run Tetragon agent.

    Copyright Authors of Tetragon (Copyright Authors of Hubble in the .proto
    headers)
    https://github.com/cilium/tetragon
    Licensed under the Apache License, Version 2.0
    Upstream revision: api/v1.7.1 (commit 99ca93d98710b98a42551bf3c12613e32888885d)

The five .proto files are unmodified. The Go stubs next to them were generated
from those files by DefenseClaw with protoc-gen-go and protoc-gen-go-grpc; the
only change from upstream's generation is the Go package path. Tetragon ships no
NOTICE file. third_party/tetragon/README.md records the provenance checks.

internal/sensor/kernelpolicy/testdata/tracingpolicy-v1.7.0.schema.json is the
openAPIV3Schema of Tetragon's TracingPolicy CRD from cilium/tetragon v1.7.0
(pkg/k8s/apis/cilium.io/client/crds/v1alpha1/cilium.io_tracingpolicies.yaml,
Apache-2.0, same copyright), with its descriptions removed. It is test data
only: a unit test checks that the kernel policies DefenseClaw renders use only
fields the lowest supported Tetragon accepts. It is not shipped in any binary
or package.

Declared third-party dependencies are listed in go.mod/go.sum (Go) and
pyproject.toml/uv.lock (Python). The shipped OpenClaw TypeScript plugin is built
from extensions/defenseclaw/package.json and
extensions/defenseclaw/openclaw.plugin.json; the runtime archive carries them
as root package.json and openclaw.plugin.json files.
extensions/defenseclaw/package-lock.json is its locked build input but is not
placed in that runtime archive. The docs-site/package.json and
docs-site/package-lock.json files belong to the separately deployed
documentation site, not a DefenseClaw runtime artifact.

Redistributed contents vary by artifact. GoReleaser archive Syft SBOM sidecars
inventory the gateway archives. The Windows Setup merged SPDX 2.3 SBOM also
derives its exact linked Go module inventory from `go version -m`.

THIRD_PARTY_LICENSES.txt is a scoped attribution artifact for dependencies
added by the structured command and semantic tool-call analysis work, not an
exhaustive dependency inventory. Its header records the exact covered module
versions, upstream license sources, and license-text digests. Additional
license details can be found in each dependency's source repository. Key
dependencies include:

  - Cobra (github.com/spf13/cobra) — Apache-2.0
  - Viper (github.com/spf13/viper) — MIT
  - Bubbletea (charm.land/bubbletea) — MIT
  - Lipgloss (charm.land/lipgloss) — MIT
  - Bubbles (charm.land/bubbles) — MIT
  - Bifrost (github.com/maximhq/bifrost) — Apache-2.0
  - OPA (github.com/open-policy-agent/opa) — Apache-2.0
  - SQLite (modernc.org/sqlite) — BSD-3-Clause
  - mvdan shell parser (mvdan.cc/sh/v3) — BSD-3-Clause
  - CEL-Go (github.com/google/cel-go) — Apache-2.0 with BSD-3-Clause component
  - CEL expression protobufs (cel.dev/expr) — Apache-2.0
  - ANTLR4 Go runtime (github.com/antlr4-go/antlr/v4) — BSD-3-Clause
  - Go experimental packages (golang.org/x/exp) — BSD-3-Clause
  - NVIDIA OpenShell Go SDK (github.com/NVIDIA/OpenShell/sdk/go) — Apache-2.0
  - OpenTelemetry Go (go.opentelemetry.io/otel) — Apache-2.0
  - Lumberjack (gopkg.in/natefinch/lumberjack.v2) — MIT
  - UUID (github.com/google/uuid) — BSD-3-Clause
  - fsnotify (github.com/fsnotify/fsnotify) — BSD-3-Clause
  - gorilla/websocket (github.com/gorilla/websocket) — BSD-2-Clause
  - Tetragon API definitions (github.com/cilium/tetragon/api, vendored) — Apache-2.0
  - Unicode Character Database 13.0 DerivedAge data — Unicode-DFS-2016

The generated observability redaction repertoire includes data derived from the
Unicode Character Database 13.0 `DerivedAge.txt` file.
Copyright © 1991-2020 Unicode, Inc. All rights reserved.
Distributed under the Unicode Data Files and Software License; see
https://www.unicode.org/copyright.html.

THIRD-PARTY MQTT LIBRARIES

This product includes:

  - Eclipse Paho MQTT Go Client (github.com/eclipse/paho.golang v0.23.0)
    Copyright (c) 2023 Contributors to the Eclipse Foundation
    Licensed under the Eclipse Public License 2.0 and the Eclipse Distribution License 1.0

  - Eclipse Paho Embedded C/C++ MQTT Client (edge-connector/third_party/paho-embedded/)
    Copyright (c) 2014, 2026 IBM Corp., Ian Craggs
    Licensed under the Eclipse Public License v2.0