Cisco AI Defense Inspection API

# Fix list: Cisco AI Defense Inspection API

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/cisco-ai-defense-inspection, the October 2026 research run, assessed 8 October 2026. Grade C, 61.3 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Cisco AI Defense Inspection API: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Payments & pricing, 0 out of 100, up to 12.5 more on the total

Why it scored 0: No x402, MPP or L402 in the developer docs or the Offer Description (0). No price is published. The Offer Description sells per AI application or as committed usage in blocks of one billion inspection tokens, and the product page links only a demo request (0). No free tier or trial for the Inspection API was found. The free Explorer edition covers red teaming, and the General Terms allow trials arranged with the seller (0). A person buys a subscription, claims it with a code in Security Cloud Control, creates an application and a connection in the console and copies the key (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 2. Schema & documentation, 59 out of 100, up to 6.7 more on the total

Why it scored 59: The overview page links a downloadable OpenAPI document, version 1.0.0+2025.02.28. robots.txt on developer.cisco.com disallows `/*.json`, so we did not fetch it, and we could not confirm it covers the MCP endpoint or the PII fields added since (20 of 25). developer.cisco.com/llms.txt redirects to a 404 and no Markdown pages were found (0). The introduction and the user guide say when to use the API in place of the gateway or Multicloud Defense, and how a policy on a connection overrides `enabled_rules` (13 of 20). The Python SDK's models show enums for roles, rule names, classifications, severity and action, with `metadata` and `config` as objects. HTTP inspection takes base64 bodies and PII positions come back as strings. The reference pages are drawn by script and went unread (10 of 15). Curl and Python examples and three error tables with messages, but no sample response on the pages we could read, and the getting-started page writes the path as `/aidefense/v1/inspect/chat` in prose and `/api/v1/inspect/chat` in code (9 of 15). The path is versioned `/api/v1`. The API changelog has one entry, v1.0.0 on 28 February 2025, while the product release notes record PII detail added to responses on 22 April 2026 and a rule removed on 16 September 2026 (7 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 3. Agent ergonomics, 67 out of 100, up to 5.4 more on the total

Why it scored 67: A response is one object with `is_safe`, `action`, `classifications`, `severity`, `rules`, `processed_rules`, `explanation`, `event_id` and `detected_pii`, per the SDK's models. No field selection (18 of 25). There are no lists to page. The policy on the connection or `enabled_rules` in the call picks the rules, and entity lists for PII, PCI and PHI can be narrowed (12 of 20). Errors are JSON with `code`, `message` and `details`, and the docs list 400 messages for chat and HTTP inspection. A keyless request returned 401 with `missing api key` on 8 October 2026 (14 of 20). An inspection changes nothing but the event log and the token count, `client_transaction_id` traces a call, and the SDK retries. No idempotency key (14 of 20). `messages` is the only required field when the connection has a policy. Python is the only official SDK, with a LangChain middleware, a Google ADK plugin and a Go CLI beside it (9 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 4. Reliability, 80 out of 100, up to 4 more on the total

Why it scored 80: Read with the hosted lines, for the Inspection API. status.security.cisco.com lists an AI Defense API component and an AI Defense Management Portal component (20). The history feed from 10 July to 8 October 2026 has four incidents, none naming the Inspection API. Security Cloud Control was down for 72 minutes on 23 September, sign-on was degraded on 7 and 18 August, and onboarding of new AI Defense tenants in ap-northeast-1 failed for 88 minutes on 22 July (20 of 30). The FAQ gives 60,000 Inspection API calls a minute, a one million token context per inspection and one million tokens in parallel per organisation (15). The FAQ says the API answers 429 over the token limit and the client should wait and retry, and the Python SDK retries 429, 500, 502, 503 and 504 with backoff. No Retry-After header is documented (10 of 15). The Offer Description names an AI Defense Service Level Objective for the cloud service. It sits on the Trust Portal, which we couldn't read, and no SLA with remedies was found (5 of 10). The API is v1.0.0 since 28 February 2025 with no beta label (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 5. Security & auth, 81 out of 100, up to 3.3 more on the total

Why it scored 81: An API key per connection, with an expiry date or none, revocation and regeneration that deactivates the old key at once. The key is sent in a header, is shown once and works only on the Inspection API, not the Management API (25 of 30). The key can only inspect. Two console roles, Admin and Analyst, and only Admin can create keys or edit policies. No finer scopes on a key (15 of 20). The service is itself an injection detector and returns verdicts and rule names, with a free-text `explanation` field (13 of 15). Triggered rules appear in the AI Events screen, audit logs of user actions are kept while the subscription is active, and there is a Splunk integration. Whether clean inspections are logged per call was not found (12 of 15). www.cisco.com has a signed security.txt valid to 1 January 2027, a PSIRT, a vulnerability policy and CSAF advisories. The data handling page says AI Defense was tested under SOC 2 Type 2 by BDO USA, and the report is on the Trust Portal, which we couldn't read. No bug bounty found (16 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 6. Transparency & trust, 76 out of 100, up to 2.1 more on the total

Made of editorial 62, provenance 90.

Why it scored 76: Closed service under Cisco's General Terms, version 6.0 of 10 September 2025, and the AI Defense Offer Description, version 2.1 of 23 September 2026. The Python SDK is Apache-2.0 (17 of 30). The data handling page says prompts and responses are inspected in Cisco's cloud, event records are kept one year, audit logs for the life of the subscription, a tenant-wide opt-out stores the word REDACTED in place of content, and customer prompts aren't used to train Cisco models. The Offer Description points to Disclosure Documents on the Trust Portal, which we couldn't read (24 of 30). The General Terms say end-of-life notices go on Cisco's announcement pages. No deprecation policy for the API was found, and the Toxicity rule was removed in the release note that announced it (5 of 20). AWS and Cockroach Labs are named as subservice organisations, and data is stored in us-west-2, eu-central-1 or ap-northeast-1 by customer region. A full sub-processor list was not read (16 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Privacy policy: not found (0 of 10)

## 7. Maintenance & community, 80 out of 100, up to 1.8 more on the total

Why it scored 80: The newest release note is AI Defense 2026.9.4 of 23 September 2026, 15 days ago, and the user guide was last updated on 7 October 2026 (30). Twelve dated releases between 10 July and 23 September 2026 (20). Public weekly release notes, a Python SDK repository with no open issues on 8 October 2026 and commits to 1 October, and support through Cisco with Enhanced Support included. No public forum was found (11 of 15). `cisco-aidefense-sdk` 2.2.0 went to PyPI on 18 September 2026, in Python only (12 of 15). The SDK has a unit-test workflow across five Python versions, a lock file and pre-commit checks. CI results were not read (7 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## Deductions

Each comes off the total. A fixed and documented problem counts for less at the next check.

- 16 September 2026. Release 2026.9.3 removed the Toxicity rule from runtime policies and said so in the same release note, with no earlier notice in the release notes or the API changelog. `cisco-aidefense-sdk` 2.2.0, published two days later, still lists the rule. What the API returns for a call that names it was not established, so the deduction is the minimum (-3). https://securitydocs.cisco.com/docs/ai-def/user/168305.dita

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: the OpenAPI document linked from the overview page (`ai_defense_ap_is_1_0_0_2025_02_28.json`). robots.txt on developer.cisco.com disallows `/*.json`, so it was not fetched. Request and response shapes come from the Python SDK's models.
- unchecked: the API reference pages and the docs navigation on developer.cisco.com, which are drawn by script from JSON files the robots rule covers. Six pages were read by their URLs.
- unchecked: the Trust Portal (trustportal.cisco.com), which is drawn by script. The AI Defense Service Level Objective, privacy data sheet and SOC 2 report sit there and went unread.
- unchecked: the incident feed's duration for the AI Defense API component alone. The history feed names products in titles, not components.
- `provenance.privacy` is left out. The product's privacy data sheet is on the Trust Portal and we found no direct URL for it. The data handling page in the user guide is the nearest public statement.
- The Python SDK 2.2.0 maps Asia Pacific to `apj.api.inspect.aidefense.security.cisco.com` and adds a `uae` host, while the docs list `ap.api.inspect.aidefense.security.cisco.com`. From our network the `ap` host answered and the `apj` and `uae` hosts did not connect.
- What the API returns since 16 September 2026 for a call that names the removed Toxicity rule in `enabled_rules`.
- Whether a free trial of the runtime subscription exists. None is published, and the General Terms allow trials arranged with the seller.
- The Offer Description forbids publishing benchmark or competitive test results without Cisco's written permission, which matters before any probe of ours runs.
- The build's spelling check lists the word in the product's name (AI Defense) as an American spelling, so the name needs an entry in the allowed names before landing.
- The lead was right on vendor, URL, docs and interface. It did not mention the MCP inspection endpoint `/api/v1/inspect/mcp`, which the SDK calls.

## Weaknesses

- No public price, free tier or trial for the Inspection API. Subscriptions are bought through sales and activated with a claim code
- The Toxicity rule was removed on 16 September 2026 in the release note that announced it, with no earlier notice found
- The developer changelog lists only v1.0.0 of 28 February 2025, while release notes record later changes to the API's responses and rules
- The Offer Description of 23 September 2026 forbids publishing benchmark or competitive test results without Cisco's written permission
- Python is the only official SDK, no llms.txt was found, and robots.txt on developer.cisco.com disallows the OpenAPI JSON file

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Send the key in `X-Cisco-AI-Defense-API-Key` to `POST /api/v1/inspect/chat` on the regional host where the tenant was created. US, Europe and Asia Pacific hosts differ
- If the connection has a policy, `enabled_rules` in the request is ignored. Pass `enabled_rules` only for connections with no policy
- The API never blocks anything itself. Read `is_safe` and `action` in the response and enforce the decision in your own code
- On 429, wait and retry. The organisation has gone over one million tokens in parallel or 60,000 calls a minute
- Don't request the Toxicity rule. It was removed on 16 September 2026, and the Safety rules such as Hate Speech, Harassment and Profanity replace it

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.