Cisco's Project Quarry explained: how its agent rules work, and what the Claude Code plugin does and does not watch

On October 28, 2026, Cisco open-sourced Project Quarry, a rule language for spotting risky AI agent behavior. Coverage says it ships a plugin for Claude Code and Codex. We read the repository to see what a rule checks, what the plugin installs, and whether it guards a live agent.

This explains reporting by

Cisco, "Project Quarry" by Adam Swanda, Ravikumar Balakrishnan, Amy Chang and Konstantin Berlin (October 28, 2026). Read the original first:

https://blogs.cisco.com/ai/project-quarry-agent-security-detections

In one minute #

• Quarry is an Apache 2.0 Python engine that scans a recorded agent conversation against rules, a bit like Snort or YARA for agent traces.
• A rule can require order: read a secrets file, then call an outside host. Quarry compiles each rule to a state machine, so read-then-send matches and send-then-read does not.
• The Claude Code and Codex plugin gives your agent tools to look up syntax, compile rules and scan conversation JSON. Its hooks run only on Quarry's own tools.
• So installing the plugin does not block or watch your agent's real actions. You feed Quarry the transcripts you want checked.
• Quarry is alpha, and its README says the rule syntax may change before 1.0.

What Cisco released #

Cisco's AI Defense team describes Quarry as a neurosymbolic rule language: exact rule checks, plus optional calls to a classifier or LLM judge for questions rules cannot answer. It covers single and multi-turn chats, tool use, MCP calls and multimodal inputs, per Cisco's post.

The repository, cisco-ai-defense/project-quarry, is Apache 2.0 licensed, was created on October 27, 2026, and supports Python 3.11 to 3.13. Its README says Quarry is in alpha and the syntax may change before v1.0.0.

Amy Chang, who leads AI threat research at Cisco, told The Register the gap Quarry fills is context: one tool call can look fine until the next step sends its output to an attacker's server.

How a rule works #

This is the read-then-send example from the repo's own docs:

rule "Flow After"
condition:
    any http in get_tool_calls("http_request") where
        http.arguments.url contains "evil-corp.io"
    after
    any read in get_tool_calls("read_file") where
        read.arguments.path contains_any [".env", "credentials", "secrets"]

Quarry turns each rule into a finite-state machine and walks the conversation in order. In the repo's matching sample, the agent reads /app/.env and later calls a backup URL on that host, so the rule fires. The same calls in reverse order do not.

A match comes with a witness, the smallest set of events Quarry could find that still matches. The docs are careful about what that means: the calls happened in that order with those arguments. It is not proof that file contents were sent, or of what the agent intended.

Scans also report a completion state. A timeout or bad input gives an incomplete result, never a clean pass. The CLI exits 0 for a clean scan, 1 for a match and 2 for an invalid or incomplete one.

What the Claude Code plugin installs #

Cisco's post and The Register both mention a plugin for Claude Code and Codex. Here is what the repo's plugin files add:

What installing the Quarry plugin adds (from the repo, October 28, 2026)
MCP server   quarry-mcp, started with uv, five read-only tools:
             quarry_reference, quarry_compile, quarry_decision_tree,
             quarry_decision_flows, quarry_scan
Skills       skills/quarry-policy, skills/detection-rules
Hooks        SessionStart: adds file-marker instructions
             PreToolUse: only on Quarry's own compile and scan tools,
             swaps quarry+file:// markers for file contents
Not added    no hook on your agent's Bash, Edit, WebFetch or MCP calls

The plugin's own docs call the five tools read-only, and quarry_scan scans conversation JSON you hand it. It does not read files, sessions or stored records by itself. The PreToolUse hook matches only Quarry's own server names and resolves file paths you name, inside your workspace.

That makes the plugin a rule-writing assistant: your agent helps you write a rule, compile it and test it on sample transcripts. It is not a guard on the agent you are running. To check a live agent, you would export its transcripts, or call Quarry's Python API from your own pipeline, and act on the results yourself.

Where your data goes #

Local rules run entirely on your machine. Rules that ask a model a question send conversation text to whatever model you configure in ~/.quarry/plugin.yaml, routed through LiteLLM with that provider's credentials.

If no model is set, model-backed rules report that configuration is missing and the local rules still run. The docs also warn that host debug traces can include the rewritten file contents, so leave debug off for sensitive transcripts.

The example config loads 14 local rules. Four of them use keyword stubs in place of a model, and the repo says those are for tests, not production decisions.

Who is affected #

What to do #

• If you want to try it, start with local rules on a few exported agent transcripts and check both a matching and a clean sample.
• Write one read-then-send rule for your own secret paths and outbound hosts. That pattern is what the tool is built for.
• Treat a match as a lead to review, not as proof of a data leak.
• Do not count the plugin as a runtime guard. Keep your egress rules and permission prompts.

What is still unknown #

• Cisco's post mentions a rule starter pack. We found example rules in the repo but did not confirm which set Cisco means.
• How well the rules catch real attacks. We found no published test on real incident data, and Cisco told The Register it had not run Quarry on the OpenAI Hugging Face incident records.
• We read the repo but did not install or run Quarry. Everything here comes from its docs and config files as of October 28.
• Cisco's post links a second repository, cisco-aispg/augur-dsl, which returned Not Found from GitHub's API when we checked.

Sources #

AI News Report· every headline, every morning.