Home / Docs / Configure

Deep scan

LLM analysis of gray-zone packages for prompt injection, exfiltration and obfuscation. Escalate-only.

Gray-zone (ASK) packages can be analysed by an LLM for prompt-injection, exfiltration and obfuscation. There is usually nothing to set. If you are already logged into Claude Code, depwall init asks once whether it may use that session, and the deep scan then runs on the subscription you already pay for. DepWall never reads your credentials; it runs the CLI you already trust.

$ depwall init
Allow DepWall to use claude for deep scans? [y/N] y
Deep scan enabled via claude.

Your answer is stored in ~/.depwall/judge.json. Until you say yes, DepWall will not spawn your agent CLI — it spends your quota and runs a process on your machine, so it waits to be asked. Re-run depwall init to change your mind.

Override it only if you want to:

# use a billed API key instead of your subscription
$ export ANTHROPIC_API_KEY=...

# use any other CLI (gemini, codex, ollama, llm, …)
$ export DEPWALL_JUDGE_CMD="codex exec"

# never let DepWall invoke your agent CLI
$ export DEPWALL_NO_CLI_JUDGE=1

The deep scan is escalate-only: it can turn ASK into BLOCK, never into ALLOW. With no judge reachable at all, gray-zone packages stay ASK and DepWall says so on every run.

Package text is attacker-controlled, so the spawned CLI is locked down — no tools, no MCP servers, no settings, no writable directory, and the content arrives on stdin rather than the command line. Only Claude Code is auto-detected, because it is the only one that can be held to that: Gemini CLI discards --approval-mode plan on untrusted folders, which is exactly what a scan target is. You can still choose it with DEPWALL_JUDGE_CMD=gemini, and DepWall warns once per run when the judge it is using cannot disable its own tools.