SCM SDK for Rust
scm-sdk is a community-maintained native Rust SDK for Strata Cloud Manager,
beginning with Prisma AIRS and shared DLP/IAM capabilities. Consumers need Cargo
and an application-owned async runtime; Node is absent from the packaged crate.
The implementation covers all 448 concrete methods and all 3,820 exported
capabilities in frozen @cdot65/prisma-airs-sdk 0.34.0, commit
4a80dbdb3dc14365e1c25d838ac0bd139485d48c. Capabilities include 2,630 root exports
and 1,190 public members; methods are part of that inventory. Native adaptations
and exact public paths are recorded in the operation matrix
and export ledger.
The baseline implementation phases and maintenance releases require actual Claude Code review of at least 9/10. Phase status records the accepted reviews and exact source evidence.
Crate version: 0.2.0. This release adds full Red Team dataplane 0.93.0 coverage: 47 operations, including 11 new calls, with a separately pinned vendor ledger. See the migration notes before adopting the stricter query contract.
The published maintenance release is 0.1.1,
with published API docs and a verified
publication receipt. For its G10 behavior,
see response defaults and the
offline example. The
initial 0.1.0 receipt remains historical.
Install the vendor update as scm-sdk 0.2.0.
Its registry receipt records the verified
archive and exact release source; its immutable tag is v0.2.0.
See CI and the release procedure.
The qualification summary consolidates the
source-bound implementation, checks, live classifications and delivery limitations.
Start here
Add the published crate, optionally using the shorter dependency alias:
[]
= { = "scm-sdk", = "=0.2.0" }
The alias exposes scm::airs::scan, scm::airs::management, and the other product
modules. Add opt-in product names through Cargo's features field. For a Git
dependency, use ssh://git@git-ssh.cdot.io/cdot/scm-sdk-rs.git and pin rev to
the accepted commit you intend to consume. The compiled scan example
shows typed content, profile selection, and async scan submission; the application
owns its Tokio runtime and supplies credentials explicitly.
Build the checkout with Rust 1.89 or newer. Defaults enable scanning and the reqwest HTTP adapter. The foundation example is compiled and included in rustdoc. Use configuration for isolated initialization and explicit environment loading, OAuth for service credentials, and foundation for transport, proxy/custom-CA setup, destination admission, cancellation and resource limits.
Product guides cover scanning, management, DLP, IAM, Model Security, Red Team, Red Team resources, Gateway, Gateway controls, and Gateway runtime. Shared behavior is documented in models, validation, pagination, streaming, provisioning/recovery, and errors.
Features and qualification
Other product clients are opt-in through their named Cargo features. Experimental
AgentGuard uses agentguard. Realtime
uses realtime with a caller connector; ws-transport adds the native connector
pinned to patched tokio-websockets 0.13.3. Optional tracing
emits fixed metadata fields without installing a subscriber or logging payloads.
The application owns credentials, runtime, transports and enforcement policy.
Implementation and offline contract coverage do not imply universal live support. See live acceptance, its current receipt pointer, and the per-method operation matrix for actual successful, blocked and unverified workflows. Platforms separates Linux musl native execution from other targets' compile-only evidence. Dependencies records advisory/license/source policy and native cryptography; packaging verifies the extracted archive and external consumers. Stability, security and release describe compatibility and remaining release steps.
Development
Follow development, the accepted design and sequential phase gates. Development-only frozen TypeScript and Zod tooling provide independent contract evidence; Cargo consumers build the packaged Rust sources. Preserve failed review/check attempts and require an actual Claude Code score of at least 9 before advancing a phase.
Maintained by cdot65. Project-owned code is Apache-2.0 with retained notices.
This is not an official Palo Alto Networks SDK. See CHANGELOG.md.