SCM SDK for Rust

scm-sdk is a community-maintained native Rust SDK for Strata Cloud Manager, beginning with Prisma AIRS and shared DLP/IAM capabilities. Consumers need Cargo and an application-owned async runtime; Node is absent from the packaged crate.

The implementation covers all 448 concrete methods and all 3,820 exported capabilities in frozen @cdot65/prisma-airs-sdk 0.34.0, commit 4a80dbdb3dc14365e1c25d838ac0bd139485d48c. Capabilities include 2,630 root exports and 1,190 public members; methods are part of that inventory. Native adaptations and exact public paths are recorded in the operation matrix and export ledger.

Historical phases used actual Claude Code review of at least 9/10. Current phases use five independent review categories: chunks require at least 42/50 and phases at least 46/50, with each category at least 8/10. The five-attempt exception and recorded deficiencies follow the maintainer’s review policy. Phase status records the accepted reviews and exact source evidence.

Crate version: 0.2.3, the AIRS management 0.86.0 update, retaining the G25 response-compatibility correction. It retains five experimental Portkey access-policy APIs and retains full Red Team dataplane 0.93.0 coverage: 47 operations, including 11 new calls, with a separately pinned vendor ledger. See the migration notes before adopting the stricter query contract.

The published maintenance release is 0.1.1, with published API docs and a verified publication receipt. For its G10 behavior, see response defaults and the offline example. The initial 0.1.0 receipt remains historical. Install the vendor update as scm-sdk 0.2.0. Its registry receipt records the verified archive and exact release source; its immutable tag is v0.2.0. See CI and the release procedure. The qualification summary consolidates the source-bound implementation, checks, live classifications and delivery limitations.

The 0.2.3 docs/checks/release-registry-0.2.3.json and docs/checks/release-tag-v0.2.3.json establish publication only when present and verified; missing receipts mean that publication is not yet verified. The published 0.2.2 receipt remains historical. The access-policy client requires explicit compatible control-plane key credentials and remains live-unverified. Existing 0.2.0 APIs and G10 behavior are retained.

Start here

After verifying the 0.2.3 registry receipt above, pin that release using the shorter dependency alias. Until publication is verified, retain your existing released pin:

[dependencies]
scm = { package = "scm-sdk", version = "=0.2.3" }

The alias exposes scm::airs::scan, scm::airs::management, and the other product modules. Add opt-in product names through Cargo's features field. For a Git dependency, use ssh://git@git-ssh.cdot.io/cdot/scm-sdk-rs.git and pin rev to the accepted commit you intend to consume. The compiled scan example shows typed content, profile selection, and async scan submission; the application owns its Tokio runtime and supplies credentials explicitly.

Build the checkout with Rust 1.89 or newer. Defaults enable scanning and the reqwest HTTP adapter. The foundation example is compiled and included in rustdoc. Use configuration for isolated initialization and explicit environment loading, OAuth for service credentials, and foundation for transport, proxy/custom-CA setup, destination admission, cancellation and resource limits.

Product guides cover scanning, management, DLP, IAM, Model Security, Red Team, Red Team resources, Gateway, Gateway controls, and Gateway runtime. Shared behavior is documented in models, validation, pagination, streaming, provisioning/recovery, and errors.

Features and qualification

Other product clients are opt-in through their named Cargo features. Experimental AgentGuard uses agentguard. Realtime uses realtime with a caller connector; ws-transport adds the native connector pinned to patched tokio-websockets 0.13.3. Optional tracing emits fixed metadata fields without installing a subscriber or logging payloads. The application owns credentials, runtime, transports and enforcement policy.

Implementation and offline contract coverage do not imply universal live support. See live acceptance, the archived historical 0.2.2 receipt, and the per-method operation matrix for actual successful, blocked and unverified workflows. The archived receipt does not qualify the current management changes; fresh live evidence belongs to release qualification. Platforms separates Linux musl native execution from other targets' compile-only evidence. Dependencies records advisory/license/source policy and native cryptography; packaging verifies the extracted archive and external consumers. Stability, security and release describe compatibility and remaining release steps.

Development

Follow development, the accepted design and sequential phase gates. Development-only frozen TypeScript and Zod tooling provide independent contract evidence; Cargo consumers build the packaged Rust sources. Preserve failed review/check attempts and require an actual independent five-category review meeting the current phase threshold before advancing. Phase 20 CI comprises 49 jobs: 24 feature sets on two compilers and the contract gate.

Maintained by cdot65. Project-owned code is Apache-2.0 with retained notices. This is not an official Palo Alto Networks SDK. See CHANGELOG.md.