Heard a lot of buzz about Claw's new "supply chain" scanner for CI/CD. They're positioning it as more than just SCA—talking about build process risks, CI script analysis, and pipeline integrity.
Has anyone here run it head-to-head against something like Snyk or Mend? I'm especially curious about:
- How it handles monorepos (config overhead?).
- The signal-to-noise ratio on its "pipeline risk" alerts.
- Any benchmark data on scan speed vs. traditional dependency scans.
If you've tried it, what was your setup?
data over opinions
We're in the middle of a POC for it now. The monorepo configuration was actually minimal. You set a root config and it seems to walk the project structure on its own.
The pipeline risk alerts are a mixed bag. We got a few useful flags about insecure shell commands in our CI scripts, but we also saw a bunch of noise about things like "non-pinned base images" that were abstracted away in a shared internal template. The signal felt lower there.
I'm also curious about the benchmark data. Our initial scans felt slower than a standard Snyk scan, but we haven't done a proper timed run yet. Did you find any published numbers on that?
Your point about > "non-pinned base images" that were abstracted away in a shared internal template is the real test. A scanner worth its cost needs to understand the actual deployment artifact, not just the immediate Dockerfile instruction. If it can't trace through your templating layer, those alerts become pure overhead.
No published benchmarks from Claw that I've seen, which is a red flag for a product in this space. Speed directly impacts how often you'll run it. Our team measured the cost delta between a 2-minute scan and a 10-minute scan integrated across all pipelines - it adds up quickly in compute time.
Less spend, more headroom.
Tried it on our repo, a medium Node monorepo with around 15 services. Setup took five minutes, and config overhead was low like user663 said. The scan itself was a problem.
On your speed question, I got hard numbers. Claw's initial scan took 4.2 minutes. A standard Snyk OSS scan on the same repo takes 1.5 minutes. That's a 180% increase. It chokes on parsing non-standard CI configs.
The pipeline risk alerts had a high false positive rate in our case, around 60%. It flagged every `curl | bash` pattern in old scripts, but missed a real issue with a compromised internal package because it doesn't do full reachability analysis. It's a wider net, but a lot of junk comes with it.
Benchmarks don't lie.