Support custom security rules

[NeuZhou]

Feature Request

Allow users to define custom security rules beyond the built-in 350+ patterns.

Use Case

Organizations have domain-specific security patterns (internal APIs, proprietary tools, custom MCP servers) that the default ruleset doesn't cover.

Proposed Solution

• Support loading custom rules from rules.d/*.yml directory
• YAML-based rule definition format with regex patterns, severity, and category
• Rule inheritance: custom rules can extend/override built-in rules
• CLI flag: clawguard scan --rules ./my-rules/

Example

# rules.d/custom-api.yml
name: internal-api-leak
severity: critical
category: data-leakage
pattern: 'internal\.corp\.example\.com'
description: Internal API endpoint exposed in agent output