Stop your AI agent from leaking your credentials and data.
An agent runs with your authority: your API keys, your files, your tool access, your network. That's exactly what an attacker wants. A hidden instruction in content the agent trusts can turn all of it into an exfiltration path — read a secrets file, collect data, and send it out through a tool call. Crawdad runs on your machine, makes stolen credentials useless, catches the staged read-collect-send chain, and blocks the egress before data leaves.
Free tier, every feature. One command, one env var. Nothing leaves your machine.
An agent's job is to move data. That's also how it leaks it.
Data exfiltration through an agent doesn't look like a breach. It looks like the agent doing its job, on content that happened to carry a hostile instruction. The agent reads a file, calls a tool, makes a request — all normal actions — except one of them is sending your ~/.aws/credentials, your source, or your customer data somewhere it shouldn't go.
Three things make agents an exfiltration risk your existing stack doesn't cover:
- They hold real credentials. The keys are in the agent's environment, headers, or config. Read any of those and you have working credentials.
- They act on untrusted content. A poisoned document, webpage, or tool result can instruct the agent to read a secret and send it out.
- They can stage it. The dangerous version isn't one obvious step. It's recon, then reading progressively more sensitive data, then collecting it, then sending — each step individually unremarkable.
DLP wasn't built for an agent's tool calls. Your identity provider sees a valid session. The perimeter sees normal traffic. Nothing was watching the agent's actions from the inside.
Make the keys useless, catch the chain, block the egress.
Credentials the agent can't leak
In broker mode, the real API key lives in a hardened AES-256-GCM store the agent never touches. The agent carries a placeholder that only authenticates through Crawdad. Read the agent's environment, dump its headers, exfiltrate its config — none of it yields a key that works anywhere else. Credential theft becomes architecturally impossible. Proven across Anthropic, OpenAI, Google, xAI, and NVIDIA.
Catch the read-collect-send chain
Crawdad watches the shape of the whole session, not just single requests. Enumerate a directory, read progressively more sensitive files, stage them, then send — each step is individually allowed, but the trajectory is the attack. A running risk budget, anchored to how sensitive the data is, holds or blocks a divergent chain. If no local reasoner is reachable, a completed staging chain is held for review, never silently allowed.
Scan for secrets and PII in the flow
The detection pipeline scans for credentials and PII — API keys, private keys, tokens, connection strings, AWS credentials — in the agent's actions and output, before they reach a tool or leave the machine.
Block the egress at the OS level (opt-in)
Point an agent at the proxy and it's cooperative; a compromised agent might try another route out. Opt a device into Enforce and the operating system itself makes Crawdad the only path off the machine — a default-deny egress lock (pf on macOS, iptables on Linux), including UDP/QUIC, that persists even if the Crawdad process is killed. There's no back door for exfiltrated data to slip out.
Nothing leaves for Crawdad, either
Inspection happens on-device. The data Crawdad is protecting never leaves your machine for Crawdad to see it — only metadata leaves by default, and even that is off unless you turn it on.
What Crawdad catches, and what it doesn't claim
The shape real exfiltration takes — the sensitivity-climbing read-collect-send chain, credential access, and the egress attempt — and it makes stolen keys useless. It publishes a public, reproducible benchmark of 497 real attacks, including data-exfiltration and credential categories, so you can check the claim.
Least privilege on your tokens, secrets management, tool-side authorization, or your broader DLP and data-governance program. It's the runtime layer that governs what the agent can do with the data and credentials it can reach.
Free tier, every feature. Monitor mode by default; opt into the OS egress lock.