Ship the agent. Don't ship the attack path with it.
The moment your agent has tools, credentials, and untrusted context, it's an attack path — a poisoned document or tool result can steer it into leaking secrets or running the wrong command. Crawdad protects it at runtime with one environment variable and no code changes, catches the attacks, and stays out of the way of normal work.
Monitor mode by default: watches, blocks clear attacks, changes nothing else. If it goes down, your agent keeps working.
Build and ship agents without creating a new attack path.
You want to move fast and not become the reason your company's credentials leaked through an agent. Crawdad is the guardrail that doesn't slow you down: it runs in Monitor mode by default, and if it ever goes down, your agent keeps working.
One env var, no SDK, no code changes
Point your agent's base URL at Crawdad; its traffic flows through with no change to how you build.
Doesn't get in your way
Normal developer work — reading your files, running your commands — flows through. When something is caught, you get a plain-language reason and a one-click way to allow it if it's fine. A held action is a pause, not a dead end.
Catches the real attacks
Prompt injection, indirect injection in tool results and retrieved content, credential and data exfiltration, staged multi-step attacks.
Credentials the agent can't leak
The real key lives in a store the agent never touches. Works across Anthropic, OpenAI, Google, xAI, and NVIDIA.
What Crawdad is, and what it doesn't replace
Crawdad is runtime protection for the agent's actions. It doesn't replace least privilege, secrets management, or tool-side authorization — it's the layer that governs what your agent does when hostile content inevitably reaches it. And the 497-attack benchmark is public, so you can check what it catches.
Free tier, every feature. One command, one env var, no code changes.