Control what your AI agent can do with its tools.
The moment you give an agent tools, its mistakes stop being words and start being actions: a command run, a file changed, an API called, data moved. That capability is the point of an agent, and it's also where the risk concentrates. Crawdad runs on your machine and governs each agent's tool use by its jobwhich tools it may call, and what it may do with them, judging the tool call before it happens, recording it, and freezing an agent that goes out of scope. Blocking single calls comes with Enforce.
See it on your own agents in a demo. Nothing leaves your machine. Already a customer? Sign in.
An agent decides which tool to call from content it can't vet.
An agent chooses its next tool call based on what it read, the task you gave it, plus whatever content it pulled in along the way. When that content carries a hidden instruction, it steers the tool call. The agent invokes a tool it shouldn't, against data it shouldn't touch, and the result goes somewhere it shouldn't.
And most agents are overscoped. They hold broad tool access because it's easier to set up, so a single misdirected step reaches far more than the task required. The combination, untrusted content driving tool choice, plus more tool access than the job needs, is what turns an agent's tools into an attack surface.
Bound the tools by identity. Judge the call. Freeze what goes out of scope.
A per-agent tool boundary
Each agent gets a governance plane authored in one policy file, applied most-restrictive-wins at the agent-to-tool boundary: an autonomy ceiling (read-only / limited / standard / privileged), security zones (the set of tools an identity may touch), per-tool rules (a verb ladder: kill / deny / ask / observe / allow), and a session-risk budget. An agent stays powerful within its job and bounded outside it. Each primitive is proven by an over-the-wire block test against the real proxy.
Judged on the action, not the claimed intent
Crawdad evaluates the tool call the agent actually makes, on the device, before it runs. A deceptive stated intent buys nothing. An out-of-scope call is recorded and named by axis (capability, target, or effect), and the agent is frozen; blocking the call itself comes with Enforce.
The whole session's shape
A single tool call can look fine; a sequence can be an attack. Crawdad tracks the trajectory and records a divergent one, so staged tool-based attacks are visible by their shape; holding or blocking them comes with Enforce.
Tool-risk visibility
Crawdad assesses MCP server risk, flags typosquats against known packages, and classifies per-tool risk, so you can see what an agent is connected to and how dangerous each tool is before something goes wrong.
What Crawdad governs, and what it doesn't replace
What the agent tries to do with its tools: restrict and contain which tools it may call and what it may do with them, catch staged tool-based attacks, keep content on-device, and produce a verifiable record.
The tool's own authorization, what a server or API will itself permit, or identity, server hardening, and secrets management. Govern the agent's behavior with Crawdad; enforce the tool's own permissions server-side. A sound setup does both. The public benchmark, which includes tool-abuse categories, lets you check what Crawdad catches.
Write a policy from the dashboard and it governs at the wire on the next tool call, no restart.