AI agents are being handed real power now — real credentials, real systems, real consequences — and the security to match hasn't caught up. Closing that gap is the whole reason Crawdad exists — and it's not a problem any single vendor solves in isolation. It gets solved alongside the people actually running agents in the wild, hitting the edges, and shaping what comes next.
So that's how Crawdad is built — with you, not just for you. There's no distance between the people using it and the people building it. When you run into something, it reaches engineering directly, and you can see the result right here on this page: much of what shipped over the last few months started with real users running the tool and showing us where it fell short. Report something on a Tuesday, and it's not unusual for the fix to land that week.
Every release is verified end-to-end before it ships, and every claim is reproducible — including the unflattering ones, because you deserve the real numbers, not the marketing ones. That's the standard we hold ourselves to, and it's the standard the community deserves.
If something's slowing you down, breaking, or just feels wrong — or if you see where this should go next — that's the conversation we want: contact@getcrawdad.dev. We read all of it, and it genuinely shapes what we build. Thank you for building this with us.
What we've shipped
Items tagged FEEDBACK were built because users asked for it.
2026-07-31 v1.5.1 — ONNX Init Resilience
RELIABILITY
- ML crash sentinel. Intermittent SIGABRT during ONNX Runtime graph optimization on Apple Silicon no longer kills the sidecar permanently. On crash: a sentinel file survives, next startup detects it, skips ML, and the sidecar starts healthy on L1 pattern detection. Retries ML after 120 seconds. After 3 consecutive SIGABRTs in an hour, ML pauses for up to 1 hour while L1 patterns stay active.
- Crash-loop guard. ML crashes now degrade gracefully instead of killing the sidecar. The crash-loop guard checks the sentinel before exit, so the sidecar always restarts into a working state.
- Honest status reporting. The health endpoint now accurately reports "retry paused for up to 1h (L1 patterns active)" when ML is sentinel-disabled, instead of the false "retrying in 120s" that appeared previously.
2026-07-30 v1.5.0 — Multi-Platform Release
FEATURE
- Full platform coverage. Signed, notarized binaries for macOS ARM64 + x86_64, Linux x86_64 + ARM64, and Windows x86_64. SHA-256 verified against CI for every binary.
- Windows installer.
install.ps1 one-liner for Windows — previously returned 522. Cloudflare Worker updated with the new route.
- Sealed arbiter. Hardware-attested ML inference on AWS Nitro Enclaves. KMS gates model-key release on attestation. The real 271 MB DeBERTa model runs inside the enclave — attack/benign discrimination verified end-to-end over public HTTPS.
- Auto-update path. Ed25519-signed manifest cutover — existing installs auto-update on next check. Signature verified locally before push and again against the live production endpoint.
2026-07-26 v1.4.0 — Guardian UI & API Tier 1
FEATURE
- Guardian UI. The Workspace view replaced with a 4-layer state-driven guardian screen. Accordion-style item detail. Decisions move items between layers with a full audit trail and recently-decided list.
- API Tier 1. Moat scrub, OpenAPI spec, and developer documentation for the public API surface.
- Dashboard performance. r2d2 connection pool, database indexes, query consolidation, and pre-compute cache. Cold-start penalty eliminated — 9.5 seconds down to under 100 milliseconds (verified live).
- Email system. Durable subscriber list, welcome email with truthful copy, and one-click unsubscribe.
2026-07-25 v1.3.0 — Workspace
FEATURE
- Workspace VPN surface. Persistent ON/OFF VPN control with Touch ID approval and dashboard UI. Agents run inside a hypervisor-isolated workspace with no network path except through Crawdad — the architectural closure for agents that ignore the proxy.
- Guest projection. Writable filesystem projection so guest writes are visible on the host. Manifest-based file classification with
--session flag and exit hints.
- Guest assets. Built, uploaded to R2, manifest SHAs embedded, resumable fetch.
- Biometric helper. Hardware-gated approval via the biometric helper binary, packaged in
release.sh and install.sh.
2026-07-25 v1.2.0 — Air-Gap, Clarity Mode & Threat Intelligence
FEATURE SECURITY
Air-gap egress enforcement
- crawdad-egress crate. Dedicated egress chokepoint — all sidecar egress converted to the
EgressClient with 100% coverage. Build-time lint guard prevents new uncontrolled egress paths.
- Full egress coverage. Non-completions paths (storage, uploads, arbitrary POST) are now inspected — previously only completions were checked. Destination policy evaluated at headers before body read. Cumulative volume escalation closes the small-chunk loophole.
Clarity Mode
- Protected Models view. 3-state badges showing protection status per model.
crawdad run launcher for one-click protect with environment proven.
- Protect/bypass backend. GUI graceful-restart mechanism. Unified ClarityBadge. Agents-view protect/pause buttons with Overview coverage upgrade.
- Fleet-permission gating. Clarity protect/bypass/pause actions gated by fleet permissions.
Enterprise ingestion
- ICAP server. Opt-in config model with integrity-checked proxy-mode skeleton. ICAP server reuses the existing detection engine. Fleet console management UI for enterprise ingestion.
Threat intelligence
- Threat telemetry pipeline. Relay aggregator to console sync bridge. Governed telemetry-depth policy with dual-auth mechanics.
- Threat dashboard & reports. Visual security intelligence with zero-knowledge-enforced exports.
Security & auth
- Passkey + TOTP. Settings/Security page for managing passkeys and TOTP from inside the app.
- Auth perimeter. Legacy
/api/* routes closed. RBAC role tokens enabled.
- Dual-auth bypass fix. Device-target and push_policy now require second operator.
- Defense-in-depth. Splunk/OTLP red-team tests, gateway Sentry scrubber, consent-gate parity.
Release tooling
- Ed25519 manifest signing.
crawdad-sign tool with keygen, sign, verify, pubkey subcommands. Volume safety checks and key material zeroization.
- Installer hardening. 6 dangerous
|| true instances replaced with real error messages.
2026-07-07 v1.0.0 — Shipping Release
FEATURE
- Crawdad 1.0. Version unified across all 21 workspace crates. Full fleet loop verified end-to-end on the real deployed stack.
- Console-driven enrollment. Operators mint single-use enrollment tokens from the console. Sidecars redeem tokens with a CSR, receive a signed certificate and root CA, and pin the CA fingerprint on first use (TOFU). Wrong fingerprint aborts enrollment and stores nothing.
- One-command fleet bootstrap.
./init-fleet.sh stands up the full fleet stack from zero: step-ca, PKI extraction, relay TLS cert, image build, service start, admin + enrollment + operator initialization. Idempotent — safe to re-run.
- Fleet Console deployable.
docker-compose.fleet.yml deploys the complete fleet stack (step-ca + relay + console). Console command → relay → sidecar verified with chain + signature + replay + target + hard-floor checks.
- Guided first-run. The console dashboard detects a fresh deployment and shows a setup guide with the correct bootstrap commands.
- Self-protection. Auth-gated override endpoint. Filesystem rules wired into
decide_tool_call. Tamper attempts recorded in the Merkle chain at risk 100.
2026-06-01 v0.12.0 — Graduated Trust
FEEDBACK FEATURE
Early testing showed Crawdad was too aggressive out of the box — blocking tool calls for benign dev work. This release introduces a graduated approach: real attacks still block immediately, but ambiguous actions are observed instead of blocked.
- Two-tier default policy. High-confidence attacks (prompt injection, credential exfiltration, destructive commands) block by default. Ambiguous tool calls (language runtimes, network tools) are observed — passed through, recorded, and surfaced without interrupting work.
- Observe mode. A new disposition between Allow and Ask. Observed events pass through the proxy unchanged but appear in the Activity feed for review.
- Activity feed. Dashboard view showing a chronological stream of observed and blocked events with color-coded badges.
- Promote-to-block. One-click "Block this" on any observed event writes a deny rule and reloads the policy engine instantly.
- Session summaries. Per-session breakdown of observed, blocked, and "worth a look" events.
- ML sensitivity presets. Strict / Balanced / Relaxed — one setting controls the ML classifier threshold across both the proxy and scan endpoints. Default is Balanced (99.8% detection, 0.09% FP on the open benchmark).
- Node-family tool coverage.
node, nodejs, ts-node, tsx, npx, and more are now observed by default. npx moved from allowed to observed.
2026-05-19 v0.11.0 – v0.11.3 — Policy Engine
FEATURE
- KDL capability policy engine. Configurable rules for filesystem, commands, network, and credentials. Supports Allow, Ask (pending review), Deny, and Kill verbs with per-tool and per-path granularity.
- Pending Review queue. Actions that match an Ask rule are held for dashboard approval before proceeding. SSE-driven real-time updates.
- Default security baseline. Ships with an opinionated default policy: read-only commands allowed, destructive commands blocked, system-admin commands require approval.
- Policy page in the dashboard. Browse, enable/disable, and test rules. Import/export policy bundles for fleet deployment.
- ML classifier calibration. Recalibrated the ML classifier to reduce false positives on benign developer chat (security discussions, code reviews) — with no loss of attack detection on the benchmark corpus.
2026-05-18 v0.10.5 – v0.10.7 — Reliability
FEEDBACK RELIABILITY
Driven by friction surfaced during real-world testing.
- Dashboard no longer blanks on restart. A reconnection indicator appears automatically and dismisses when the sidecar is back.
- Manual trust-level choices stick. Your explicit trust-level decision for an agent is no longer overridden by a single detection event.
- Fewer false escalations. A single borderline detection no longer causes an abrupt trust-level change for an agent.
- Events survive restart. The event stream replays missed events on reconnect so nothing is lost.
- One-click restart to apply updates. Dashboard button replaces manual terminal commands.
- Auto-update observability. Every update check now produces a log line. Updater task is supervised — panics respawn within 60 seconds.
2026-05-07 v0.10.2 – v0.10.4 — Install & ML Activation
INSTALL
- ML detection activates on first boot. Fresh installs across macOS ARM64, Linux x86_64, and Linux ARM64 now reach full ML detection without manual steps. The model and runtime download in the background and activate automatically.
- Robust Linux installer. Handles
sudo installs correctly (resolves the real user's home, not root's). Graceful fallback on systemd-less distributions (Alpine, distroless). Handles minimal Docker containers.
- Reproducible public benchmark. 99.80% attack detection (496/497), 0.09% false-positive rate (1/1,172) — verified end-to-end through the full proxy pipeline. Reproduce it yourself.
- Install troubleshooting page. Docs → Install Troubleshooting covers every error path.
2026-05-06 v0.10.0 – v0.10.1 — Protection Modes
FEATURE
- Protection modes. Maximum / Standard / Reduced / Paused. Standard is the default. Reduced flags most categories instead of blocking. Paused suppresses blocking while continuing to detect and record forensically — useful when Crawdad is in the way and you need to ship. Auto-unpause after a timer.
- Protection-mode pill in the dashboard header. Always visible. One click to change. Keyboard shortcut for the modal.
- ML detection on all supported platforms. macOS ARM64, Linux x86_64, Linux ARM64. Proxy attack recall measured at 99.5% (190/191 attacks blocked).
- macOS auto-quarantine notification. Native macOS notification fires when an agent is escalated to Quarantined. Tapping opens the Identities page.
2026-04-21 v0.9.2 — Cross-Platform ML
FEATURE
- ML detection on three platforms. macOS ARM64, Linux x86_64, and Linux ARM64 all ship with auto-downloaded ML. Intel Mac remains pattern-only pending an upstream ONNX Runtime release.
- Smaller ML model. FP16 quantization reduced the model from 541 MB to 272 MB with identical accuracy.
- Deferred download. Install is binary-only (~30 MB, seconds). The ML model downloads silently in the background on first run.
- Open benchmark corpus. 497 attacks across 13 categories, 1,172 benign samples across 4 categories. CC-BY 4.0, reproducible by anyone.
- MCP server security database. 59 servers across 16 categories with trust-level classification.
2026-04-17 v0.9.1 — Remote Control Plane & Agent Trust
FEATURE
- Monitor from your phone. Pair via QR code, then view live detections, change agent trust levels, and release quarantined agents from any network. All relay traffic is end-to-end encrypted — the relay sees only opaque ciphertext.
- Per-agent trust levels. Four levels (Autonomous, Monitored, Restricted, Quarantined) with automatic escalation on detection events and configurable auto-recovery.
- Agent attribution. Every request is attributed to the specific agent process that made it, so actions against one agent never affect another.
- Dashboard agent behavior map. Per-agent activity sparklines, top tools, anomaly indicators.
- Attack pattern intelligence. Ranked category bars with trend arrows, top and new-this-period patterns.
2026-04-15 v0.9.0 — Launch
FEATURE
- Multi-layer detection pipeline. Pattern matching, ML classifier, indirect injection, session context, PII/credential detection, code scanning, optional LLM Judge.
- Transparent proxy. One env var per provider — works with Claude Code, Anthropic SDK, OpenAI SDK, and any base-URL-compatible client.
- Local dashboard. Session timeline, detection details, audit trail, cost tracking.
- Zero-knowledge architecture. Raw content stays on your machine by default. Metadata-only telemetry (counts, categories, verdicts) egresses by default — raw content never does. Telemetry depth is customer-governed.
- Signed binaries. macOS: signed + notarized by Apple. Linux: four-platform support.