The essentials first: how to secure AI agents, what credential mediation is, how to govern an agent by purpose, and where the benchmark lives. Product and account questions follow.
Route the agent's model and tool traffic through a security proxy that inspects every request in the path where the agent acts. Crawdad installs with one environment variable on macOS or Linux, no SDK and no code change, and runs on your own machine. It detects prompt injection, data exfiltration, and credential exposure locally; governs each agent by a declared purpose, so an out-of-scope action is blocked even when the stated intent looks benign; and mediates credentials so the agent never holds the real secret. On a public 497-attack benchmark the detection engine catches 99.80% of attacks at a 0.09% false-positive rate. Protection is scoped to agents whose traffic is routed through Crawdad, not every process on the machine.
Credential mediation means the agent proves it may make a request but never possesses the API key. Crawdad holds provider credentials in a broker at the local proxy. The agent sends its request with a placeholder; after the request passes policy, Crawdad injects the real credential into the outbound call at the transport layer, so the secret rides the wire but is never returned into the agent's context. A prompt-injected or compromised agent has no key to exfiltrate. The broker covers the major providers, Anthropic, OpenAI, and Google (including the URL-key and OAuth forms), and is proven bypass-impossible end-to-end in tests.
Two layers, both enforced on-device. A per-agent charter declares an allowlist of the tools the agent may call, the data (paths, hosts, recipients) it may touch, and the effects it may produce; an out-of-charter tool call is blocked at the wire and the block names the axis that fired. Independently, trust levels can block classes of tools, for example denying shell execution or reads from ~/.ssh, ~/.aws, and /etc. Every request is attributed to the agent's own process, so restricting one agent never affects another on the same provider.
Crawdad judges the action, not the stated intent. A charter and the arbiter evaluate the actual tool call the model returned, its capability, its target, and its effect, so a deceptive explanation buys nothing. The identical request can be allowed for one agent and blocked for another, because the charter decides, not the wording. This is why Crawdad keeps detection (is this content an attack?) and governance (does this action fit the agent's job?) as separate mechanisms.
Yes. Crawdad publishes Contemporary Agent Attacks, a public, versioned corpus of 497 real agent attacks (395 open plus 102 held-out) across 22 categories, paired with 1,172 benign samples, licensed CC BY 4.0. The full detection engine catches 496 of 497 (99.80%) at one false positive (0.09%); without the ML layer the pattern-only floor is 37.8%. The corpus names its own errors: the one missed attack is a bare social-engineering pretext in the human_agent_trust holdout, and the one false positive is a Stack Overflow question about Go method-receiver syntax with GitHub links. Clone it and run it against any tool at github.com/AndrewSispoidis/contemporary-agent-attacks. It is an evaluation corpus, not training data, and no independent third party has re-run it against a running sidecar yet.
The security runs on your machine and raw content never leaves it by default. Crawdad inspects prompts, responses, tool-call arguments, and PII entirely on-device; only metadata telemetry (event counts, detection categories, verdicts) egresses by default, enforced by a sanitization chokepoint in the sidecar rather than by policy. Elevated telemetry is off by default and gated by dual consent, an organization policy plus an on-device end-user consent record. Fleet telemetry is sealed with X25519+AES-256-GCM and routed by a relay that never decrypts it. There is no third party in the content data path.
Direct injection is when a user types instructions designed to override the agent's behavior, like "ignore previous instructions." Modern LLMs handle most direct injection well. Indirect injection is when malicious instructions are embedded in content the agent processes, a web page, a document, a tool result, and the agent treats them as instructions. Indirect injection is the dominant enterprise threat in 2026. Anthropic dropped the direct prompt injection metric from their system cards in February 2026 specifically because indirect attacks are more relevant to production deployments. Crawdad's L3 layer specifically scans for indirect injection attempts in tool results, web content, and documents.
Three things. First, Crawdad normalizes content aggressively before pattern matching, stripping zero-width characters, unicode confusables, decoding base64/hex/ROT13/URL encoding, and stripping markdown wrappers. Second, detection patterns run against ALL contexts (tool results, agent responses, code), not just user messages. Third, the LLM-as-Critic validates that agent responses match the user's original intent, catching hijacks that bypassed pattern matching entirely.
No. Crawdad works out of the box with detection layers L1–L6 plus structural defenses. For the optional L7 LLM-critic (judgment for ambiguous cases), install Ollama and a local model: brew install ollama && ollama pull llama3.1:8b. Recommended but not required. 99.80% detection, 0.09% false-positive rate (1/1,172) on the open 497-attack, 1,172-negative benchmark. Stack: pattern layers + fine-tuned DeBERTa-small ML classifier + indirect-injection + code + PII/credential detector.
Because only the binary downloads at install time. Pattern detection is active the moment the sidecar starts, so your agents are protected immediately. The ML model (~568 MB) and the platform libonnxruntime shared library download in the background on first run, the dashboard shows a single line of status while it's happening, and full detection activates automatically on the next sidecar restart. The download runs exactly once per machine.
The full pattern layer plus the indirect-injection, output-guard, code, and PII/credential detectors are all live from the first request. ML adds the remaining attack coverage that brings the stack to 99.80% detection. Note: detection means at least one layer identifies the attack, and blocking is a separate arbiter decision; the credential and data-exfiltration floors always block inline, and the arbiter promotes a single high-confidence detection to an inline block, so proxy-path blocking reaches 99.80% at the same 0.09% false-positive rate. While the model downloads, pattern detection is blocking prompt-injection, credential exfiltration, and tool abuse attempts exactly as it will after ML activates; ML is an upgrade, not a gate.
The sidecar retries three times with backoff, resuming via HTTP Range requests where the server supports it. If the SHA-256 doesn't match, the partial file is deleted and the download restarts. If all three attempts fail the dashboard shows "Detection enhancement paused, will retry automatically" and the sidecar keeps running in pattern-only mode. The retry happens on the next sidecar restart. Insufficient disk space (model size + 200 MB margin) produces "Additional detection capabilities require more disk space" instead. At no point does any failure interrupt pattern detection or your agent's traffic.
Raw content, prompts, responses, action parameters, and PII, never leaves your machine by default. Metadata-only telemetry (event counts, detection categories, verdicts, agent counts) egresses by default; raw content never does. This is enforced by a sanitization chokepoint in the sidecar architecture, not policy. Telemetry depth is customer-governed: elevated telemetry (full_telemetry mode) is gated by a dual-consent requirement, both an org-level policy and an on-device end-user consent record, and is off by default. The one additional opt-in exception: the L7 cloud LLM Judge (off by default) sends content to a third-party model if you explicitly enable a cloud backend. The sidecar binary intercepts API calls, scans content, records sessions to local SQLite, and serves the dashboard, all on localhost.
Metadata telemetry (event counts, detection categories, verdicts) egresses by default, raw content (prompt text, response text, tool-call arguments, PII values) never leaves your machine. All scanning, detection, and recording happens inside the sidecar binary on localhost. For regulated environments, there is no third-party data processing for content because there is no third party in the content data path.
Yes. The Crawdad Secure Agent package runs entirely on your own infrastructure. Your data never touches our servers. Download the installer at getcrawdad.dev.
Crawdad is an in-line proxy, not a fail-open shim, there is no "degraded" passthrough header and a request is never silently forwarded uninspected. The sidecar runs locally as a system service and restarts automatically, so downtime is rare. What happens while it is down depends on the enforcement mode. In Monitor (the default) Crawdad makes no OS-level network changes; if the sidecar is unreachable the agent's connection to the local proxy port is simply refused, so its request fails rather than escaping uninspected. While the sidecar is alive but cannot inspect a request (for example an unparseable body), the default fail_mode is fail-closed: the request is blocked with a 422 and an attributable error, not forwarded (set fail_mode to fail_open for the legacy forward-anyway behavior). In Enforce the OS default-deny egress lock persists across a sidecar kill, so a down sidecar cannot be bypassed, all non-proxy egress stays denied until the sidecar restarts or an authorized crawdad enforce break-glass release runs. See the Enforce mode guide.
They are the two settings of enforcement_mode (a separate axis from the Maximum/Standard/Reduced/Paused protection modes). Monitor is the default: it inspects and scores traffic but installs no operating-system lock, so a stock device is byte-for-byte unchanged and the agent reaches the proxy only because it is pointed there by its base-URL env var (a door it may decline to use). Whether detections block is a separate axis (DetectionEnforcement), which a fresh install leaves at Observe (records, does not block); arm it with crawdad arm. Enforce installs a persistent OS default-deny egress lock (pf on macOS, iptables on Linux) so a governed agent reaches only the proxy path and everything else, including UDP/QUIC, is denied by construction; it also makes the credential broker mandatory and enforces per-tool policy at the tool-call boundary. Windows applies the mandatory broker but has no OS egress lock today, so a Windows device under Enforce reads amber (“Broker-only”) in the posture view, by design. You set the mode from the dashboard’s Enforcement view (its strengthen and ceremony-gated reduce controls), or directly with the admin mode API or protection_mode.json, and a fleet can pin it. Enforce is proven on Linux (live kernel) and macOS (pf floor). See the Enforce mode guide.
Under Enforce, the egress lock is a persistent default-deny OS firewall rule (pf on macOS, iptables on Linux) scoped to the governed agent: it allows only the local Crawdad proxy ports and denies every other outbound connection, including UDP/QUIC, so there is no path off the machine except through Crawdad. It persists across a sidecar kill, so the boundary cannot be removed by killing Crawdad; on Linux this has been verified against a live kernel (kill -9 persistence, clean removal). Removing it is a deliberate, authenticated crawdad enforce break-glass operation, never something the agent can do.
Maximum is an opt-in tier under Enforce (distinct from the "Maximum" protection mode, which is just the most aggressive blocking setting). The agent runs inside a sealed VM, macOS/arm64 today, on Apple's Virtualization.framework, whose only network path routes through Crawdad, so containment is by construction: an attempted escape is refused at the packet level rather than by firewall deny rules. It is liveness-gated: if the VM capability (launcher, host stack, guest assets) is not installed, Enforce falls back to the Standard egress-lock floor and reports Standard in force, the configured tier is never silently dropped. Where the VM is backed, containment has been exercised on real Apple-silicon hardware.
Break-glass is the operator escape hatch for a persisted egress lock, and it is deliberately hard to reach: every command requires root and the device administrator token, the agent can never invoke it, and every use is written to the tamper-evident audit chain. crawdad enforce recover is the preferred path, it restarts the sidecar into a time-boxed bounded-Monitor posture (detection and audit stay ON, the egress lock comes OFF) that auto-reverts to Enforce at expiry (default 60 minutes, policy-configurable, hard maximum 240). crawdad enforce release is a last-resort direct offline release for a dead sidecar and is refused while the sidecar is alive (use the mode API or recover instead). crawdad enforce reenforce ends a recovery window early and crawdad enforce status shows the current state. See the Enforce mode guide.
Pattern-only layers (L1, L3–L6) run sub-millisecond in memory, compiled regexes, no network calls, no disk I/O. The ML layer (L2) runs on every input, running it selectively would drop detection sharply, so inference is not gated per-input; latency is instead managed by caching and quantization. Pattern-only traffic stays at sub-10ms p99, and ML adds its inference time when it runs, which varies by platform: low on macOS ARM64 with native ONNX prebuilts, higher on platforms running through the Rust ORT path (Python inference subprocess fix is tracked for a future release). LLM response generation takes 500ms–5s regardless, so pipeline overhead is small relative to round-trip.
Crawdad is deliberately light: it runs on the machine your agent already runs on, with no separate server and no GPU. Expect a small resident footprint (around 60–70 MB on macOS), sub-millisecond in-memory pattern checks, and negligible CPU in normal use; it does not grow with your model. Full runtime detection and enforcement run on macOS and Linux; native Windows runs detection and monitoring today, with WSL2 recommended for full ML detection. On first run the ML model (~272 MB) downloads once in the background. The added latency is small relative to the model's own round-trip and isn't noticeable in normal agent workflows. See the full system requirements.
Cancel anytime from your dashboard. No cancellation fees. Your data is available for export for 30 days after cancellation. After 30 days it is permanently deleted.
Crawdad is licensed under BSL 1.1. The sidecar's detection logic and proxy are verifiable by inspecting network traffic, you can verify what telemetry egresses using curl http://localhost:7749/v1/verify. Five architectural invariants are property-tested over 1,000,000 iterations on every release by the crawdad-zk-verify crate. A standalone getcrawdad/zk-verify MIT reproducer is on the roadmap so any operator can confirm the invariants independently. No third-party security audit has been completed. Results will be published publicly when available.
Crawdad is built in Rust for memory safety. 3,737 tests across 26 crates. Licensed under BSL 1.1. Contact us at contact@getcrawdad.dev.
Crawdad runs entirely locally with no external network dependencies for core functionality. Threat feed updates can be disabled for air-gapped environments. Contact us at contact@getcrawdad.dev for details.
Any framework that uses the Anthropic, OpenAI, or Google APIs. Set ANTHROPIC_BASE_URL=http://localhost:7748 (or the equivalent for OpenAI/Google) and your agent's traffic is protected automatically. Tested with: Claude Code, OpenClaw, Aider, LangChain, CrewAI, AutoGen. Also available as a Python SDK for explicit API calls.
Crawdad has two management surfaces. Local posture sharing (built into every sidecar): set one sidecar as a posture hub, others as reporters. Devices share posture metadata over LAN, no infrastructure needed. Fleet Console (separately deployed): a self-hosted control plane with scope hierarchy, policy inheritance, signed fleet commands, sealed telemetry, RBAC, and central audit. Deploy with docker-compose -f docker-compose.fleet.yml up. See the fleet page for details.
Both local posture sharing and fleet telemetry send only posture metadata: security scores, detection counts, layer status, agent counts, and policy hash. Raw content, session content, prompts, responses, and file data, never leaves any device by default. Fleet telemetry is additionally sealed with X25519+AES-256-GCM, the relay routes it without decryption.
Detection asks whether content is an attack; governance asks whether an agent's action fits its job. Contextual Agency Governance lets an operator declare a charter for an agent, an allowlist over the tools it may call, the data (paths, hosts, recipients) it may touch, and the effects it may produce (read, write, external-send, execute, delete). The charter is held outside the agent's control and enforced on the observed action, the tool call the model actually returned, so a deceptive stated intent buys nothing. An out-of-charter action is blocked at the wire and the block names the axis that fired (capability, target, or effect); the same request from two agents can get two verdicts, because the charter decides, not the bytes. It is opt-in per agent and composes with the rest of the governance plane on the same on-device chokepoint. Contextual and trajectory governance exist in other tools; Crawdad's combination is on-device enforcement plus a full control surface plus fleet rollup in one platform.
Some attacks stage themselves: enumerate a directory, read progressively more sensitive in-scope files, then send. Each step is individually allowed, so the shape of the whole session is the attack. A trajectory layer keeps a bounded per-session window of action features and scores escalation-shape with deterministic signals anchored to resource sensitivity, feeding the cumulative session-risk budget. Only the genuinely ambiguous cases gate an on-device reasoner (the local model backend); nothing leaves the device on the local path. With no local model reachable, a completed staging chain is held for human review, never silently allowed. The false-positive cost on ordinary multi-step work is measured at zero. Honest boundary: it does not claim to catch every composed harm, a genuinely sensitive resource with an innocuous name, or a novel shape with no sensitivity marker, can still slip the deterministic layer; it catches staged compromise that carries a sensitivity climb, which is the shape real exfiltration takes.
The self-hosted Fleet Console is MSP-native. One tenant model carries the MSP root, its client organizations, and their device groups, with role-based access that inherits down the tree. You provision a tenant and each client from one call, roll out to a client's whole fleet with one minted enrollment key and a ready-to-run install package that carries the console URL and CA fingerprint pin (devices self-enroll with real signed certificates, no per-device manual signing), and see every client in a consolidated cross-org rollup: per-client device counts, open governance holds, governance and threat activity, and cost, plus fleet totals. Billing meters the governed device count and reports it to Stripe as real metered usage records at $4.99 per governed device per month; a preview shows the current count and amount with no Stripe call, and reporting usage is admin-gated. Charter templates authored per client or fleet-wide are distributed to devices over the signed command channel, and held actions surface in a cross-client review queue.
Two options: (1) Transparent proxy, set your agent's base URL to the Crawdad proxy port (no code changes). (2) SDK scan endpoint, POST content to /api/v1/sdk/scan and receive detection results (sub-millisecond on pattern-only layers; ML layer adds platform-dependent inference time). A Python client is included. Available on Pro tier and above. Contact contact@getcrawdad.dev for OEM licensing.
Crawdad never stops protecting. Cancellation moves you to the Free tier, which includes the full multi-layer detection pipeline (1 agent, 50K requests/month fair-use). All your data remains on your machine and is fully accessible. You can export everything at any time. Re-subscribe whenever you want to lift the agent/request caps.
Settings → Your Data → Export All Data. Downloads a complete backup of sessions, audit events, and configuration. Your data is stored locally and always accessible regardless of subscription status.
Yes. Core detection works fully offline. Disable threat feed updates in Settings. Fleet management works on internal networks with no internet dependency.
Executive (2-3 pages): summary stats, OWASP coverage, key findings, recommendations. Full (5-10 pages): adds complete detection detail, AI inventory, policy configuration, threat intelligence. Technical (20+ pages): adds full session forensics, tool risk analysis, attack sequences, and data flow for every detection.
Every agent Crawdad detects runs at one of four levels. Autonomous (green) runs L1–L6 detection with the default arbiter matrix (most lenient), no restrictions. L7 LLM-critic is a separate opt-in regardless of trust level. Monitored (yellow) runs the full L1–L7 pipeline with no restrictions, the default for newly discovered agents. Restricted (orange) runs the full pipeline plus active per-tool-call restrictions (block Bash/shell, deny reads from /etc, ~/.ssh, ~/.aws, ~/.config; all editable per-agent). Quarantined (red) returns HTTP 403 to every request from that agent before detection runs. Enforcement is per-agent, each inbound request is attributed to the specific agent process that made it (by resolving the caller's TCP socket to its owning PID and walking the process tree), so blocking one agent never affects another on the same provider.
The system ratchets the offending agent's trust level down one step automatically. Autonomous → Monitored on any detection scored ≥ 50. Monitored → Restricted on score ≥ 70, or on two detections within five minutes. Restricted → Quarantined on score ≥ 90, or on three detections within ten minutes. Exfiltration-class patterns (credentials, PII, recon) quarantine immediately from any level. Every transition is audited with its trigger string, previous level, and whether it was manual or automatic, visible on the agent detail view in the dashboard. After a quiet period with no detections, a background loop walks auto-escalated agents back toward Autonomous one level at a time (Monitored → Autonomous after one hour by default; longer recovery windows for Restricted and Quarantined and default off, requiring human review). Manual level changes are never auto-reverted.
Yes. Click the protection mode pill in the dashboard header (or the Settings page Protection Mode panel), then choose Paused with a duration of 5 minutes, 15 minutes, 1 hour, or until you manually unpause. While paused, Crawdad continues to detect attacks and record them forensically, it just stops blocking. Auto-unpause is enforced server-side, so a paused sidecar will return to its previous mode at the end of the duration even if you forget. You can also unpause immediately with the "Unpause Now" button in the modal.
The endpoint that changes mode lives only on the management API and is not reachable from the proxy data path. A compromised LLM response or an injection payload arriving through traffic cannot trigger a pause. Quarantined agents remain quarantined regardless of mode. Allow-Always rules continue to apply. Detection still runs at every mode.
Yes, per-agent. Each agent_identities row carries an auto_recovery_enabled flag and an auto_recovery_after_seconds dwell time. Both are editable via the agent detail view. Disabling auto-recovery leaves an auto-escalated agent at its current level until a human changes it manually. Automatic escalation down (the ratchet toward more restriction) always runs, Crawdad never ignores detection signal. What you can disable is the recovery path that walks agents back up.
Yes. Open Settings → Connect Device on the dashboard, scan the QR code from your phone, and you're paired. From the phone you can watch live detections, flip an agent's trust level (Autonomous / Monitored / Restricted / Quarantined), release a quarantined agent, and receive alerts, from anywhere. First pairing needs you on the same WiFi as the desktop so the handshake stays local; after that the encrypted relay path works over any network.
Yes, by design. Every remote command from the phone is Ed25519-signed by the paired device's key and replay-protected on the sidecar. Relay traffic is AES-256-GCM encrypted, the relay forwards opaque blobs it cannot decrypt. Per-device rate limits cap sensitive actions (5 trust changes per 10 minutes, 1 quarantine release per hour). Sensitive actions can be PIN-gated. Permissions can be scoped per device (view-only or full control). A local kill switch on the desktop disconnects any paired device instantly. Every accepted remote command is written to the tamper-evident audit trail with its device ID.
Encrypted blobs and opaque per-device IDs. Nothing else. State snapshots and alerts are encrypted on the sidecar with a key the relay doesn't hold; commands are signed by a key the relay doesn't hold. The relay cannot read prompts, responses, tool-call arguments, PII values, detection content, trust levels, or agent names. It cannot correlate devices to tenants or identify fleet membership, the only identifier that crosses the boundary is a random 128-bit per-device token.
No. The mobile UI is a web app that works in any modern phone browser. Add it to your home screen for an app-like launch experience. A native app with push notifications is on the roadmap but not required for any v1 capability.
Home: a one-line health bar (uptime, requests inspected today, blocked today), a 0–100 security score with three sub-scores (trust posture, detection health, alert hygiene) and a trend arrow, three-up activity stats (Today / Week / Month), and the agent list with colored trust dots. Alerts: filter by severity / agent / category; per-alert Acknowledge, Quarantine, and Investigate (Investigate shows metadata only, time, agent, category, pattern, severity, verdict, never content). Agent detail: 24-hour activity sparkline, tool usage chips, trust-level selector. Settings: notification preferences (threshold, per-agent mute, quiet hours), tool-name anonymization toggle, disconnect device.
A floating action button on the home screen opens two emergency-grade commands. Run Test Battery fires the 24-payload adversarial spectrum through your local detection pipeline and surfaces results in your alert feed, useful to sanity-check detection from a hotel room. Pause All Agents quarantines every routable agent in one tap, with a confirmation dialog, for incidents where you want traffic stopped before you finish debugging. Both are signature-gated like any other remote command.
By default the remote state snapshot carries real tool names (Read, Bash, WebSearch) so the phone can show tool-usage counts meaningfully. If your agents use custom-named tools that could reveal the nature of your work (query_patient_database, stripe_refund), enable Anonymize tool names in Settings (desktop or mobile). Names are mapped to six generic buckets (file_read, file_write, shell, web, api_call, other) only at the snapshot boundary. The local agent_activity table and desktop dashboard always show the real names. Startup default is off; set CRAWDAD_ANONYMIZE_TOOLS=1 to enable at boot.
Nothing. The app has two transports in parallel, the direct HTTP path (used when your phone shares WiFi with the desktop) and the encrypted relay WebSocket (used everywhere else). If one goes down, the other takes over. Local state and the last-known alert feed are cached in the phone's IndexedDB, so the app renders immediately on every launch and fills in live data as the transports come back. Specifically: after a desktop reboot that changes the LAN IP, the phone races a 3-second direct probe and falls back to the relay automatically, never a blank screen. When both transports are offline the app shows a red banner ("Machine appears to be offline, showing last known state") above the cached content instead of going blank.
Yes. Tap the floating action button on the home screen and choose Run Test Battery. The phone sends an Ed25519-signed run_test_battery command; the sidecar kicks off the local test battery in a background task (same pipeline the desktop Run Test Battery button uses) and the resulting detections flow into your alert feed on both phone and dashboard within the next snapshot cycle.
Two new widgets replace the old static OWASP checklist: Agent Behavior Map (polls every 10s; per-agent trust dot, 5-minute activity sparkline, top tools in the last 5 minutes, last action + relative timestamp, anomaly indicator when volume exceeds baseline + 2σ or a detection fires) and Attack Pattern Intelligence (polls every 60s; 24h / 7d / 30d range selector, total blocked, ranked category bars with trend arrows vs. previous equal-length period, top patterns, new-this-period patterns highlighted, red-team-gaps link). Chart axis labels render in the viewer's local timezone; the sidecar still stores everything in UTC.
Fill out the form below and we'll get back to you.