STRIDE analysis of Crawdad's local-first, on-device sidecar architecture.
Crawdad is a local sidecar process that sits between AI agents and AI APIs as a transparent proxy. Raw content is processed in memory and never transmitted by default. Metadata-only telemetry (counts, categories, verdicts) egresses by default; telemetry depth is customer-governed. Trust boundaries: the user's machine (trusted), the network (untrusted), external AI APIs (untrusted), retrieved documents and tool outputs (untrusted).
Threat: An attacker impersonates an authorized agent or spoofs the identity of the Crawdad sidecar itself.
Control: Agent identity via PID attribution. Each inbound request is attributed at connection time by resolving the caller's TCP socket to its owning PID and walking the process tree for a classifiable agent ancestor (e.g. claude, cursor, copilot). This is OS-level process identity, not cryptographic identity, it is strong for identifying which local process made a call but does not provide non-repudiation or survive across network hops. API keys are SHA-256 hashed before storage, raw keys never stored on server. Fleet device identity is bound to an Ed25519 certificate renewed every 24 hours.
Residual risk: PID attribution relies on OS process tables, which a root-level attacker or a compromised agent with user privileges can manipulate. An agent could fork a child that the process-tree walker does not classify, causing requests to appear unattributed. Crawdad trusts the host OS to report process ancestry honestly.
Threat: An attacker modifies the audit log, memory entries, or detection results after the fact.
Control: SHA-256 hash-chained audit log. Each entry's hash includes the previous entry's hash, forming a tamper-evident chain. Ed25519 signatures on each entry provide non-repudiation. Memory entries use the same hash chain.
Residual risk: An attacker with root access on the host could replace the entire audit database. The chain detects modification of existing entries but not wholesale replacement.
Threat: An agent or user denies that a security-relevant action occurred.
Control: Every firewall decision, policy evaluation, and PII detection is recorded in the tamper-evident audit log with Ed25519 signatures. The /v1/verify endpoint returns a cryptographic attestation of chain integrity. Signed compliance reports can be generated for auditors.
Residual risk: Audit log contains hashes of content, not content itself (by design). An investigator can verify that a decision was made but cannot reconstruct the original input from the hash alone.
Threat: Sensitive data (PII, credentials, internal URLs) leaks through agent responses.
Control: Layer 5 PII exfiltration detector scans every outbound response. Detects 15 PII categories and 10 credential types (AWS, GitHub, Stripe, OpenAI, Anthropic, JWT, SSH keys, database URLs). Automatic redaction before response reaches the client.
Control: On-device architecture, content stays in the local process by default. Only signed operation counts transmitted to cloud. The optional L7 cloud LLM Judge (off by default) is the one opt-in exception. Verified via /v1/verify.
Residual risk: Novel PII formats not in the detector's pattern set may pass undetected. Signature updates every 4 hours mitigate but do not eliminate this.
Threat: An attacker overwhelms the proxy, preventing legitimate agent traffic.
Control: Proxy has a 10MB request body limit. Detection pipeline runs in <1ms (no network calls). Behavior on sidecar failure is governed by enforcement_mode: in Monitor (the default) a crashed sidecar refuses the agent's proxy connection rather than forwarding uninspected traffic, and while the sidecar is alive but cannot inspect a request the default fail_mode is fail-closed (block, not forward); in Enforce the OS default-deny egress lock persists across a sidecar kill, so traffic cannot be routed to the API around a dead sidecar.
Residual risk: No per-client rate limiting in the sidecar currently. A local process sending high-volume requests could consume CPU.
Threat: Prompt injection causes the agent to execute unauthorized actions with elevated permissions.
Control: Multi-layer detection pipeline: Layer 1 (pattern matching), Layer 2 (semantic heuristics, boundary dissolution, role hijacking, authority impersonation), Layer 3 (indirect injection from documents), Layer 4 (session context, escalation tracking), Layer 5 (data exfiltration), Layer 6 (content analysis), and optional Layer 7 (LLM Judge). Policy engine restricts actions by trust level.
Control: Contextual Agency Governance governs each agent by an operator-declared charter, an allowlist over the tools, data, and effects its job needs, held outside the agent's control and enforced on the observed action at the tool-call boundary. An action outside the charter is blocked at the wire with the divergence axis named, independent of whether the injection that produced it matches any signature, so this control does not depend on the signature-update cycle. The governance plane adds autonomy ceilings, security zones, per-tool rules, and a cumulative session-risk budget, composed most-restrictive-wins; a trajectory layer scores per-session escalation-shape and holds a completed staged chain for human review.
Residual risk: Novel injection techniques not yet in the pattern set may bypass detection. The 4-hour signature update cycle means there is a window between a new technique being published and Crawdad adding detection. Charter and trajectory governance are opt-in and do not claim to catch every composed harm: a sensitive resource with an innocuous name, or a novel composition staged purely by shape with no sensitivity marker, can be missed.