Crawdad sits between your agent and its model as a transparent local proxy. Multi-layer detection pipeline inspects every request. Raw content never leaves your machine by default. Works with any provider, any framework.
Install, point your agent's base URL at the local proxy, activate your license. Crawdad intercepts every API call transparently — your agent doesn't know it's there.
ANTHROPIC_BASE_URL or equivalentNot a single classifier. Not a regex list. A multi-layer prompt injection protection pipeline where each layer catches what the others miss. Built in Rust. 2,988 tests across 26 crates.
127 patterns across 22 attack categories. Catches known injection formats, encoding tricks, and role-override attempts before anything else runs.
127 patterns · 22 categories7 sub-checks analyze structural signals — conversation topology, authority escalation, instruction-data boundary violations. Catches attacks that look benign to static patterns.
7 sub-checksDetects instructions hidden inside documents, tool outputs, and retrieved content. The threat that enters through what your agent reads, not what the user types.
Maintains a 20-message sliding window to catch multi-turn attacks that unfold gradually — slow escalation, context poisoning, progressive boundary shifting.
20-message windowScans for 10 credential and PII types — API keys, tokens, SSNs, credit cards — before they reach the model. Blocks exfiltration at the proxy layer.
10 credential types44M-parameter transformer fine-tuned on adversarial prompt data. Runs locally on-device. Catches novel attacks that evade pattern and behavioral layers.
DeBERTa-v2-small · 44M paramsThe Arbiter combines signals from every layer into a single verdict. Unanimous agreement — not majority vote — determines final disposition.
Full reference in Redoc →
Detections, sessions, policies, audit logs, fleet management — every capability exposed through a documented REST API with OpenAPI 3.0 spec and interactive Redoc reference.
Crawdad is a transparent proxy — an LLM firewall that sits between your agent and the model. If your tool talks to an LLM API, Crawdad can inspect it. No SDK, no code changes.
497 attack samples, 1,172 benign negatives, 22 categories. The entire corpus is open under CC BY 4.0. The product is licensed under BSL 1.1.
Crawdad runs as a transparent proxy on your machine. Raw content — prompts, responses, tool outputs — never leaves your device by default. Metadata-only telemetry by default, customer-governed.
One environment variable routes your agent's traffic through the local proxy. Your agent doesn't need to know Crawdad exists. Detection runs entirely on-device.
Start with the install. Read the docs. Run the benchmark yourself.