Agent security for every client you manage.

1.8.2: Enforce is available. Isolate is coming in a later release: its sealed workspace isn't ready yet.

Crawdad protects enterprises directly and through the MSPs that run their IT. For your practice, it is a managed service you add to what you already run: provision, roll out, govern by charter, freeze an agent that goes out of bounds, and bill per device, every client from one self-hosted console (Enforce adds OS-level containment on macOS when agents run as a separate user). Your clients are running AI agents right now, with real credentials and file access, and nothing in their stack watches what those agents do. That exposure is your problem, and your opening.

Become a Partner → Download the Partner Brief

Security-first firm running a SOC? See Crawdad for MSSPs → for the monitoring-versus-active-containment story.

Crawdad Fleet Console, manage AI agent security across your client base

Fleet Console, centralized management across your client base

The MSP opportunity

AI agents run with real power inside your clients' environments. Nothing in their stack sees them.

The agent layer is a new attack surface. The MSP who brings the answer first wins the relationship.

The gap

A surface nobody covers

AI agents act with real authority, your client's credentials, files, network. When an agent reads a poisoned document, it follows hidden instructions silently. EDR, DLP, firewalls, and identity tools don't see agent-layer behavior. This is a net-new attack surface.

Why now

Your clients are already deploying

AI agents are moving from pilot to production across every industry. Regulated clients are asking who secures them. The security buyer is looking for answers, the MSP who arrives first with a real one defines the category.

Why you

You own the security relationship

Your clients already trust you with their endpoints, their networks, their identity. Agent security is a natural extension, and a new recurring service line layered on top of the relationship you've already built.

MSP-native

Built for the way you actually deliver. Provision, roll out, govern, bill.

Crawdad is built for the way MSPs deliver, serving many clients, including regulated ones, on an architecture where raw content stays on the client's machine by default. The multi-tenant model, the rollout, the governance rollup, and the billing are part of the product, not services you assemble.

Provision

A client in one call

Create a client organization with its own scope, default group, and reusable enrollment key. Each client is an isolated subtree with role-based access, so an operator sees only the clients they are granted.

Roll out

A fleet with one key

One minted enrollment key returns a ready-to-run package: the enroll command, the unattended installer invocations, and the CA fingerprint pin. Devices self-enroll with no per-device signing. Push it through the RMM or MDM you already run.

Govern

By charter, per client

A charter declares what a client's agents are for: which tools, which data, which effects. Crawdad judges the action an agent takes, not the intent it claims, so the identical request is in bounds for one agent and out of bounds for another; at Observe that is recorded and an out-of-bounds agent is frozen. Author a template once, share it across clients, and it governs at the wire on their devices; at Enforce, held actions surface in a cross-client review queue you resolve from the console.

Bill

Your price, per governed device

You set your own client price. Partner pricing is shared in a demo. Usage is metered through Stripe usage records, counted from the real device inventory. Preview the current period any time; the count is a gauge, so it tracks devices as they come and go.

Roll up

Every client, one view

A consolidated rollup puts per-client device counts, open governance holds, threats this week, and metered cost in one response, plus fleet totals, scoped to what each operator can see.

Trajectory reasoning watches the shape of a whole session and flags a staged compromise, the exfiltration whose every single step looked fine; holding it for review comes with Enforce. No runtime check catches every composed harm; this catches the staging shape. Full runtime enforcement on macOS and Linux comes with Enforce, which is opt-in; the OS network lock is macOS only, and Crawdad 1.8.2 has no OS network lock on Linux. The whole model runs on your own self-hosted console, with each client's content staying on their machines.

Fleet Console, per-client tenancy, centralized policy management

Crawdad Dashboard, real-time detection trends, agent activity

Managed AI agent protection

Fleet-scale agent security. Every client. One console.

Deploy Crawdad across your client base with one command per endpoint. The self-hosted Fleet Console gives you per-client tenancy, centralized policy, detection trends, and governance rolled up per client and across every client, while raw content stays on each client's machine.

Per-client tenancy and isolation, enforced by the scope model
Governance rolled up per client and across clients: charter decisions, held actions, threats
Charter templates authored once and distributed to a client's devices
One-command deployment per endpoint, raw client content never leaves their machines by default
Each client gets their own dashboard

Local proxy deployment model

One deployment. Every request inspected.

Your client's machine, raw content stays local

🤖

Client's Agent

any framework

→

Crawdad

inspects every request

→

🧠

AI Model

any provider

✓ prompt injection ✓ credential leaks ✓ data exfiltration ✓ indirect injection

Crawdad sits between every agent and its model on the client's machine. One environment variable routes traffic. Raw content never reaches the cloud, or you.

The enforcement boundary

That env var is cooperative. On macOS, when agents run as a separate user, Enforce makes Crawdad the sole way out.

Pointing an agent at the proxy is a door the agent can decline, and a compromised one may try another route. Observe is the default and a stock device is byte-for-byte unchanged. In Enforce, on macOS when agents run as a separate user, the operating system itself leaves no path off the machine except through Crawdad (where the lock is validated). Crawdad 1.8.2 has no OS network lock on Linux. On Linux, and when agents run as the person, Enforce works through Crawdad's own checks (the proxy, hooks and the secrets floor), and no network lock applies.

Enforce · the OS egress lock

Rolled out and pinned per client

On macOS, when agents run as a separate user, Enforce installs a persistent OS default-deny egress lock (pf on macOS). A governed agent reaches only the Crawdad proxy path; everything else, including UDP/QUIC, is denied by construction. You set it from the console and pin it across a client's fleet.

›The lock persists across a kill of the Crawdad process; the boundary doesn't vanish if the enforcer dies.
›Crawdad 1.8.2 has no OS network lock on Linux. On macOS the pf anchor loads and validates its signed rules, not yet proven at the packet level on hardware.

Isolate · sealed-workspace containment

Containment by construction

The Isolate tier, coming in a later release, runs the agent inside a sealed workspace (a VM on Apple silicon) whose only network interface routes through Crawdad. Escape is refused at the packet level, not by a deny rule.

›On real Apple-silicon hardware, an adversarial escape battery was fully blocked and the host filesystem was byte-identical after a guest destruction battery.
›Liveness-gated, fail-closed: with the VM capability absent it falls back to the Enforce network-lock floor and reports the configured vs in-force level honestly.

Break-glass · fail-closed

Recovery is deliberate

Where the lock is in place, it survives a kill, so the recovery path is deliberate and deliberately hard to reach, with an audit trail your client can rely on. When agents run as the person, a program that person runs can still change or stop Crawdad.

›Break-glass requires root and a device-administrator token, is written to the tamper-evident audit chain, and auto-reverts to Enforce at expiry. An agent without root and that token cannot invoke it.
›Fail-closed by default: if Crawdad is alive but can't inspect a request, it blocks rather than forwards. There is no degraded fail-open path.

Platform, stated plainly. Every device runs Observe by default, so a stock device is byte-for-byte unchanged; Enforce is opt-in, and its network lock applies only on macOS, when agents run as a separate user. Crawdad 1.8.2 has no OS network lock on Linux. Read the Enforce mode guide →

Trust

533 real attacks on a public, reproducible benchmark

The detection engine is measured on this public corpus. Detection and blocking are separate: at Observe (the default) Crawdad records detections and blocks secrets (credentials and clear attempts to send data out) in chats that go through it, in agent tool calls, and on supported AI sites, and broader blocking comes with Enforce, which is opt-in. The corpus is open so you can run it yourself. Detection and blocking, explained →

533attacks tested

1,187benign samples

15attack categories

102held out

Every result is published, including the misses. We’re not aware of another vendor in the category that ships a reproducible, clone-and-run benchmark at all. Clone the corpus, run it against us or anyone, and compare. Every number here is reproducible.

Multi-layer detection pipeline. Built in Rust. Over 5,100 automated tests across the workspace. Raw content stays on the client's machine by default, metadata-only telemetry by default (none at all when run fully offline).

AndrewSispoidis/contemporary-agent-attacks →

CC BY 4.0 · 533 attacks · 1,187 benign negatives · 15 categories

MSP partner economics

Channel-friendly. Built for recurring revenue.

Crawdad fits the MSP delivery model. Deploy it, manage it, bill for it.

Revenue

A new recurring service line

Crawdad is a managed service, not a one-time sale. Layer it into your existing security practice alongside EDR, DLP, and identity. One more line of recurring revenue on top of the relationships you already have.

Fit

Additive, not competitive

Crawdad doesn't replace anything in your current stack. It covers the agent layer that EDR, DLP, identity, and firewalls don't see. Additive to your existing offering, no displacement, no rip-and-replace conversations.

Timing

An early, differentiated service line

The AI agent security category is nascent. The MSPs who bring a real answer to their clients now can lead on how this layer gets covered, and offer a service line few competitors have.