Light enough to forget it's running.

Supported platforms

Detection and Observe run on macOS, Linux and Windows. The Enforce OS network lock is opt-in and applies only on macOS, when agents run as a separate user. Crawdad 1.8.2 has no OS network lock on Linux. On Linux, and when agents run as you, Enforce works through Crawdad's own checks (the proxy, hooks and the secrets floor), and no network lock applies. On native Windows, Crawdad runs detection, monitoring, and the mandatory credential broker; the OS-level network lock is macOS only. The Windows build shows an unsigned-app warning on install until our code-signing certificate is in place, and running the Linux build under WSL2 remains fully supported.

Footprint

Crawdad is a small native binary written in Rust. Detection runs in-memory, in the request path, and stays there.

• Memory, depends on the detection mode: in pattern-only mode (an operator setting for low-spec endpoints, pattern + PII + dictionary layers, ML classifier off) the resident footprint is small, around 60–70 MB on macOS, and it does not grow with your model or context window. In the default ML-active mode (once the DeBERTa classifier loads on macOS/Linux) the process holds the model in memory: roughly 1.8 GB for a single session, up to ~2.7–2.9 GB under the production session pool (measured on an Apple-silicon, 16 GB reference machine). Size for the ML-active figure unless you deliberately run pattern-only.
• CPU: negligible in normal use. The pattern layers are compiled regexes running in memory; there is no busy loop and nothing polling.
• Disk I/O: none of consequence in the request path. Events are written to a local SQLite log out of band; inspection itself touches no disk.
• No GPU, no server: everything runs locally in the sidecar process. There is nothing to provision and nothing to scale.

Latency

Crawdad inspects each request as it passes through, so it adds a small amount of time. In practice it disappears into the model's own latency.

• Pattern layers (secrets, the 15 PII categories, the client dictionary) run in-memory: sub-millisecond for a typical prompt, and a few milliseconds on very large inputs. In pattern-only mode that is the entire per-request cost.
• The ML classifier (the default, ML-active mode) runs on every input and adds platform-dependent inference time, with a one-time warm-up on the first call after the model loads; it is higher on platforms going through the portable CPU runtime.
• An LLM's own response takes roughly 500 ms–5 s per call, so even the ML-active overhead is small relative to the round-trip.

Disk & first run

Install is fast because only the binary downloads at install time. Full detection warms up in the background on first run.

• The binary itself is small and installs to /usr/local/bin (or a Windows service).
• On first run the sidecar downloads the ML model (~568 MB, v0.9.4 FP32 DeBERTa-small) and the platform ML runtime once per machine, in the background, while pattern detection is already protecting you. Keep roughly the model size plus a ~200 MB margin free.
• The optional on-device L7 judge uses a local model via Ollama if you enable it, recommended, not required.

What you need

The whole checklist:

• A supported platformmacOS, Linux, or Windows.
• An agent or tool that talks to a supported provider: Anthropic, OpenAI, Google, xAI, or NVIDIA. Any framework works, you point it at Crawdad with one environment variable, no SDK and no code changes.
• A few localhost ports free (the proxy, verify, and dashboard ports in the 7748–7750 range). Nothing inbound, nothing exposed.
• A few minutes to install and connect, with the guides in the customer portal.

Customers find the step-by-step install for every platform in the customer portal. See also the FAQ.