BakeLens/crust

Crust – a local security gateway for AI agents

What it is – Crust is an open‑source, locally‑run proxy that sits between an AI‑powered coding assistant (or any LLM‑backed tool) and the LLM provider. It watches every tool call the agent makes (file reads, shell commands, network requests, etc.) and blocks actions that could expose secrets or otherwise compromise the host.

Why it matters – Modern AI agents run on the same machine as a developer’s code and credentials. If the model is tricked (prompt‑injection, malicious output, etc.) it can try to read .env files, SSH keys, browser cookies, or even invoke dangerous shell commands. Crust intercepts those calls before they reach the OS, keeping the user’s data on‑device and requiring no code changes in the agent.

---

How it works

Entry point	Command	What it protects
HTTP proxy	crust start	Acts as a forward proxy for any OpenAI‑compatible API. Scans the request payload (conversation history) and the response (tool calls) for secrets, dangerous commands, path traversal, etc.
MCP stdio gateway	crust wrap -- <cmd>	Wraps a Model Context Protocol (MCP) server, intercepting tools/call and resources/read messages.
MCP HTTP gateway	crust wrap -- <cmd>	Reverse‑proxy for streamable‑HTTP MCP servers.
ACP stdio proxy	crust wrap -- <cmd>	Wraps an Agent Client Protocol (ACP) agent (e.g., JetBrains AI, VS Code extensions) and blocks file‑system or terminal actions.
Auto‑detect	crust wrap -- <cmd>	Detects whether the subprocess speaks MCP or ACP and applies the appropriate filter.

All entry points share a 17‑step evaluation pipeline that runs in microseconds:

1. Self‑protection (prevent the agent from disabling Crust)
2. Input sanitisation
3. Unicode normalisation
4. Obfuscation detection
5. DLP secret scanning
6. Path normalisation
7. Symlink resolution
8. Rule matching (42 built‑in rules, 51 DLP patterns)
   9‑17. Additional checks (size limits, TLS enforcement, logging, etc.)

Every decision is logged to an encrypted local store, and the logs themselves are protected by the OS keyring.

---

Quick start (desktop)

# macOS / Linux / BSD
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/BakeLens/crust/main/install.sh)"
# Windows (PowerShell)
irm https://raw.githubusercontent.com/BakeLens/crust/main/install.ps1 | iex
# Docker (optional)
 docker compose up -d   # or build/run manually

Then launch the proxy:

crust start          # listens on 0.0.0.0:9090 by default
crust status         # verify it’s running

The gateway auto‑detects the LLM provider from the model name, so you can keep your existing API keys unchanged.

---

Hooking up an agent (example)

Set the base URL of the agent to http://localhost:9090/v1 (or just http://localhost:9090 for some clients). The README lists dozens of supported tools – Claude Code, OpenAI Codex CLI, Cursor, JetBrains AI, Continue, Aider, etc. For any OpenAI‑compatible client the same environment variable works:

export OPENAI_BASE_URL=http://localhost:9090/v1   # or ANTHROPIC_BASE_URL, etc.

Crust will forward the request, apply its rule engine, and only allow safe tool calls to reach the provider.

---

Mobile / iOS integration

Crust ships a Swift package CrustKit that can be embedded in iOS 15+ apps. Three integration styles are provided:

1. Local reverse proxy – run a tiny HTTP proxy on the device and point the AI SDK to it.
2. URLProtocol – register CrustURLProtocol so any URLSession automatically passes through the engine (zero‑config).
3. Direct evaluation – call engine.evaluateAsync(...) for manual checks. The same rule set (including 7 mobile‑specific locked rules) protects contacts, photos, keychain, clipboard reads, dangerous URL schemes, Bluetooth/NFC, biometric APIs, and in‑app purchases.

---

Built‑in protection rules

• 42 security rules (39 locked, 3 user‑disableable) covering credentials, system auth files, shell history, browser data, package registry tokens, Git credentials, persistence mechanisms, mobile PII, keychain, clipboard, URL schemes, hardware access, crypto wallets, and more.
• 51 DLP patterns that recognise real API keys, tokens, PEM private keys, BIP‑39 mnemonics, etc.
• Rules are defined in plain YAML (security.yaml) and Go code for the DLP patterns, making them easy to audit or extend.
• The project claims validation against 84 real‑world CVEs affecting popular AI assistants (Cursor, GitHub Copilot, Claude Code, OpenAI Codex, etc.).

---

Custom rules & plugins

• Custom rules – add a YAML file with crust add-rule my-rules.yaml. Hot‑reload is supported, so changes take effect immediately.
• Plugins – optional late‑stage filters that run in isolated processes. They communicate via newline‑delimited JSON, can be written in any language, and are subject to a circuit‑breaker that disables a misbehaving plugin after three failures.
• Example plugin (Python) shows how to enforce a project‑directory sandbox before allowing file access.

---

Security posture of Crust itself

• Listens only on localhost; no external network exposure.
• Agents cannot disable or reconfigure the gateway (hard‑coded pre‑filter).
• Secrets and logs are stored in the OS keyring and encrypted SQLite DB.
• All traffic to LLM providers uses TLS 1.2+.
• CI runs gosec, semgrep, fuzz testing (46 targets), govulncheck, and gitleaks on every commit.

---

Getting involved

• Build from source with Go 1.26+ (go build .).
• Contribute new security rules or plugins via pull requests.
• Report bugs or security issues through the GitHub issue tracker or the private disclosure process described in SECURITY.md.

---

License

Crust is released under the Elastic License 2.0, a source‑available license that permits use, modification, and distribution but restricts providing the software as a competing service.

---

Bottom line – Crust gives developers a drop‑in, locally‑run shield that stops AI agents from accidentally (or maliciously) leaking secrets, executing destructive commands, or accessing privileged resources, all without having to modify the agent’s code.