brexhq/CrabTrap

What it solves

CrabTrap provides security guardrails for AI agents that interact with external APIs. It prevents agents from making unauthorized or dangerous outbound HTTP/HTTPS requests by intercepting traffic and evaluating it against a set of security policies before the request ever reaches the internet.

How it works

CrabTrap operates as a forward proxy that sits between the AI agent and the external world. It uses TLS termination to decrypt HTTPS traffic and then applies a two-tier evaluation process:

1. Static Rules: It first checks the request against deterministic URL patterns (prefix, exact, or glob). If a match is found, the request is immediately allowed or denied.
2. LLM Judge: If no static rule matches, the request is sent to an LLM-based judge that evaluates the request against a natural-language security policy defined for that agent.

All decisions, requests, and responses are logged to a PostgreSQL database for auditing. It also includes SSRF protection to block requests to private networks and a circuit breaker to handle LLM failures.

Who it’s for

Developers and organizations deploying AI agents that call external services (such as Slack, Gmail, or GitHub) and need a verifiable way to enforce security policies and audit outbound traffic.

Highlights

• Two-Tier Evaluation: Combines fast deterministic rules with flexible natural-language LLM policies.
• HTTPS Interception: Transparent MITM proxy with automated TLS certificate generation.
• SSRF Protection: Built-in prevention of requests to private networks and DNS-rebinding attacks.
• Policy Builder: An agentic loop that analyzes traffic patterns to automatically draft security policies.
• Audit & Eval: Full audit trails in PostgreSQL and a system to replay historical logs to test policy accuracy.