CrabTrap

CrabTrap is an open-source HTTP/HTTPS forward proxy designed to secure AI agents that call external services like Slack, Gmail, and GitHub. It intercepts every outbound request, evaluates it against deterministic static rules and an LLM-based policy judge, and either forwards or blocks it with a reason. Every request and decision is logged to PostgreSQL for a complete audit trail. Built by Brex, it runs as a Docker container and provides a web UI for policy management and audit review.

• HTTPS Interception — transparent MITM proxy with custom TLS server certificate generation per host, enabling full request inspection
• Two-Tier Policy Evaluation — deterministic static rules (prefix, exact, glob URL patterns with optional HTTP method filters) are checked first; the LLM judge is only invoked if no rule matches
• SSRF Protection — blocks requests to private networks (RFC 1918, loopback, link-local, CGN, IPv6 ULA/NAT64/6to4) with DNS-rebinding prevention
• Per-Agent LLM Policies — natural-language security policies evaluated via LLM judge with configurable fallback (deny or passthrough) when the judge is unavailable
• Circuit Breaker — trips after 5 consecutive LLM failures and reopens after a 10-second cooldown to maintain proxy availability
• Per-IP Rate Limiting — token bucket rate limiter with a default of 50 req/s and burst of 100
• Prompt Injection Defense — request payloads are JSON-encoded and policy content is JSON-escaped before being sent to the LLM judge
• Policy Builder — an agentic loop that analyzes observed traffic and automatically drafts security policies
• Eval System — replay historical audit log entries against a policy to measure accuracy before deploying
• Web UI — audit trail viewer, policy editor, eval results, and agent management accessible at localhost:8081
• PostgreSQL Audit Trail — every request, decision, and response is recorded for compliance and forensic review
• Docker-Based Deployment — runs via docker compose up -d alongside PostgreSQL; cross-platform binaries available for linux/darwin on amd64/arm64