# CrabTrap — LLM-as-Judge HTTP Proxy to Secure AI Agents in Production

> CrabTrap sits between your AI agent and the internet, vetting every outbound request against natural-language security policies before they leave.

- Org: Brex
- Date: 2026-04-17
- Category: repo, tool
- Source: https://www.brex.com/journal/building-crabtrap-open-source
- Canonical page: https://ai-tldr.dev/releases/brex-crabtrap/

## In short

Brex open-sources CrabTrap, a Go+TypeScript HTTP/HTTPS proxy that intercepts all outbound AI agent requests and evaluates them against natural-language security policies using an LLM-as-judge. Static rules execute in microseconds; the LLM judge activates on <3% of requests. 110 HN points, 204 GitHub stars.

## What it is

CrabTrap is an open-source HTTP/HTTPS proxy from Brex Engineering that intercepts all outbound requests made by AI agents. Every request passes through a two-tier policy engine: first a fast static rules layer (URL patterns, HTTP methods, path prefixes), then an LLM-as-judge layer that evaluates the full request context against natural-language policies. The proxy adds SSRF protection for private network access, a PostgreSQL audit log, a web UI for managing policies and reviewing decision history, and an automatic policy builder that learns from observed traffic patterns.

## How it works

Agents route all HTTP(S) traffic through CrabTrap by setting proxy environment variables. Static rules execute in microseconds via cached regex patterns — the first check, covering the common case. When no static rule matches, the LLM judge receives the full request body, headers (capped at 4KB to avoid context flooding), and the relevant policy as structured JSON — encoding as JSON prevents prompt injection through adversarial request content. In Brex's deployment the LLM judge activated on fewer than 3% of requests, making added latency negligible. All decisions are logged to PostgreSQL with a flag indicating whether the static rules or the LLM judge made the call.

## Why it matters

AI agents calling external APIs are an expanding attack surface: SSRF, data exfiltration, and adversarially-crafted tool calls are real production risks. Hard-coded allowlists are brittle; CrabTrap's natural-language policies can express intent ('never send customer data outside company domains') without exhaustively enumerating every legitimate URL. The design pairs probabilistic LLM judgment with deterministic rules as a first-line defense and full audit logging for post-hoc review.

## Who it's for

Teams running AI agents in production who need enforceable security guardrails on external API calls.

## Try it

git clone https://github.com/brexhq/CrabTrap  # Docker Compose quickstart in <2 min

## Links

- [Announcement](https://www.brex.com/journal/building-crabtrap-open-source)
- [Repo](https://github.com/brexhq/CrabTrap)
- [Quickstart](https://www.brex.com/crabtrap)