CrabTrap

// Overview

CrabTrap sits between an AI agent and the internet. Every outbound HTTP and HTTPS request the agent makes is intercepted and evaluated before it is allowed through, which turns "what can this agent reach?" from a question about prompt wording into a question about network policy you can inspect and change.

Evaluation is two-tier, and the ordering is the point. Deterministic static rules are checked first and settle the common cases in microseconds; the LLM judge is only invoked when no rule matches, so the expensive, non-deterministic path handles the tail rather than every request. Policies can therefore be written in natural language without paying for a model call on traffic that a simple rule already covers.

The rest is production plumbing: HTTPS interception with a generated CA certificate, SSRF protection that blocks requests into private network ranges, per-IP rate limiting, a circuit breaker for when the judge model is unavailable, OpenTelemetry metrics in Prometheus format, and a full request/response audit trail in PostgreSQL with a web UI for managing policies and reading it back.

// What it does

• Two-tier policy evaluation: deterministic static rules first, LLM judge only when nothing matches
• HTTPS interception via a generated CA certificate, so TLS traffic is inspectable
• SSRF protection that blocks agent requests into private network ranges
• Complete request/response audit logging to PostgreSQL, with a web UI to review it
• Per-IP rate limiting and a circuit breaker for LLM judge failures
• OpenTelemetry metrics exported in Prometheus format

// Getting started

The quickstart runs the proxy and its dependencies with Docker Compose, then sends a request through it to confirm interception works.

docker compose up -d

docker compose cp crabtrap:/app/certs/ca.crt ./ca.crt

admin_token=$(docker compose exec -it crabtrap ./gateway create-admin-user test-admin | tail -n1 | cut -d" " -f2)

curl -x http://${token}:@localhost:8080 --cacert ca.crt https://httpbin.org/get

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Give a production agent internet access without giving it unrestricted internet access
• Answer "what did the agent actually call last Tuesday?" from an audit log instead of from model traces
• Express an allow-list in natural language for the long tail, while keeping hot paths on deterministic rules
• Block SSRF-style attempts to reach internal services from a tool the agent controls

// How CrabTrap compares

CrabTrap alongside other open-source guardrails & security tools AI/TLDR tracks, ranked by GitHub stars.