# CrabTrap

> An egress proxy that decides, per request, where your agent is allowed to go

- Category: Evaluation & Production Ops / Guardrails & Security
- Language: Go
- Licence: MIT
- Repository: https://github.com/brexhq/CrabTrap
- Website: https://www.brex.com/crabtrap
- Canonical page: https://ai-tldr.dev/tools/crabtrap/
- Updated: 2026-04-17

## In short

CrabTrap sits between an AI agent and the internet. It sits in the Guardrails & Security category of the Evaluation & Production Ops tools and is open-source, written in Go and licensed MIT. To get started: start the proxy.

## Overview

CrabTrap sits between an AI agent and the internet. Every outbound HTTP and HTTPS request the agent makes is intercepted and evaluated before it is allowed through, which turns "what can this agent reach?" from a question about prompt wording into a question about network policy you can inspect and change.

Evaluation is two-tier, and the ordering is the point. Deterministic static rules are checked first and settle the common cases in microseconds; the LLM judge is only invoked when no rule matches, so the expensive, non-deterministic path handles the tail rather than every request. Policies can therefore be written in natural language without paying for a model call on traffic that a simple rule already covers.

The rest is production plumbing: HTTPS interception with a generated CA certificate, SSRF protection that blocks requests into private network ranges, per-IP rate limiting, a circuit breaker for when the judge model is unavailable, OpenTelemetry metrics in Prometheus format, and a full request/response audit trail in PostgreSQL with a web UI for managing policies and reading it back.

## What it does

- Two-tier policy evaluation: deterministic static rules first, LLM judge only when nothing matches
- HTTPS interception via a generated CA certificate, so TLS traffic is inspectable
- SSRF protection that blocks agent requests into private network ranges
- Complete request/response audit logging to PostgreSQL, with a web UI to review it
- Per-IP rate limiting and a circuit breaker for LLM judge failures
- OpenTelemetry metrics exported in Prometheus format

## Getting started

The quickstart runs the proxy and its dependencies with Docker Compose, then sends a request through it to confirm interception works.

1. Start the proxy

   Brings up CrabTrap and its PostgreSQL audit store.

```bash
docker compose up -d
```

2. Copy out the CA certificate

   Clients need CrabTrap's CA to trust the intercepted TLS connections.

```bash
docker compose cp crabtrap:/app/certs/ca.crt ./ca.crt
```

3. Create an admin user

   The gateway binary mints a token you use for the web UI and for authenticating proxy clients.

```bash
admin_token=$(docker compose exec -it crabtrap ./gateway create-admin-user test-admin | tail -n1 | cut -d" " -f2)
```

4. Send a request through it

   Point any HTTP client at the proxy with the token as the username and the CA you exported. This is also how you wire an agent's HTTP_PROXY/HTTPS_PROXY environment to CrabTrap.

```bash
curl -x http://${token}:@localhost:8080 --cacert ca.crt https://httpbin.org/get
```

## When to use it

- Give a production agent internet access without giving it unrestricted internet access
- Answer "what did the agent actually call last Tuesday?" from an audit log instead of from model traces
- Express an allow-list in natural language for the long tail, while keeping hot paths on deterministic rules
- Block SSRF-style attempts to reach internal services from a tool the agent controls

## Version history

- 2026-04-17: Brex open-sourced CrabTrap, an HTTP/HTTPS proxy that evaluates every outbound AI-agent request against natural-language security policies with an LLM-as-judge, backed by deterministic static rules.