Anthropic announced Claude Mythos Preview on April 7, 2026. Read how Crawdad defends the AI agent layer →
Live  ·  local-first  ·  zero-knowledge

The next security threat isn't breaking in. It's already inside, running with your credentials.

Your company's AI tools — ChatGPT, Claude, Copilot, Cursor — have full access to your files, your data, and your credentials. Every time they run, they send that information over the internet with nothing checking what goes out. Crawdad watches everything your AI tools do and stops anything that shouldn't be happening. It runs on your machine. Your data stays yours.

Under the hood: a local proxy sits between every agent and its LLM, inspects every request through a 7-layer detection pipeline, and blocks prompt injection, credential exfiltration, and PII leakage before it reaches the model — or propagates to the next agent. Only signed, content-free metering packets transmit upstream. Raw prompts, responses, and action parameters stay on your machine by default, enforced by architecture, not policy. Works with Claude Code, Cursor, the Anthropic and OpenAI SDKs, and any client that respects a base URL.

Crawdad dashboard showing Protection Active, 631 requests inspected, and items needing review
Your dashboard the moment Crawdad starts inspecting traffic.
See how it works ↓
99.8%detection — 497-attack open benchmark
1 FPacross 1,172 benign samples — 0.09% false-positive rate
7detection layers before the LLM sees it
0bytes of content leave your machine

Every number above is reproducible. Clone AndrewSispoidis/contemporary-agent-attacks, run python3 benchmark/run.py --adapter adapters.crawdad, compare.

Not technical? No problem. Forward this page to your IT team or the person who manages your computers — they'll have it running in under a minute.

terminal
# Install Crawdad (one command, seconds — enhanced detection downloads in the background)
$ curl -fsSL https://getcrawdad.dev/install.sh -o /tmp/crawdad-install.sh && sh /tmp/crawdad-install.sh

# Point your agent at the proxy
$ export ANTHROPIC_BASE_URL=http://localhost:7748

# Open the dashboard
$ open http://localhost:7750
Who is this for

Three doors into the same protection.

For your company

If your team uses AI tools for any part of their work — writing, coding, analysis, customer support — Crawdad protects every machine those tools run on. One install per machine. Your IT team or any technical person can set it up in seconds.

For IT and security teams

Deploy Crawdad across your organization with the Fleet Console — a self-hosted control plane with scope hierarchy (org/team/device), policy inheritance, signed fleet commands, sealed telemetry, RBAC, and a central audit trail. One command: docker-compose -f docker-compose.fleet.yml up. Your data stays on your machines by default.

For consultants and service providers

If you help companies adopt AI, offer Crawdad as part of your security package. Your clients get protection. You differentiate your practice. Contact us about partnership.

A new kind of threat

The call is coming from inside the house.

Traditional security watches the perimeter. Firewalls, antivirus, VPNs, EDR — every tool in the stack was built around one assumption: an external attacker is trying to get in, and everything inside is trusted. That assumption was wrong often enough already. With autonomous AI agents, it's structurally broken.

Your agents are already inside. You invited them. You gave them your credentials, your file access, your API keys, your shell. They operate with your authority, and the rest of your stack treats their traffic the way it treats yours — because to a firewall, it is yours.

That is what makes contemporary agent attacks different. A single compromised instruction buried in a retrieved document gets processed by one agent, passed to a second, validated by a third. By the time it reaches a tool call, a shell command, or an outbound API request, it has been laundered through your own trusted systems. No one agent looks compromised. The chain does.

This is an autoimmune problem. The system attacking itself through its own trusted channels. Perimeter security cannot see it. EDR cannot see it. The agent is the perimeter now.

Crawdad watches every agent independently, inspects every request before it reaches the LLM, tracks cascading behavior across sessions, and blocks threats at the source before they propagate to the next agent. It sits inside the trust boundary, because that's where the threat is.

A real scenario

Your marketing team uses an AI assistant to draft client proposals. The assistant pulls in a reference document from a shared drive. Someone — or something — has slipped an invisible instruction into that document. The assistant follows it, quietly attaching your client list and pricing to an outbound request. Nobody asked it to. Nobody noticed. The call came from inside the house. Crawdad catches that instruction before the assistant ever acts on it.

This is indirect prompt injection — an invisible instruction embedded in a retrieved document, email, web page, or tool output. It's one of 13 attack classes Crawdad's L3 layer catches, tested on the public benchmark at 100% detection.

How it works

Four steps, one afternoon.

1
Install Crawdad on any Mac or Linux machine
One command, takes seconds. Works on MacBooks, developer workstations, and servers.
2
Your AI tools are monitored automatically
No configuration needed for most setups. Point your agent at localhost:7748 (Anthropic), 7747 (OpenAI), etc., and every request flows through the detection pipeline.
3
Crawdad blocks attacks and alerts you if something suspicious happens
Prompt injection, credential exfiltration, indirect injection in retrieved documents, tool abuse — all blocked before the request reaches the model. Alerts surface in the dashboard and on your phone.
4
Monitor from your phone, manage across your fleet
Pair your phone by QR code for quick local monitoring. For org-wide management, deploy the Fleet Console — a self-hosted control plane with scope hierarchy, policy inheritance, signed commands, and a central audit trail.

The sections below get into the technical detail — 7-layer pipeline, architectural invariants, benchmark reproduction. If that's not your audience, skip ahead to pricing.

Architecture

Zero-knowledge by architecture

Crawdad runs entirely on your machine. The sidecar intercepts API calls at the provider-specific port, runs them through the 7-layer detection pipeline, and proxies allowed requests upstream. Only signed metering packets (event counts, Ed25519-signed, sequence-numbered) transmit upstream. By default, raw prompts, responses, action parameters, and PII never leave your machine — enforced by architecture, not policy. The one opt-in exception is the L7 cloud LLM Judge (off by default), which sends content to a third-party model if you explicitly enable a cloud backend.

The metering packet contains counts only: how many requests were inspected, how many were blocked, which layers fired. No prompt text. No response text. No tool-call arguments. No PII. An independent verifier (crawdad-zk-verify) exists as a feature-gated crate that can confirm data-locality invariants against a running sidecar; it has not yet been published as a standalone tool.

Transparent HTTP proxy

Anthropic on 7748, OpenAI on 7747, Google on 7746, xAI on 7745, NVIDIA NIM on 7744. Point your agent's base URL at the right port. No SDK required. No code changes. Works with Claude Code, Cursor, the Anthropic/OpenAI/Google SDKs, and any framework that respects a base URL.

7-layer detection pipeline

L1 pattern matching, L2 ML semantic classifier (custom-trained DeBERTa-small ONNX, FP16, ~272 MB, auto-downloaded on macOS ARM64, Linux x86_64, and Linux ARM64), L3 indirect injection scanning, L4 session context & provenance, L5 output guard, L6 PII & credential detector, L7 optional local-model LLM-critic. Every decision happens in-proxy before the upstream LLM sees the traffic.

Signed metering, content-free

Upstream billing is driven by Ed25519-signed, sequence-numbered event counts. No prompt text. No response text. No tool-call arguments. No PII. Five architectural invariants are property-tested over 1,000,000 iterations on every release.

For regulated environments, this architecture simplifies compliance: there is no third-party data processing because there is no third party in the data path.
Full architecture spec →

What's Built

How Crawdad watches from the inside

Crawdad inspects every request every agent makes, catches attacks before they propagate to the next agent, and surfaces threats that traditional security can't see — because the traffic looks like yours. These are the capabilities that are built, tested, and running in 1.0.0. No roadmap items. No aspirational features. What you see here is what you get when you install.

New in 1.0: Fleet Console — a self-hosted control plane with scope hierarchy, policy inheritance, signed commands, sealed telemetry, RBAC, and a central audit trail. See the fleet story →

7-layer detection pipeline

L1 compiled regexes for known attack shapes. L2 custom-trained DeBERTa-small ONNX classifier (FP16, ~272 MB, auto-downloaded in the background on macOS ARM64, Linux x86_64, and Linux ARM64). L3 indirect injection scanning across retrieved documents, tool output, and file uploads. L4 session context and provenance tracking. L5 output guard on the response path. L6 PII and credential detection across 15 categories. L7 optional local-model LLM-critic for ambiguous cases.

Honest, reproducible detection numbers

99.8% detection and 0.09% false-positive rate (1/1,172) on the open 497-attack, 1,172-negative corpus at AndrewSispoidis/contemporary-agent-attacks. 12 of 13 attack categories hit 100% (the remaining other bucket at 98.57%). Zero false positives on hand-curated, conversational, and security-discussion negatives; one false positive in the developer-messages category. Every number is reproducible — python3 benchmark/run.py --adapter adapters.crawdad, compare your tool. Stack: pattern layers + DeBERTa-small ML classifier + indirect-injection + code + PII/credential detector. CRAWDAD_ML_BLOCK=0 turns ML blocking off for pattern-only mode.

Zero-knowledge architecture

By default, raw prompts, responses, action parameters, and PII stay on your machine. Only signed metering packets (event counts, Ed25519-signed, sequence-numbered) transmit upstream. Enforced by architecture, not policy. The optional L7 cloud LLM Judge (off by default) is the one opt-in exception. Five architectural invariants are property-tested over 1,000,000 iterations every release.

Per-agent trust levels

Every agent runs at one of four levels — Autonomous (green), Monitored (yellow), Restricted (orange), Quarantined (red). Each request is attributed to a specific agent at connection time, so blocking one agent never affects another on the same provider. Detections automatically lower trust; quiet periods recover it. Every transition is audited. The Fleet Console extends trust levels across your fleet with per-device policy inheritance and centralized control.

Continuous red team

A live adversarial engine runs static attacks plus mutation variants (unicode, base64, code-block wrapping, authority prefix, encoding layering) against the detection pipeline every 60 seconds. Gaps surface in the dashboard in real time. The Run Test Battery button fires 24 curated adversarial payloads on demand — blocks, allows, and per-layer decisions populate live.

Agent, MCP, and model inventory

Crawdad inventories the agents, models, and MCP servers active on the host. Which agents are routable through the proxy. Which MCP servers are running and what tools they expose. Unknown servers are flagged. Human-readable KDL capability policy decides what's allowed per tool call, per agent, per workspace.

Dashboard and forensics

Embedded React dashboard on localhost:7750. Overview renders detection timeseries, top patterns, red team trend, and activity heatmap — now with Agent Behavior Map (per-agent 5-minute activity sparkline, top tools, anomaly indicator) and Attack Pattern Intelligence (category bars with trend arrows vs. previous period, top and new patterns, red-team gap count) replacing the old static OWASP checklist. Axis labels render in the viewer's local timezone; the sidecar stores UTC. Per-session timeline, agent identity tracking, MCP inventory, fleet management, audit trail with CEF/JSON SIEM export. Run Test Battery button for on-demand adversarial verification.

Crawdad audit trail showing detections with layer, pattern matched, and full request context
Every detection is recorded with the layer that caught it, the pattern matched, and the full request context.
Crawdad red team view showing detection engine results against attack corpora
Crawdad runs its detection engine against attack corpora continuously and shows you exactly what is caught and what is missed.
Crawdad inventory showing every model, MCP server, and agent with policy controls
Crawdad inventories every model, MCP server, and agent on your machine. You see what is running and decide what is allowed.
Fleet Console

Org-wide control. Same zero-knowledge architecture.

The Fleet Console is a self-hosted control plane for managing Crawdad installations across your organization. Scope hierarchy, policy inheritance, signed commands, sealed telemetry, RBAC, central audit. Deploy with one command: docker-compose -f docker-compose.fleet.yml up. Full fleet story →

Scope hierarchy + policy inheritance

Organize devices into org → team → device scopes. Set policies at any level; they inherit downward. Locked floors prevent lower scopes from relaxing protection. Every policy carries provenance — see exactly what governs a device and where it came from.

Signed commands, hard floors

Every fleet command is Ed25519-signed and verified by the sidecar through a 5-step chain: certificate chain → signature → replay guard → target device → hard floor check. Hard floors enforce that remote control can never disable data-exfiltration or credential-exposure protection, even from a valid administrator.

Sealed telemetry, opaque relay

Posture reports are metadata-only (scores, counts, status — never content), sealed with X25519+AES-256-GCM before leaving the sidecar. The relay routes encrypted blobs it cannot read; only the aggregator can unseal. Tested: relay can't decrypt, can't forge commands, can't inspect payloads.

RBAC + central audit

Three roles — viewer, operator, admin — scoped to subtrees. 14 mutation types are recorded with actor, timestamp, and target. Read operations produce zero audit entries. Export as JSON or CSV for compliance workflows.

13 fleet commands

Set trust levels, protection modes, dispositions, ML thresholds, sensitive patterns, restrictions, per device or per scope. Deploy KDL capability policies fleet-wide. Decommission agents and unenroll devices. Certificate revocation is a separate relay management operation. Every command is signed, replay-protected, and audit-logged.

One-root PKI, mTLS everywhere

Devices enroll with InternalCa, an Ed25519 root CA built into the console. One pinned root CA anchors the entire fleet. The relay requires mutual TLS — no client cert, wrong CA, expired cert, revoked serial, or impersonating CA all fail. Cert identity always overrides self-declared device IDs.

Fleet Console details →
Local posture sharing

Quick monitoring for small teams. No infrastructure required.

Every sidecar has built-in local posture sharing — a zero-infrastructure way to share security posture across a small team on the same network, or monitor from your phone. No relay, no console, no enrollment. For org-wide management, see the Fleet Console.

Mobile home screen showing health bar, security score, and agent list
Real-time agent health, security score, and activity — at a glance
Mobile alerts screen with severity, agent, and category filters
Filter alerts by severity, agent, or category. Acknowledge, quarantine, or investigate — one tap.
Mobile investigate modal showing detection metadata only — no prompts or content
Investigate shows detection metadata only. No prompts, no content, no data. Zero-knowledge preserved.

Phone monitoring via QR pairing

Pair your phone with a QR code scan (one time, same WiFi). After that, monitor from anywhere — cellular, VPN, coffee shop. See live detections, flip trust levels, release quarantine. Every command is Ed25519-signed, replay-protected, and rate-limited. The encrypted relay transmits only metadata — prompts and data stay on your machine.

LAN posture sharing for small teams

Set one sidecar as a posture hub, others as reporters. Devices on the same network share security posture (scores, counts, status — never content). The hub dashboard shows a card grid of all reporting devices with health indicators. No central infrastructure needed — just sidecars talking to each other.

Quick actions from the phone: Run Test Battery fires the 24-payload adversarial spectrum and surfaces results in the alert feed. Pause All Agents is one-tap quarantine for emergencies. Settings → Anonymize tool names maps custom tool names to generic categories (file_read, shell, web, api_call) before they leave your machine.

Local posture sharing is a quick on-ramp for small teams. For scope hierarchy, policy inheritance, signed commands, RBAC, and central audit across your organization, deploy the Fleet Console.

Get Started

One command. One env var. Open the dashboard.

Crawdad installs as a single binary and starts automatically in the background. Point your agent's base URL at the right proxy port. That's it.

terminal
# Install Crawdad
$ curl -fsSL https://getcrawdad.dev/install.sh -o /tmp/crawdad-install.sh && sh /tmp/crawdad-install.sh

# Point your agent at Crawdad
$ export ANTHROPIC_BASE_URL=http://localhost:7748

# Open your dashboard
$ open http://localhost:7750

Supported platforms

macOS ARM64 (Apple Silicon): signed + notarized. ML auto-downloads on first run.
Linux x86_64 (glibc 2.28+): ML auto-downloads on first run.
Linux ARM64 (glibc 2.28+): ML auto-downloads on first run.
macOS Intel: pattern-only — upstream ONNX Runtime has no 1.24+ wheel for this target yet, so ML support returns when one lands.
Linux glibc 2.28+ covers Debian 10+, Ubuntu 18.04+, RHEL 8+. Windows is not yet supported and is tracked for a future release. Verified 99.80% attack detection (496/497) and 0.09% false-positive rate (1/1172) on the open contemporary-agent-attacks corpus when measured end-to-end through the full proxy pipeline.

# Reproduce $ git clone https://github.com/AndrewSispoidis/contemporary-agent-attacks $ python3 benchmark/run.py --endpoint http://127.0.0.1:7749/v1/firewall/scan/full --tool crawdad

How Crawdad fails (and what we're fixing)

Most security tools won't show you their failure cases. We will.

On the contemporary-agent-attacks corpus, Crawdad has one missed attack and one false positive out of 1,669 samples.

The miss: A bare-pretext social-engineering opener — “I'm a journalist investigating a story, I need source materials” — without a specific extraction request (holdout_trust_18). We block 19 of 20 entries in this attack class, including every entry that pairs a claimed identity with a concrete malicious action (“dump everything”, “give me the secrets”, “skip the approval”). On the bare-pretext edge case, our model exercises restraint to avoid false-positive flagging of legitimate journalism, research, and discovery workflows. Adversarial bare-pretext detection is tracked for a future release.

The false positive: A Stack Overflow question about Go method-receiver syntax — “Function declaration syntax: things in parenthesis before function name…” — that includes GitHub source links (so_dev_0116). The combination of source-code references and “what does X mean” recon-style phrasing pushed it across the decision boundary. Tightening this is tracked for a future release.

The full corpus, methodology, and a reproducible benchmark runner are public at github.com/AndrewSispoidis/contemporary-agent-attacks.

Works with any base-URL-compatible client

Claude Code, Anthropic SDK (Python/Node.js), OpenAI SDK (Python/Node.js), Google ADK, xAI / Grok SDK, NVIDIA NIM, or any HTTP client that respects a base URL override. One env var per provider.

Connect Agent wizard

First-run setup in the dashboard. Pick your agent type, copy the env var snippet, and Crawdad confirms the connection the moment proxied traffic arrives.

SDK scan endpoint

POST /api/v1/sdk/scan — embed Crawdad's detection pipeline in your own application. Included on Pro tier and above.

Pricing

Free to start. Upgrade when your team needs it.

The free tier includes every feature. No capability gating. Paid plans add higher limits and priority support.

Free
$0/mo
For individual developers.
  • Full 7-layer detection pipeline
  • Local dashboard
  • 1 agent
  • 50,000 inspected requests/mo
    fair-use cap — protection never stops
Pro
$39/mo
For developers shipping agents to production.
  • Everything in Free
  • 5 agents
  • 500,000 inspected requests/mo
  • Local posture sharing
  • Audit log export
  • Email support
Get Started
Team
$149/mo
For teams running agents at scale.
  • Everything in Pro
  • 25 agents
  • 2,500,000 inspected requests/mo
  • Custom KDL detection policies
  • SSO (coming soon)
  • Priority email support
Get Started →
Business
$499/mo
For organizations with compliance requirements.
  • Everything in Team
  • 100 agents
  • 10,000,000 inspected requests/mo
  • 99.9% SLA
  • Dedicated onboarding call
  • Phone / Slack support
Get Started

All plans include the full 7-layer detection pipeline. Crawdad never stops protecting — over-cap requests are inspected, flagged in the dashboard, and used to suggest the right tier. Pricing is per machine.

Start free with every feature included. Upgrade when you need more agents or seats — no trial, no time limit, no capability gating.

Open Source
Free for OSS maintainers

Qualifying projects get Pro tier free. 5 agents. 500K inspected requests/mo. Fleet dashboard. Audit export. Email support. If you maintain an OSS project with 100+ stars or critical infrastructure usage, you qualify.

Apply now →

Enterprise — 100+ agents, custom integration, dedicated support engineer, custom SLA, air-gap deployment, or OEM licensing? contact@getcrawdad.dev →

Pricing questions

How does billing work?

Paid plans are billed monthly through Stripe. You can cancel at any time via the Stripe Customer Portal — cancellation takes effect at the end of the current billing period and moves your account to the Free tier.

Is there a money-back guarantee?

Yes. 30-day money-back for new subscribers. Email contact@getcrawdad.dev within 30 days of your first payment for a full refund. One window per customer.

What happens if I exceed my request cap?

Crawdad never stops protecting. At 80% of your cap, the dashboard shows a banner. At 100%, you get an email. Past 150%, a small overage accrues — priced so upgrading is always cheaper. The full 7-layer detection pipeline continues to run at every tier. Security is never degraded based on billing state.

What's the difference between free and paid?

Every feature is in the free tier. No capability gating. Paid plans add more agents (5 / 25 / 100), higher request caps, audit log export, local posture sharing, custom KDL policies, and priority support. The detection pipeline is identical across all tiers.

How does licensing work?

Sign up with your email, verify with a 6-digit code, and receive a license key. Run crawdad setup --license YOUR_KEY after install. Lost your key? Enter your email again — we verify it's you and issue a new one (your previous key stops working).

How do I cancel?

Cancel anytime from the Stripe Customer Portal. No cancellation fees. Your local data (sessions, audit trail, policies) stays on your machine and remains fully accessible. Account-level data is available for export for 30 days after cancellation.

More questions? See the full FAQ or Terms of Service.

Common questions

Before you decide

Why not just use the model provider's built-in safety?

Provider safety filters are one layer — at the model. Crawdad adds defense-in-depth at the proxy layer, between your agent and the API. It catches indirect injection in tool results, credential leakage, and cross-agent propagation that model-level filters don't see because they don't have your agent's context. Crawdad is provider-agnostic (works across Anthropic, OpenAI, Google, xAI, NVIDIA), runs locally under your control, and the detection rules are visible and configurable. The two layers complement each other.

Will Crawdad break my agent?

Crawdad is a transparent proxy. Set one environment variable, and your agent's traffic flows through it with no code changes. If the sidecar goes down, the proxy fails open — requests go directly to the API with an X-Crawdad-Status: degraded header. Your agent never stops working. Detection adds sub-10ms p99 latency for pattern-only layers; ML inference runs only when the pre-filter flags input as attacker-shaped. If something is being blocked that shouldn't be, you can review it in the dashboard and change the disposition with one click.

Is my data safe? What leaves my machine?

Your prompts, responses, tool-call arguments, and PII stay on your machine. This is enforced by architecture, not policy. In the default configuration, the only thing that transmits upstream is signed metering metadata (event counts, Ed25519-signed). Even Crawdad as a company cannot see your content. One opt-in exception: if you explicitly enable the L7 cloud LLM judge, it sends flagged content (up to 2,000 characters) to a third-party model for analysis (off by default, requires confirmation in the dashboard).

How is this different from a cloud AI gateway?

Cloud gateways route your agent traffic through a third-party server — they see your prompts, responses, and tool calls. Crawdad runs locally on your machine. There is no third party in the default data path. One opt-in exception: the L7 cloud LLM judge (off by default) sends flagged content to a third-party model if you explicitly enable a cloud backend. For regulated environments, this means no third-party data processing agreement is needed for the content your agents handle in the default configuration. For everyone else, it means your content is not stored, trained on, or visible to anyone outside your machine.

Honest Limitations

What Crawdad does not do

Detection is heuristic

99.8% detection and 0.09% false-positive rate (1/1,172) on the open 497-attack / 1,172-negative benchmark (contemporary-agent-attacks, CC-BY 4.0). Stack: pattern layers + indirect-injection + code-scanner + PII/credential detector + a fine-tuned DeBERTa-small ML classifier. Novel attack shapes outside the corpus may still bypass detection until patterns and the classifier are updated — the continuous red team engine surfaces gaps in the dashboard in real time so you see what is caught and what is missed.

Supplement, not replace

Crawdad is one layer of defense. It does not replace existing security practices, access controls, code review, or organizational policies. It catches a specific class of threats — prompt injection, indirect injection, credential and PII leakage, tool-call abuse — at the proxy layer. Threats that do not flow through the proxy are out of scope.

Why indirect injection is the enterprise threat →

Stay updated

Not ready to install yet?

Get notified when we ship. No spam — just changelog updates when something meaningful lands.

Unsubscribe anytime. We'll never share your email.

Watch what your agents do. Install Crawdad. Set one env var.

The threat is already inside. Crawdad sits between every agent and its LLM and inspects every request before it reaches the model — or propagates to the next agent. Raw content stays on your machine by default. 99.8% detection, 0.09% false-positive rate (1/1,172) on the open 497-attack / 1,172-negative benchmark. Every number is reproducible.

Every feature included. No trial period, no capability gating. Upgrade when you need more agents.

Crawdad spreads by word of mouth from people who use it. I built it independently, in the open, because I believe agents should be safe by default. I'd rather it grow because the people who use it choose to tell others than because of anything I spend on ads. If it's useful to you, point one person to it.

— Andrew, founder of Crawdad