AI agents are being handed real power now — real credentials, real systems, real consequences — and the security to match hasn't caught up. Closing that gap is the whole reason Crawdad exists — and it's not a problem any single vendor solves in isolation. It gets solved alongside the people actually running agents in the wild, hitting the edges, and shaping what comes next.
So that's how Crawdad is built — with you, not just for you. There's no distance between the people using it and the people building it. When you run into something, it reaches engineering directly, and you can see the result right here on this page: much of what shipped over the last two months started with real users running the tool and showing us where it fell short. Report something on a Tuesday, and it's not unusual for the fix to land that week.
Every release is verified end-to-end before it ships, and every claim is reproducible — including the unflattering ones, because you deserve the real numbers, not the marketing ones. That's the standard we hold ourselves to, and it's the standard the community deserves.
If something's slowing you down, breaking, or just feels wrong — or if you see where this should go next — that's the conversation we want: contact@getcrawdad.dev. We read all of it, and it genuinely shapes what we build. Thank you for building this with us.
Every release, newest first. Items tagged FEEDBACK were built because users asked for it.
FEATURE
crawdad enroll --token et_... --console-url https://... --ca-fingerprint sha256:.... Wrong fingerprint aborts enrollment and stores nothing../init-fleet.sh stands up the full fleet stack from zero: starts step-ca, extracts PKI, issues the relay TLS certificate, builds Docker images from source, starts the relay and console, creates the admin signing identity (--init-admin), stores the provisioner key for token minting (--init-enrollment), and creates the first operator (--init-operator). Idempotent — safe to re-run.docker-compose.fleet.yml deploys the complete fleet stack (step-ca + relay + console). Console command → relay → sidecar verified with chain + signature + replay + target + hard-floor checks.init-fleet.sh commands.deployment.md rewritten end-to-end with both compose and manual paths, all three bootstrap ceremonies, and the correct enrollment commands. reference.md updated: 7 enrollment API routes (34 → 41 total), console CLI flags table, 4 new environment variables.RELIABILITY
init-fleet.sh now builds Docker images from source before starting services, so --init-enrollment is always recognized regardless of cached image state.docker-compose.fleet.yml now sets STEP_CA_URL, STEP_CA_PROVISIONER, and STEP_CA_ROOT_CERT_FILE for the console service. The console loads the fleet root CA and passes it to the step-ca client — strictly stronger than the previous CRAWDAD_CA_SKIP_VERIFY workaround (pin to fleet root vs. disable all TLS verification).crawdad update now uses the correct binary name and semver directionality check.FEEDBACK FEATURE
node, nodejs, jsnode, ts-node, tsx, and npx are now observed by default — testing revealed that only node was matched, and common aliases slipped through. Each is now covered by exact match.npx downloads and immediately executes arbitrary packages — same risk profile as a language runtime. It's now in the observe tier so you see it in the Activity feed.FEEDBACK FEATURE
The anchor release. Early testing showed Crawdad was too aggressive out of the box — blocking tool calls for benign dev work. This release introduces a graduated approach: real attacks still block immediately, but ambiguous actions are observed instead of blocked.
curl -fsSL getcrawdad.dev/uninstall.sh | sh cleanly removes Crawdad. --purge flag to also remove data.FEATURE
FEEDBACK RELIABILITY
Driven by friction surfaced during real-world testing.
INSTALL
sudo installs correctly (resolves the real user's home, not root's). Graceful fallback on systemd-less distributions (Alpine, distroless). Handles minimal Docker containers.FEATURE
FEATURE
FEATURE
FEATURE