Crawdad is a small security program that runs on your machine. It sits between your AI agents and the upstream LLMs and inspects every request through a multi-layer detection pipeline before it's forwarded. Metadata-only telemetry (event counts, categories, verdicts) egresses by default, raw content never does. Raw prompts, responses, and action parameters stay on your machine by default, enforced by a sanitization chokepoint in the architecture, not policy. Telemetry depth is customer-governed.
Catches direct and indirect injection before the LLM sees the request.
Scans outbound responses for API keys, secrets, internal URLs, and 15 PII categories.
Every decision recorded locally in a SHA-256 hash-chained, Ed25519-signed audit trail.
Cmd+Space, type "Terminal", press Enter./usr/local/bin/crawdad-sidecar and registers a LaunchAgent that starts automatically at login.http://localhost:7750. Click Run Test Battery to verify the detection pipeline.Apple Silicon (ARM64) ships full ML detection, the sidecar downloads the model and libonnxruntime in the background after install, then activates on the next restart. Reproducible score: 99.80% detection / 0.09% FP (1/1,172) on the open 497-attack / 1,172-negative benchmark. Intel Macs run pattern-only because upstream ONNX Runtime has no 1.24+ x86_64-apple-darwin wheel. Full notes at Getting Started.
sudo once to register the systemd user unit at /etc/systemd/system/crawdad-sidecar.service.http://localhost:7750. Click Run Test Battery to verify detection.Linux x86_64 and Linux ARM64 both ship full ML detection, the sidecar auto-fetches the platform-specific libonnxruntime 1.24.4 tarball along with the model on first run, then activates ML on the next restart. Reproducible score: 99.80% detection / 0.09% FP (1/1,172) on the open 497-attack / 1,172-negative benchmark.
Or download the signed binary directly:
Native Windows is brought current in 1.7.4 — the full, current product; the build shows an unsigned-app warning on install until our code-signing certificate is in place. Under Enforce mode, Windows applies the mandatory credential broker but has no OS egress lock today (that runs on macOS and Linux).
crawdad.exe to %ProgramFiles%\Crawdad, registers the CrawdadSidecar service (auto-start), and adds Crawdad to your system PATH.http://localhost:7750.Administrator is required, the installer declares #Requires -RunAsAdministrator because it registers a service and writes to Program Files. For silent RMM/MDM push, set $env:ENROLLMENT_KEY, $env:CONSOLE_URL, and $env:CA_FINGERPRINT before running the command to auto-enroll into a fleet console. Step-by-step: the install walkthrough.
Want full ML detection on Windows today? Run the Linux binary under WSL (Windows Subsystem for Linux): open your WSL shell and run curl -fsSL https://getcrawdad.dev/install.sh | sh, then export ANTHROPIC_BASE_URL=http://localhost:7748.
Managing more than one machine? The fleet console is a single self-hosted binary, no Docker, that runs the operator console and the mTLS device relay with a built-in internal CA. Install it on the host that will manage your fleet (macOS or Linux):
Run it as your user for a per-user install (~/.local/bin, data in your home directory) or with sudo for a system service (/usr/local/bin, data in /var/lib/crawdad-fleet). On first boot it bootstraps the admin identity and prints your operator login key, a ck_… key shown once. The console listens on https://localhost:9000 and the relay on wss://0.0.0.0:8800. Full walkthrough and the device-enrollment story: Deploy your fleet.
Open the local dashboard at http://localhost:7750 to see every request inspected, per-layer decisions, and the continuous red team trend. New to Crawdad? The install walkthrough narrates exactly what each installer prints, where the binary lands, and how to confirm it's running. Hit a snag? See install troubleshooting.
/usr/local/bin.sudo, and systemd for the auto-start service.9000 and 8800 free, ≥100 MB disk, and curl.