brexhq/CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production

An LLM-as-a-judge HTTP proxy to secure agents in production - brexhq/CrabTrap

Summary

CrabTrap is a Go-based HTTP/HTTPS forward proxy that mediates outbound traffic from AI agents to external APIs. It checks every request against deterministic URL pattern rules and, when those don't match, against an LLM-based policy judge, then forwards or blocks with a logged reason. A PostgreSQL audit trail and a React admin UI give operators visibility into what agents are doing and why requests were allowed or denied.

What it is useful for

CrabTrap addresses the gap between trusting an agent and controlling what it can do on the network. Concrete scenarios from the README include:

• Restricting an agent to specific Slack channels or GitHub repositories by writing prefix, exact, or glob URL rules.
• Letting an LLM judge approve or deny ambiguous requests against a per-agent natural-language policy.
• Blocking SSRF attempts — RFC 1918 ranges, loopback, link-local, IPv6 ULA/NAT64/6to4, and DNS rebinding are rejected before the request leaves the proxy.
• Replaying historical audit entries through the eval system to measure how a policy would have performed.

Documented limitations to plan around: CrabTrap is a forward proxy only and is not a WAF for inbound traffic. It does not redact sensitive data — request bodies and headers like Authorization and Cookie are visible to the proxy by design, since the trust boundary is the proxy itself. There is no human-in-the-loop approval flow; decisions are made automatically. API responses are not filtered, and only the WebSocket upgrade request is evaluated — frames pass through uninspected after the upgrade.

How engineers can use it

The README's quickstart uses Docker Compose to run CrabTrap and Postgres together. The flow is: bring the stack up, copy the generated CA cert, create an admin user via the gateway create-admin-user command, mint a per-user token from the admin API, then point the agent (or a tool like curl) at the proxy.

docker compose up -d
docker compose cp crabtrap:/app/certs/ca.crt ./ca.crt
curl -x http://${token}:@localhost:8080 --cacert ca.crt https://httpbin.org/get

For applications, set HTTP_PROXY and HTTPS_PROXY to the proxy address (default localhost:8080); the admin UI lives on localhost:8081. Configuration is in config/gateway.yaml — see config/gateway.yaml.example for the inline-commented reference, covering SSRF CIDR allowlists, rate limits (default 50 req/s with burst 100), LLM provider and circuit-breaker settings, and the fallback mode (deny or passthrough when the judge is unavailable). The optional Prometheus listener (default bound to 127.0.0.1:9090) exposes counters for rate-limit hits and approval decisions, judge latency histograms, and circuit-breaker state gauges; the metric catalog is in docs/observability.md. For architecture and troubleshooting, see DESIGN.md and TROUBLESHOOTING.md.