Brex built CrabTrap, an open-source HTTP/HTTPS proxy that intercepts all outbound agent network traffic, applies policy rules, and uses an LLM as a “judge” to approve or deny unusual requests. The company created the platform after finding that traditional SDK-level permissions and model guardrails were insufficient to contain agents’ real-world behavior when those agents hold credentials such as API keys or OAuth tokens.
Why the transport layer?
Pedro Franceschi, Brex co-founder and CEO, argued that the network layer was an underused enforcement point: "Every request an agent makes is an opportunity to intercept, reason about, and make a policy decision." By operating at the transport layer, CrabTrap is framework-, language-, and API-agnostic. It does not require SDK wrappers or per-tool integrations: users set HTTP_PROXY and HTTPS_PROXY in an agent’s environment so that every outbound request routes through the proxy before reaching its destination.
Franceschi emphasized that this choice complements other defenses rather than replacing them: Brex favors "security by layers," and the transport layer was simply a place where meaningful enforcement could be added.
The LLM-as-a-judge training loop
CrabTrap combines deterministic static rules with an LLM judge for requests that fall outside known patterns. Brex says the judge fires only on the long tail of unfamiliar endpoints or unusual request shapes — for a mature agent this is typically fewer than 3% of requests.
A key insight for Brex was to bootstrap policy from observed behavior rather than write policies from scratch. To do this they built a policy builder that runs agents in shadow mode, analyzes historical network traffic, samples representative calls, and drafts a natural-language policy that reflects what the agent actually does.
An eval system tests policy changes before they go live. CrabTrap compares historical audit entries against a draft policy and reports the exact changes that would result. Results can be sliced by method, URL, original decision, and agreement status. The system runs concurrent judge calls so replaying thousands of requests takes minutes, not hours. Full audit trails are stored in PostgreSQL and are queryable via the admin API and dashboard. If a resource is continuously denied, the system can notify a human or an agent to propose a policy update for review — closing the loop between observed denials and policy refinement.
Technical challenges
Two prominent challenges were latency and prompt injection.
-
Latency: inserting an LLM between an agent and every outbound API request could have been expected to slow systems significantly. In practice this was mitigated because the judge only activates on a small fraction of requests (the ~3% noted above), high-volume patterns become static rules once observed, and the team used small, fast models such as Claude Haiku. Added latency when the judge fires was therefore negligible and can be further reduced with local models and prompt caching.
-
Prompt injection: because the judge receives the full HTTP request, user-controlled fields (URL, headers, body) could attempt to manipulate the model. Brex addressed this by structuring the request as a JSON object and escaping user-controlled content rather than interpolating it as raw text before sending it to the model.
Results and operational impact
Brex tracks agent engagement, network traffic patterns, and Net Promoter Score (NPS). The most significant effect of CrabTrap has been increased organizational confidence: previously the team hesitated to deploy autonomous agents widely because existing guardrails did not provide enough assurance. With CrabTrap in place they have an enforcement layer they trust, which has enabled broader agent deployment and more delegation of agent configuration and management to users.
Policies derived from traffic proved "surprisingly strong": Brex expected the policy builder to create only a rough starting point that would require heavy manual editing, but pointing the platform at a few days of real traffic often produced policies that matched human judgment for the vast majority of held-out requests.
The proxy also served as a discovery tool: audit trails made visible how much noise agents generate. Denial logs and traffic analysis were used not only to tune policies but to simplify agents, remove tools, and eliminate categories of requests that wasted time and tokens.
Future development and open-source contribution
CrabTrap is open-source and Brex expects the community to help shape its evolution. Planned improvements include deeper authentication (such as single sign-on), fine-grained role-based access control (RBAC), escalation workflows for agents to request additional permissions, and policy recommendations based on denial patterns.
Programmatic configuration — API endpoints for creating, forking, and applying policies — could automate the policy lifecycle instead of requiring manual management. Escalation mechanisms would allow a continuously denied agent request to route to humans or other AI agents for review with a rationale, shifting CrabTrap from a hard boundary toward a managed permission system.
The current policy bootstrap relies on network traffic, but Brex sees opportunities to incorporate additional signals (agent traces, resource-calling context, or higher-level intent) to produce more accurate and nuanced policies. There is also an open question about whether CrabTrap should be a transparent layer the agent is unaware of, or function as a "well-intentioned manager" that the agent can interact with — an area where community feedback will matter.
Lessons for other builders
CrabTrap has attracted notable interest — the project has more than 700 stars on GitHub — and Brex reports inbound interest from organizations including OpenAI and individuals such as Garry Tan and Pete Steinberger. Franceschi’s broader point is practical: infrastructure gaps should not be an excuse to wait. If enterprises want to deploy AI agents in production, they must address blockers directly; CrabTrap demonstrates that building a transport-layer enforcement plane can materially reduce risk and enable wider adoption.
