Your agents should never (try to) read your secrets.

Website • How It Works • Quick Start • Agent Setup • Protection • Plugins • Docs • Issues • Discussions

Crust is a transparent, local gateway between your AI agents and LLM providers. It intercepts every tool call — file reads, shell commands, network requests — and blocks dangerous actions before they execute. No code changes required.

100% local. Your data never leaves your machine.

Crust has five entry points — use one or combine them:

All entry points apply the same evaluation pipeline — self-protection, input sanitization, Unicode normalization, obfuscation detection, DLP secret scanning, path normalization, symlink resolution, and rule matching — each step in microseconds.

All activity is logged locally to encrypted storage.

macOS / Linux / BSD:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/BakeLens/crust/main/install.sh)"

Windows (PowerShell):

irm https://raw.githubusercontent.com/BakeLens/crust/main/install.ps1 | iex

Docker:

docker compose up -d        # uses the included docker-compose.yml
# or manually:
docker build -t crust https://github.com/BakeLens/crust.git
docker run -p 9090:9090 crust

Then start the gateway:

crust start --auto

Auto mode detects your LLM provider from the model name — no endpoint URL or API key configuration needed. Your agent's existing auth is passed through.

Point your agent to Crust:

Crust auto-detects the provider from the model name and passes through your auth — no endpoint URL or API key configuration needed. Clients that send /api/v1/... paths (e.g. some JetBrains configurations) are also supported. For providers with non-standard base paths like OpenRouter (https://openrouter.ai/api), use --endpoint.

crust status     # Check if running
crust status --agents  # Detect running AI agents and protection status
crust logs -f    # Follow logs
crust doctor     # Diagnose provider endpoints
crust stop       # Stop crust

For MCP servers, Crust intercepts tools/call and resources/read requests before they reach the server.

crust wrap -- npx -y @modelcontextprotocol/server-filesystem /path/to/dir

Works with any MCP server. See the MCP setup guide for details and examples.

For IDEs that use the Agent Client Protocol (ACP), Crust can wrap any ACP agent as a transparent stdio proxy — intercepting file reads, writes, and terminal commands before the IDE executes them. No changes to the agent or IDE required.

crust wrap -- goose acp

Supports JetBrains IDEs and other ACP-compatible editors. See the ACP setup guide for step-by-step instructions.

Crust ships as a native iOS 15+ library (CrustKit) for embedding in mobile apps. The same rule engine that protects desktop agents also protects mobile AI agents.

Three integration paths — pick one:

import CrustKit

let engine = CrustEngine()
try engine.initialize()

// ── Option 1: Local reverse proxy ──
// Best when your AI SDK doesn't use URLSession or you want explicit control.
try engine.startProxy(port: 8080, upstreamURL: "https://api.anthropic.com")
// Point your AI SDK base URL to http://127.0.0.1:8080

// ── Option 2: URLProtocol (zero-config) ──
// Best when your AI SDK uses URLSession — no base URL change needed.
CrustURLProtocol.engine = engine
let session = URLSession(configuration: .crustProtected)

// ── Option 3: Direct evaluation ──
// Best for custom integrations or manual checks.
let result = await engine.evaluateAsync(toolName: "read_contacts", arguments: [:])
print(result.matched)  // true — blocked by protect-mobile-pii

// ── Content scanning (DLP for text responses & user input) ──
let scan = engine.scanContent(aiTextResponse)     // secrets in AI output
let outbound = engine.scanOutbound(userMessage)    // secrets in user input
let urlCheck = engine.validateURL("tel:+1234567890") // blocked URL schemes

Mobile-specific protections (7 locked rules + shared rules):

Installation:

# Local development — build the xcframework
./scripts/build-ios.sh

# Then add ios/CrustKit/ as a local Swift Package in Xcode

For release builds, Libcrust.xcframework.zip is attached to each GitHub release with a SHA-256 checksum for use as a remote SPM binary target.

Mobile and desktop rules are unified using virtual paths (mobile://) — the same YAML file protects both platforms. See internal/rules/builtin/security.yaml for all 30 rules.

Crust ships with 35 security rules (32 locked, 3 user-disablable) and 46 DLP token-detection patterns out of the box:

All rules are open source: internal/rules/builtin/security.yaml (path rules), internal/rules/dlp.go (DLP patterns), and internal/rules/dlp_crypto.go (crypto key detection)

These defenses are validated against 50 real-world CVEs affecting Cursor, GitHub Copilot, Claude Code, OpenAI Codex CLI, and other AI agents — including prompt injection, config hijacking, env var poisoning, and token exfiltration attacks.

Rules use a progressive disclosure schema — start simple, add complexity only when needed:

rules:
  # One-liner: block all .env files
  - block: "**/.env"

  # With exceptions and specific actions
  - block: "**/.ssh/*"
    except: ["**/*.pub", "**/known_hosts"]
    actions: [read, copy]
    message: "Cannot access SSH directory"

  # Advanced: regex matching on commands
  - name: block-rm-rf
    match:
      command: "re:rm\\s+-rf\\s+/"
    message: "Blocked: recursive delete from root"

crust add-rule my-rules.yaml    # Rules active immediately (hot reload)

Plugins are late-stage protection layers that run after the built-in 14-step evaluation pipeline. When the engine allows a tool call, it passes through registered plugins before returning the final verdict. Plugins can implement sandboxing, rate limiting, audit logging, or custom policy enforcement.

Plugins communicate over a JSON wire protocol (newline-delimited JSON over stdin/stdout) — write them in any language: Python, Go, Rust, Node.js, etc.

# sandbox_plugin.py — restrict file access to project directory
def handle_evaluate(req):
    for path in req.get("paths", []):
        if not path.startswith("/home/user/project"):
            return {"rule_name": "sandbox:fs-deny", "severity": "high",
                    "message": f"path {path} is outside sandbox"}
    return None  # allow

Key features:

• OS-level crash isolation — plugins run as separate processes; a crash cannot affect the engine
• Circuit breaker — plugins that fail 3 times are auto-disabled with exponential backoff
• Rule snapshot access — plugins receive a read-only view of all active engine rules
• First-block wins — plugins evaluate concurrently; the first block cancels the rest

See the Plugin System documentation for the full wire protocol specification, data types, and examples.

A security tool must protect itself first. Crust is built to resist tampering — even by the AI agents it monitors:

See SECURITY.md for vulnerability reporting.

Setup

Reference

git clone https://github.com/BakeLens/crust.git
cd crust
go build .
./crust version   # Windows: .\crust.exe version

Crust is open-source and in active development. We welcome contributions — PRs for new security rules are especially appreciated.

• Report a bug
• Security vulnerabilities — please report privately
• Discussions

Add this badge to your project's README:

[![Protected by Crust](https://img.shields.io/badge/Protected%20by-Crust-blue)](https://github.com/BakeLens/crust)

@software{crust2026,
  title = {Crust: A Transparent Gateway for AI Agent Security},
  author = {Chen, Zichen and Chen, Yuanyuan and Jiang, Bowen and Xu, Zhangchen},
  year = {2026},
  url = {https://github.com/BakeLens/crust}
}

Elastic License 2.0