Brex tried the obvious approach to keeping AI agents in line: govern the code. It didn’t work. So the fintech company built something different, an HTTP/HTTPS proxy called CrabTrap that monitors what AI agents actually do at the network level, using a language model to make judgment calls on unfamiliar traffic patterns.
The company open-sourced CrabTrap on April 21, 2026, and the project has already racked up more than 700 stars on GitHub.
Why code-level governance fell short
Brex’s journey to CrabTrap started with a problem most companies building AI agents will eventually hit. Their earlier OpenClaw agent framework revealed that traditional SDK-level governance, the kind that tries to constrain agent behavior through code-level controls, was fundamentally inadequate for agents that hold sensitive credentials like API keys and OAuth tokens.
Pedro Franceschi, Brex’s co-founder and CEO, described the network layer as an “untapped enforcement point” for agent governance.
How CrabTrap actually works
CrabTrap routes all outbound requests from AI agents through its proxy. The system uses a dual-layer architecture that balances speed with intelligence.
The first layer consists of static rules derived from historical network traffic. These handle well-known, previously observed patterns and execute in microseconds thanks to caching. No model inference required, no latency penalty.
The second layer is where things get interesting. When CrabTrap encounters a request that doesn’t match any established pattern, it hands the decision to an LLM judge. The model evaluates the request against natural language policies that Brex derives from observed agent behavior, not policies written from scratch by engineers guessing what might go wrong.
The LLM returns structured JSON decisions, either ALLOW or DENY, along with its reasoning.
The efficiency numbers are compelling. Once user patterns are established, fewer than 3% of agent requests require LLM evaluation. That means 97% of traffic flows through at near-zero computational cost, and only the genuinely novel requests trigger model inference.
Discovery as a side benefit
One underappreciated feature of CrabTrap is its role as a discovery tool. By logging and analyzing all agent traffic, the proxy gives engineering teams visibility into what their agents are actually doing in production.
In at least one deployment, this capability helped Brex identify and eliminate unnecessary tools and request types that agents were making.
What this means for enterprise AI security
Brex’s approach arrives at a moment when enterprise adoption of AI agents is accelerating but security frameworks haven’t kept pace. CrabTrap’s transport-layer enforcement doesn’t care what the agent was told to do. It cares what the agent tries to do on the network.
Franceschi emphasized the importance of community feedback for CrabTrap’s ongoing development, which suggests Brex wants this to become an industry standard rather than a proprietary advantage.