Your agents should never (try to) read your secrets.

Website • Quick Start • How It Works • Issues • Discussions

Crust is a transparent, local gateway between your AI agents and LLM providers. It intercepts every tool call — file reads, shell commands, network requests — and blocks dangerous actions before they execute. No code changes required.

100% local. Your data never leaves your machine.

macOS / Linux:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/BakeLens/crust/main/install.sh)"

Windows (PowerShell):

irm https://raw.githubusercontent.com/BakeLens/crust/main/install.ps1 | iex

Then start the gateway:

crust start --auto

Point your agent to Crust:

That's it. Crust auto-detects the provider from the model name and passes through your auth. Works with all 7 major coding agents out of the box — each agent's tool names are recognized automatically.

Crust inspects tool calls at three layers:

1. Layer 0 (Request Scan): Scans tool calls in conversation history before they reach the LLM — catches agents replaying dangerous actions.
2. Layer 1 (Response Scan): Scans tool calls in the LLM's response before they execute — blocks new dangerous actions in real-time.
3. Layer 2 (OS Sandbox): Kernel-level enforcement via Landlock (Linux) and Seatbelt (macOS) — last line of defense even if rules are bypassed.

All activity is logged locally to encrypted storage.

Crust ships with 14 security rules out of the box:

All rules are open source: internal/rules/builtin/security.yaml

Rules use a progressive disclosure schema — start simple, add complexity only when needed:

rules:
  # One-liner: block all .env files
  - block: "**/.env"

  # With exceptions and specific actions
  - block: "**/.ssh/id_*"
    except: "**/*.pub"
    actions: [read, copy]
    message: "Cannot access SSH private keys"

  # Advanced: regex matching on commands
  - name: block-rm-rf
    match:
      command: "re:rm\\s+-rf\\s+/"
    message: "Blocked: recursive delete from root"

crust add-rule my-rules.yaml    # Rules active immediately (hot reload)

# Gateway
crust start --auto                          # Auto mode (recommended)
crust start --endpoint URL --api-key KEY    # Manual mode
crust start --auto --block-mode replace     # Show block messages to agent
crust start --foreground --auto             # Foreground mode (for Docker)
crust stop                                  # Stop the gateway
crust status                                # Check if running
crust logs [-f]                             # View logs

# Rules
crust list-rules                            # List active rules
crust add-rule FILE                         # Add custom rules (hot reload)
crust remove-rule FILE                      # Remove user rules
crust reload-rules                          # Force reload all rules
crust lint-rules [FILE]                     # Validate rule syntax

# Other
crust version                               # Show version
crust uninstall                             # Complete removal

server:
  port: 9090
  log_level: info

upstream:
  url: "https://openrouter.ai/api"       # fallback upstream
  timeout: 300
  providers:                               # custom model routing
    my-llama: "http://localhost:11434/v1"
    my-vllm:  "http://gpu-server:8000/v1"

security:
  enabled: true
  block_mode: remove    # "remove" or "replace"

rules:
  enabled: true
  watch: true           # hot reload on file change

sandbox:
  enabled: false        # OS-level sandbox (Landlock/Seatbelt)

docker build -t crust .
docker run -p 9090:9090 crust

# docker-compose.yml
services:
  crust:
    build: .
    ports:
      - "9090:9090"
    restart: always

git clone https://github.com/BakeLens/crust.git
cd crust
task build
./crust version

Crust is open-source and in active development. We welcome contributions — PRs for new security rules are especially appreciated.

• Report a bug
• Security vulnerabilities — please report privately
• Discussions

Add this badge to your project's README:

[![Protected by Crust](https://img.shields.io/badge/Protected%20by-Crust-blue)](https://github.com/BakeLens/crust)

@software{crust2026,
  title = {Crust: A Transparent Gateway for AI Agent Security},
  author = {Chen, Zichen and Chen, Yuanyuan and Jiang, Bowen and Xu, Zhangchen},
  year = {2026},
  url = {https://github.com/BakeLens/crust}
}

Elastic License 2.0