Heads up This site is currently under heavy development.
← all tools
◆ AI/LLM Security

crust

open-source
source ↗ rss ↗

Summary

crust is an open-source gateway, licensed under Elastic License 2.0, that sits between AI agents and LLM providers and blocks dangerous tool calls — file reads, shell commands, network requests — before they execute. It runs as a local command-line install (a single script sets up the proxy), acting as a transparent gateway rather than a hosted service, and the vendor stresses that data never leaves the machine. It's aimed at teams building or operating AI agents who need runtime guardrails against destructive or unauthorized actions, wrapping MCP or ACP agents directly with no code changes. A paid "Crust Pro" tier exists for enterprise features, but the core gateway is free to run yourself. With 6 contributors, 435 commits and 10 releases in the past year, and a first commit in 2026, it's an active, very young project.

What crust answers

Which tool calls does it actually recognize as dangerous, versus let through unexamined?

it inspects file reads, shell commands, and network requests specifically, with custom rules addable and hot-reloaded for anything outside that default set

Does it work with the agent framework I'm already running?

it wraps MCP or ACP agents directly, and pairs with any agent framework without requiring code changes

What platforms can I actually run this on?

macOS, Linux, Windows, FreeBSD, and iOS all have supported builds

Will it add noticeable delay to agent responses?

it's a Go gateway built for near-zero latency, so interception adds minimal overhead to each call

How do I know what it's blocked or let through?

a live activity log streams what's happening, plus a status view showing which agents are currently protected

What happens if the maintainers stop working on it tomorrow?

weigh that it's a young project — first commit in 2026, six contributors — against its own security posture: fuzz testing, static analysis, and secret scanning are already wired into its pipeline

all 4 features, with the evidence for each →

Features

4 capabilities · 4 backed by code, an API document or a real run

Built from everything we hold on crust — every release we have summarised, its product documentation and how that documentation has changed, its README, its command-line surface and API, and runs we performed ourselves. Dates are when we first saw a capability, not when the vendor introduced it.

Capability area
All capabilities 4 capabilities
CVE archive management verified Archives resolved CVEs (fully defended or patched) to a separate file, with a configurable retention window. 2 other sources · first seen Mar 2026

command line

CVE fetching and filtering verified Fetches CVEs from a source with controls over the time window and minimum CVSS score to include. 2 other sources · first seen Mar 2026

command line

Output file configuration verified Lets the user specify the file path where CVE tracking output is written. 1 other source · first seen Mar 2026

command line

Dry-run mode verified Prints discovered CVEs to the console without writing or modifying any files. 1 other source · first seen Mar 2026

command line

  • --dry-run — Print discovered CVEs without modifying files v3.2.0 · Mar 2026 · command-line history
Capability
Evidence

Lines in monospace are the tool's own words — help text parsed from its source, or an endpoint from its API document. Everything else is our summary of a dated release or documentation change, linked back to the source it came from.

Release history

Nothing shipped since we started watching. Releases and docs updates land here as they happen.

last release Mar 24, 2026 · watching since Jul 27, 2026

my-toolchain — 0 tools
paste an install list to detect your tools

A brew list, a Brewfile, requirements.txt, a Dockerfile — or just the product names, free-form. Nothing leaves your browser.

    browse all tools →