Stop Letting AI Agents Steal Your Secrets — Use Crust Now

Stop Letting AI Agents Steal Your Secrets — Use Crust Now

Your AI agent just read your .env file. It happened silently. No notification. No log you can read. And the worst part? You told it to do something completely innocent — "help me debug this API call" — and now your Stripe keys, AWS^{↗ Bright Coding Blog} credentials, and database passwords are sitting in a conversation history that gets synced to who-knows-where.

This isn't hypothetical. In 2024 alone, researchers found 84 CVEs targeting AI agents like Claude Code, GitHub Copilot, Cursor, and OpenAI Codex CLI. Prompt injection attacks. Config hijacking. Environment variable poisoning. Token exfiltration. The attack surface of AI agents is exploding, and most developers don't even realize they're running unprotected code with unlimited file system access.

But what if you could wrap an invisible security blanket around every AI agent you use? What if every tool call — every file read, every shell command, every network request — got intercepted and analyzed in microseconds, with dangerous actions blocked before they execute?

That's exactly what Crust does. And it requires zero code changes.

What Is Crust? The Security Gateway AI Agents Desperately Need

Crust is an open-source, transparent, local gateway that sits between your AI agents and LLM providers. Built by the team at BakeLens, it's designed from the ground up as AI Agent Security Infrastructure — intercepting and blocking dangerous agent behaviors before they happen.

The project's tagline says it all: "Your agents should never (try to) read your secrets."

Crust operates on a brilliantly simple principle: instead of trusting AI agents with raw access to your system, you route them through Crust's evaluation pipeline. Every tool call gets scrutinized through 17 sequential security checks — self-protection, input sanitization, Unicode normalization, obfuscation detection, DLP secret scanning, path normalization, symlink resolution, and rule matching. Each step completes in microseconds, meaning you get fortress-level security without perceptible latency.

100% local. Your data never leaves your machine. This isn't some cloud service mining your code for training data. Crust runs entirely on your hardware, with encrypted logs stored locally and API keys protected in your OS keyring.

The project is written in Go 1.26.1+, leveraging the new Green Tea garbage collector that reduces GC overhead by 10–40% — a critical optimization for the hot-path proxy pipeline that processes every agent interaction. It's fuzz-tested across 46 targets, scanned with gosec and semgrep, and validated against govulncheck and gitleaks on every commit.

With support for macOS 12+, Linux, Windows 10+, FreeBSD 15+, and iOS 15+, Crust meets you wherever you develop. The Elastic License 2.0 keeps it open and auditable while protecting against cloud providers reselling your security infrastructure.

Key Features: The 17-Step Fortress

Crust isn't a simple regex filter. It's a multi-layered security engine that would make enterprise firewalls jealous:

Five Flexible Entry Points

42 Built-In Security Rules (39 Locked, 3 User-Configurable)

Crust ships battle-tested protection across 11 categories:

• Credentials: .env files, SSH keys, cloud provider creds (AWS, GCP, Azure), GPG keys
• System Auth: /etc/passwd, /etc/shadow, sudoers files
• Shell History: .bash_history, .zsh_history, .python_history
• Browser Data: Chrome, Firefox, Safari passwords, cookies, local storage
• Package Tokens: npm, pip, Cargo, Composer, NuGet, Gem authentication tokens
• Git Credentials: .git-credentials, .config/git/credentials
• Persistence Mechanisms: Shell RC files, authorized_keys, cron/systemd/launchd, git hooks
• Agent Config Escalation: .claude/settings.json, .cursor/mcp.json, .mcp.json
• Crypto Wallets: BIP39 mnemonics, xprv/WIF keys with checksum validation, 16-chain wallet directories
• Dangerous Commands: eval/exec with dynamic code execution
• Self-Protection: Agents cannot read, modify, or disable Crust itself

51 DLP Token-Detection Patterns

Beyond path-based rules, Crust performs content analysis using 46+ patterns to detect real API keys and tokens in flight — AWS, GitHub, Stripe, OpenAI, Anthropic, and 40 more providers. This catches exfiltration even when attackers obfuscate or encode sensitive data.

Plugin Architecture for Custom Defense

Late-stage plugins run after the built-in pipeline, enabling sandboxing, rate limiting, audit logging, or custom policy enforcement. They communicate via JSON wire protocol over stdin/stdout, so you write them in any language — Python^{↗ Bright Coding Blog}, Go, Rust, Node.js. OS-level crash isolation means a plugin failure can't bring down the engine, and a circuit breaker auto-disables failing plugins with exponential backoff.

Use Cases: Where Crust Saves Your Bacon

1. The Junior Developer with Production Access

Your new hire asks Claude Code to "help fix the database connection." The agent helpfully reads .env.production, sees the full database URL with credentials, and includes it in the conversation context. Without Crust, that secret is now in Anthropic's logs, potentially training data, and any compromised account with access to that conversation. Crust blocks the .env read entirely — the agent gets a clean error, suggests alternative approaches, and your secrets stay secret.

2. The Open Source Maintainer Reviewing AI-Generated PRs

You're using Aider or Codex CLI to generate pull requests. A prompt injection in a dependency's README tricks the agent into reading your ~/.ssh/id_rsa and exfiltrating it through a seemingly innocent curl command. Crust's DLP scanning catches the private key content in the outbound request, blocks the network call, and logs the attempted exfiltration for your security review.

3. The Mobile App with On-Device AI

Your iOS app uses a local LLM for smart suggestions. Without protection, the model might read contacts, photos, or health data through tool calls you didn't audit. Crust's iOS library (CrustKit) provides 7 locked mobile-specific rules — PII protection, keychain isolation, clipboard read blocking, dangerous URL scheme validation (tel:, sms:, facetime:), Bluetooth/NFC restrictions, biometric auth protection, and in-app purchase blocking. Same YAML rules protect mobile and desktop through virtual mobile:// paths.

4. The MCP Server Running Untrusted Code

You install a third-party MCP server for filesystem access. It claims to only read /home/user/project, but a compromised update starts scanning ~/.aws/credentials. Crust's MCP Gateway wraps the server, intercepting every tools/call and resources/read — the AWS credential read never reaches the actual filesystem, and you get an immediate alert.

5. The Enterprise Team with Compliance Requirements

SOC 2, ISO 27001, and emerging AI regulations require audit trails for automated system access. Crust provides encrypted, tamper-resistant logging of every intercepted action, with keys stored in the OS keyring — not environment variables where agents could read them. The plugin system lets you forward events to your SIEM in real-time.

Step-by-Step Installation & Setup Guide

Getting protected takes under 60 seconds. Here's exactly how:

Installation

macOS / Linux / BSD — One command:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/BakeLens/crust/main/install.sh)"

Windows (PowerShell) — Equally simple:

irm https://raw.githubusercontent.com/BakeLens/crust/main/install.ps1 | iex

Docker^{↗ Bright Coding Blog} — For containerized deployments:

# Using the included compose file
docker compose up -d

# Or manually build and run
docker build -t crust https://github.com/BakeLens/crust.git
docker run -p 9090:9090 crust

Build from Source — Requires Go 1.26.1+ and a C compiler (CGO for SQLite):

git clone https://github.com/BakeLens/crust.git
cd crust
go build .
./crust version   # Verify installation

Start the Gateway

crust start

Auto mode is the default — Crust detects your LLM provider from the model name with zero configuration. Your existing authentication passes through transparently.

Configure Your Agent

Point any OpenAI-compatible agent at http://localhost:9090/v1:

For non-standard paths like OpenRouter (https://openrouter.ai/api), use the --endpoint flag.

Verify Protection

crust status              # Is Crust running?
crust status --agents     # Detect running AI agents and their protection status
crust logs -f             # Follow security events in real-time
crust doctor              # Diagnose provider endpoint issues
crust stop                # Graceful shutdown when needed

MCP Server Wrapping

# Protect any MCP server — filesystem, GitHub, databases, etc.
crust wrap -- npx -y @modelcontextprotocol/server-filesystem /path/to/dir

ACP Agent Wrapping

# Protect JetBrains and other ACP-compatible IDE agents
crust wrap -- goose acp

REAL Code Examples from the Repository

Let's examine actual code patterns from Crust's documentation, with detailed explanations of how each protects your systems.

Example 1: iOS Integration with Three Protection Paths

The CrustKit iOS library offers remarkable flexibility for mobile developers. Here's the complete integration pattern from the repository:

import CrustKit

// Initialize the security engine — required before any protection activates
let engine = CrustEngine()
try engine.initialize()

// ── Option 1: Local reverse proxy ──
// Best when your AI SDK doesn't use URLSession or you want explicit control
// over the interception point. Creates an HTTP server on localhost that
// forwards to the real LLM API after security checks.
try engine.startProxy(port: 8080, upstreamURL: "https://api.anthropic.com")
// Point your AI SDK base URL to http://127.0.0.1:8080

// ── Option 2: URLProtocol (zero-config) ──
// Best when your AI SDK uses URLSession — no base URL change needed.
// Swizzles into the URL loading system at the framework level.
CrustURLProtocol.engine = engine
let session = URLSession(configuration: .crustProtected)
// All requests through this session are automatically evaluated

// ── Option 3: Direct evaluation ──
// Best for custom integrations or manual checks before executing tools.
// Gives you explicit control over the async security decision.
let result = await engine.evaluateAsync(toolName: "read_contacts", arguments: [:])
print(result.matched)  // true — blocked by protect-mobile-pii rule

// ── Content scanning (DLP for text responses & user input) ──
// Scan AI outputs for accidentally leaked secrets
let scan = engine.scanContent(aiTextResponse)
// Scan user input for accidental secret pasting
let outbound = engine.scanOutbound(userMessage)
// Validate URL schemes to prevent tel: / sms: abuse
let urlCheck = engine.validateURL("tel:+1234567890") // blocked!

Why this matters: Mobile AI apps face unique threats. A compromised model could exfiltrate contacts via tel: URLs, access health data through HealthKit APIs, or read keychain items. CrustKit's three integration paths let you choose your security/convenience tradeoff, while the DLP engine catches secrets in both directions — AI outputs and user inputs.

Example 2: Custom Security Rules with Progressive Disclosure

Crust's rule system grows with your needs. Start simple, add precision when required:

rules:
  # One-liner: block all .env files anywhere in the filesystem
  # The ** glob matches across directory boundaries
  - block: "**/.env"

  # With exceptions and specific actions
  # Block SSH directory access but allow public keys and known_hosts
  - block: "**/.ssh/*"
    except: ["**/*.pub", "**/known_hosts"]
    actions: [read, copy]  # Only block read and copy, allow listing
    message: "Cannot access SSH directory"

  # Advanced: regex matching on shell commands
  # Catches variations like "rm -rf /", "rm -rf /home", etc.
  - name: block-rm-rf
    match:
      command: "re:rm\\s+-rf\\s+/"
    message: "Blocked: recursive delete from root"

Activate custom rules instantly:

# Hot reload — rules active immediately without restart
crust add-rule my-rules.yaml

Why this matters: The progressive disclosure schema is brilliant for adoption. New users get protection with one-liners. Security teams add granular exceptions without regex hell. And the re: prefix for regex matching catches obfuscated commands that simple string matching would miss — critical when AI agents might be manipulated through prompt injection.

Example 3: Plugin Development in Python

The plugin system enables custom logic in any language. Here's a sandbox plugin from the docs:

# sandbox_plugin.py — restrict file access to project directory
import json
import sys

def handle_evaluate(req):
    """
    req contains: tool_name, paths, command, arguments, rules_snapshot
    Return None to allow, or dict with rule_name/severity/message to block.
    """
    for path in req.get("paths", []):
        # Normalize path and check sandbox boundary
        resolved = os.path.realpath(path)
        if not resolved.startswith("/home/user/project"):
            return {
                "rule_name": "sandbox:fs-deny",
                "severity": "high",
                "message": f"path {path} is outside sandbox"
            }
    return None  # All paths acceptable — allow the operation

# Main loop: read NDJSON from stdin, write responses to stdout
for line in sys.stdin:
    req = json.loads(line)
    result = handle_evaluate(req)
    print(json.dumps(result or {"allow": True}), flush=True)

Why this matters: This architecture is genuinely elegant. The JSON wire protocol means your security team writes plugins in Python for rapid development, while performance-critical paths stay in Go. OS-level process isolation means a plugin crash — infinite loop, memory leak, panic — cannot compromise the main engine. The circuit breaker (3 failures → exponential backoff auto-disable) prevents a buggy plugin from silently disabling your security. And concurrent evaluation with "first-block wins" means multiple plugins don't create latency cascades.

Advanced Usage & Best Practices

Rule Optimization for Performance

Crust's evaluation pipeline completes in microseconds, but rule ordering matters. Place your most frequently hit rules first — the engine short-circuits on first match. Use specific paths over broad globs where possible. The built-in rules are already optimized based on real-world telemetry.

Plugin Development Patterns

• Keep plugins stateless — they may be restarted without warning
• Return quickly — slow plugins block the entire evaluation pipeline
• Use the rules snapshot for consistent policy decisions across plugin restarts
• Test failure modes — simulate crashes to verify circuit breaker behavior

Monitoring and Alerting

# Real-time security event stream
crust logs -f | jq 'select(.severity == "high")'

# Agent discovery for compliance auditing
crust status --agents --json > security_audit.json

Docker Deployment Considerations

When running Crust in containers, mount your rule files as read-only volumes to prevent container escape attacks from modifying security policy. Use network policies to ensure only authorized agents can reach the proxy port.

Comparison with Alternatives

The verdict: Manual configuration fails against unknown threats. Cloud gateways add latency and data sovereignty risks. Traditional WAFs don't understand AI agent semantics. Crust is purpose-built for the AI agent threat model — and it's the only solution that covers the full stack^{↗ Bright Coding Blog} from desktop IDE to mobile app.

FAQ: What Developers Ask About Crust

Does Crust slow down my AI agent interactions?

No perceptible latency. The evaluation pipeline is written in Go with the Green Tea GC, optimized for hot-path performance. Each of the 17 steps completes in microseconds — typically faster than the network round-trip to your LLM provider.

Can AI agents bypass or disable Crust?

No. Crust implements hardcoded self-protection — a pre-filter specifically prevents agents from executing commands that would modify, stop, or reconfigure Crust. This protection is embedded at the engine level, not a rule that could be edited.

What if Crust blocks something legitimate?

Three built-in rules are user-disablable; the remaining 39 are locked for safety. For custom rules, use the except: clause for granular exceptions. The crust logs command shows exactly why each action was blocked, enabling rapid policy tuning.

How does Crust handle my API keys?

Crust passes through your existing authentication — it doesn't need or store your LLM API keys. Its own encryption keys live in your OS keyring (macOS Keychain, Linux Secret Service, Windows Credential Manager), never in environment variables or config files.

Is Crust suitable for enterprise production use?

Yes. With 16 automated security checks per commit, fuzz testing across 46 targets, SAST with gosec and semgrep, secret scanning with gitleaks, and vulnerability checking with govulncheck, Crust meets enterprise security standards. The Elastic License 2.0 permits production use while preventing unauthorized cloud resale.

Can I contribute new security rules?

Absolutely. The project actively welcomes PRs for new security rules. All 42 built-in rules and 51 DLP patterns are open source in internal/rules/builtin/security.yaml and internal/rules/dlp.go.

Does Crust work with my specific AI agent?

If it's OpenAI-compatible — which includes Claude Code, Cursor, Continue, Cline, Windsurf, JetBrains AI, Aider, Zed, Tabby, and dozens more — yes, with a single base URL change. For MCP and ACP protocols, use crust wrap. The auto-detect mode handles unknown protocols intelligently.

Conclusion: The Security Layer AI Agents Should Have Shipped With

Here's the uncomfortable truth: every major AI agent platform has known vulnerabilities. 84 CVEs and counting. Prompt injection that exfiltrates secrets. Config hijacking that escalates privileges. Environment poisoning that persists across sessions. These aren't edge cases — they're the predictable consequence of giving autonomous code unlimited system access.

Crust fixes this architecturally. By inserting a transparent, local, zero-config security gateway between your agents and their capabilities, it transforms an uncontrolled attack surface into an audited, policy-enforced, logged operation. The 17-step evaluation pipeline, 42 built-in rules, 51 DLP patterns, and extensible plugin system provide defense in depth that no single vendor solution matches.

And it takes one command to install.

The future of human-AI collaboration isn't about trusting AI agents with everything — it's about building intelligent boundaries that let agents be helpful without being dangerous. Crust is that boundary. Open source, locally operated, cryptographically hardened, and actively maintained.

Don't wait for your first security incident. Get protected now:

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/BakeLens/crust/main/install.sh)"

Visit github.com/BakeLens/crust to star the project, read the full documentation, and join the community building safer human-AI symbiosis. Your secrets will thank you.

Add the protection badge to your project:

[![Protected by Crust](https://img.shields.io/badge/Protected%20by-Crust-blue)](https://github.com/BakeLens/crust)