Brex Built an Open-Source Proxy to Govern AI Agents at the Network Layer

Quick Facts

• Brex built CrabTrap, an open-source proxy that intercepts all AI agent network traffic and applies policy decisions before requests reach production APIs.
• The LLM judge that evaluates ambiguous requests activates on fewer than 3% of traffic once an agent matures into predictable patterns.
• Enterprise customers using Brex’s AI automation achieved 99% expense automation, up from 60-70% before the launch of Brex Assistant.

Brex has released an open-source tool called CrabTrap that governs AI agents at the network layer rather than the application layer. The HTTP/HTTPS proxy intercepts every outbound agent request, checks it against policy rules, and uses a large language model as a judge to approve or deny traffic before it reaches a live API.

The tool has collected more than 700 stars on GitHub since its release, a response Brex describes as stronger than expected.

The Problem With Existing Guardrails

AI agents need real credentials to function: API keys, OAuth tokens, and service accounts. Brex found that traditional guardrails could not contain what agents were doing with those credentials at scale. The company’s co-founder and CEO Pedro Franceschi told VentureBeat that existing solutions fell into two failure modes.

“The guardrails that actually exist tend to fall into two extremes: either they’re so restrictive the agent can’t do its job, or they’re so bespoke they don’t scale,” Franceschi said. Agents can hallucinate destructive actions or be manipulated through prompt injection, and once a request leaves the process it hits production systems with real consequences.

How CrabTrap Works

CrabTrap operates at the transport layer, making it framework-agnostic, language-agnostic, and API-agnostic. Developers set HTTP_PROXY and HTTPS_PROXY in the agent’s environment, and all outbound traffic routes through the proxy automatically. No SDK wrappers or per-tool integrations are required.

The system uses TLS termination to decrypt requests, then checks them against static URL pattern rules first. If a rule matches, the decision is immediate with no LLM call. Deny rules always take priority. Requests that fall outside known patterns go to an LLM judge, which evaluates them against a natural-language security policy and either forwards the request or returns a 403 with a reason. Every request, decision, and response is logged in PostgreSQL.

By using small, fast models like Claude Haiku for the LLM judge, Brex kept added latency negligible. The judge only activates on fewer than 3% of requests for mature agents, since agents quickly settle into predictable traffic patterns that become static rules.

Observe First, Write Policy Later

The approach Brex used to build its policies was unconventional. Rather than writing rules before deployment, the team watched what agents actually did and derived policy from observed behavior.

“Our key insight was to bootstrap policy from observed behavior rather than write it from scratch,” Franceschi said. “Starting from real behavior and editing down based on real-world learnings turned out to be dramatically more effective than starting from a blank page.”

Brex built a policy builder that runs agents in shadow mode, analyzes historic network traffic, samples representative calls, and drafts a natural-language policy to match actual agent behavior. Pointing the tool at a few days of real traffic produced policies that matched human judgment on the vast majority of held-out requests.

Business Results

Brex’s broader AI automation push has produced measurable results for customers. In 2025, its AI-powered systems reclaimed more than 208,000 hours per month for customers, which the company estimates equals more than $163 million in annual salary costs previously spent on manual work. Enterprise customers using Brex Assistant reached 99% expense automation, a significant jump from the 60% to 70% rate before the assistant launched.

Franceschi’s advice to other enterprise leaders is direct. “Don’t let infrastructure gaps become excuses to wait,” he said. “Instead of waiting for the industry to catch up, we decided to own the problem and invent the necessary tools.”

Read more: Brex built its AI agent policy by watching what agents actually do, not by writing rules first