Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
An LLM-as-a-judge HTTP proxy to secure agents in production
| Date | Stars |
|---|---|
| 2026-07-31 | 715 |
| 2026-08-04 | 722 |
| 2026-08-06 | 722 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
15.0
growth rate 0.00%/day
# CrabTrap
<p align="center">
<img src="assets/logo.png" alt="CrabTrap logo" width="600" />
</p>
An HTTP/HTTPS proxy that sits between AI agents and external APIs, evaluating every outbound request against security policies before it reaches the internet.
If you run AI agents that call external services — Slack, Gmail, GitHub, or anything else — CrabTrap gives you guardrails. It intercepts every outbound HTTP/HTTPS request, checks it against deterministic rules and an LLM-based policy judge, and either forwards it or blocks it with a reason. Every request and decision is logged to PostgreSQL for a complete audit trail.
<p align="center">
<img src="docs/crabtrap-flow.svg" alt="CrabTrap request flow" width="800" />
</p>
## Quickstart
CrabTrap runs as a Docker container alongside PostgreSQL. See [QUICKSTART.md](QUICKSTART.md) for the full walkthrough — the short version:
```bash
docker compose up -d # start CrabTrap + Postgres
docker compose cp crabtrap:/app/certs/ca.crt ./ca.crt # copy the generated CA cert
# create test-admin admin user and store their web_token in a variable
admin_token=$(docker compose exec -it crabtrap ./gateway create-admin-user test-admin \
| tail -n1 | cut -d" " -f2)
token=$(curl -X POST http://localhost:8081/admin/users \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${admin_token}" \
-d '{"id": "[email protected]", "is_admin": false}' \
| jq -r '.channels[] | select(.channel_type == "gateway_auth") | .gateway_auth_token')
# test with
curl -x http://${token}:@localhost:8080 \
--cacert ca.crt https://httpbin.org/get
```
The proxy listens on `localhost:8080`, the admin UI is at `localhost:8081` and you can login to it with the $admin_token.
## How It Works
1. **Agent connects** — set `HTTP_PROXY` and `HTTPS_PROXY` to point at CrabTrap
2. **TLS termination** — CrabTrap generates a per-host certificate from a custom CA and decrypts the request
3. **Static rules** — the request is matched against URL pattern rules (prefix, exact, or glob). If a rule matches, the decision is immediate — no LLM call. Deny rules always take priority over allow.
4. **LLM judge** — if no static rule matches, the request is evaluated by an LLM against the agent's natural-language security policy. Allowed requests are forwarded; denied requests get a 403 with the reason.
5. **Audit logged** — every request, decision, and response is recorded in PostgreSQL
## Features
### Security
- **HTTPS interception** — transparent MITM proxy with custom TLS server certificate generation
- **SSRF protection** — blocks requests to private networks (RFC 1918, loopback, link-local, Carrier-Grade NAT, IPv6 ULA/NAT64/6to4) with DNS-rebinding prevention
- **Prompt injection defense** — request payloads are JSON-encoded and policy content is JSON-escaped before being sent to the LLM judge
- **Per-IP rate limiting** — token bucket rate limiter (default 50 req/s, burst 100)
### Policy Evaluation
- **Two-tier evaluation** — deterministic static rules are checked first; the LLM judge is only invoked if no rule matches
- **Static rules** — prefix, exact, and glob URL pattern matching with optional HTTP method filters
- **Per-agent LLM policies** — natural-language security policies evaluated via LLM
- **Circuit breaker** — trips after 5 consecutive LLM failures, reopens after 10s cooldown
- **Configurable fallback** — deny (default) or passthrough when the LLM judge is unavailable
### Operations
- **Policy builder** — an agentic loop that analyzes observed traffic and drafts security policies automatically
- **Eval system** — replay historical audit log entries against a policy to measure accuracy
- **Denial alerting** — notifies bot managers when a new URL pattern is denied, deduped with configurable cooldown. See [docs/alerting.md](docs/alerting.md).
- **Web UI** — audit trail viewer, policy editor, eval results, and agent maExcerpt of 9,818 characters
Read on GitHub
6
6
4
2
Matt Van Horn
2
1
1
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:c4eb9a901c25019a, desc:llm-as-a-judge