CrabTrap Repo Analysis

analyze this repo, and write a post about it: https://github.com/brexhq/CrabTrap

Here’s a post in your preferred slightly sharp, systems-aware tone—grounded in what the repo actually is doing. --- ## CrabTrap: The moment we admitted agents can’t be trusted There’s a very specific point every “AI agents in production” project hits. It’s not when the agent works. It’s when the agent works **too well**—with real credentials, real APIs, and real consequences. That’s the moment you realize: you didn’t build a tool. You gave a stochastic process a credit card and a network pipe. Enter entity["company","Brex","fintech company"]’s **CrabTrap**. --- ## What it actually is (not the marketing version) CrabTrap is an HTTP/HTTPS proxy that sits between your agent and the outside world. Every single outbound request: - gets intercepted - evaluated against policy - and either **allowed or blocked in real time** citeturn0search1 Think of it less like middleware and more like a **network choke point with opinions**. Under the hood: - It MITMs traffic (yes, full TLS interception) - It inspects the full request payload - It decides: *does this request align with what this agent is supposed to do?* citeturn0search2 If yes → forward If no → kill it --- ## The interesting part: the “judge” CrabTrap splits decision-making into two layers: ### 1. Deterministic rules (fast, boring, necessary) - URL patterns - HTTP methods - allowlists / blocklists This handles the obvious stuff quickly. ### 2. LLM-as-a-judge (slow, contextual, dangerous) If no rule matches, the request gets passed to an LLM with a policy prompt. The model decides: > “Is this request aligned with the agent’s role?” Then returns: - ALLOW - or DENY (+ reasoning) This hybrid design exists because: - Pure rules are too rigid - Pure LLM is too unpredictable So they built a **two-stage filter: syntax first, semantics second**. --- ## Why this exists (and why it matters) Brex didn’t build this as a toy. They were running agents doing: - expense auditing - financial reconciliation - API calls into systems like accounting and banking And they hit the core problem: > Hard rules block valid behavior. > No rules allow catastrophic behavior. So CrabTrap becomes the compromise: - Let agents explore - But intercept consequences --- ## The deeper idea: agents need an “egress firewall” Most current “AI safety” lives in the wrong place: - prompt engineering - tool wrappers - model-level guardrails CrabTrap moves safety to where it actually matters: > **the network boundary** Because once an agent can: - send HTTP requests - hit internal APIs - mutate real systems …it doesn’t matter how polite your prompt was. --- ## What’s actually impressive There are three design decisions here that signal this isn’t just a hackathon repo: ### 1. Policy is learned from traffic Instead of writing policies from scratch, you: - observe real agent traffic - generate policies from it - replay logs to test changes That’s **security as an iterative system**, not a config file. --- ### 2. The LLM is used sparingly In practice, the LLM only handles a small percentage of requests (long tail cases). That’s key: - cost stays reasonable - latency stays predictable - behavior stabilizes over time --- ### 3. It assumes agents will misbehave Not “might.” **Will.** So it builds in: - rate limiting - SSRF protection - audit logging - circuit breakers This is not optimism. This is containment. --- ## The uncomfortable tradeoff To do its job, CrabTrap: - decrypts everything - sees all headers - sees all tokens That means: > Your “security layer” becomes your most sensitive system. You’ve effectively centralized trust into the proxy. This is not a bug. It’s the cost of visibility. --- ## The real criticism (and it’s valid) Using an LLM as a security decision-maker is… questionable. Security systems traditionally rely on: - determinism - guarantees - explicit constraints CrabTrap introduces: - probability - interpretation - ambiguity Critics are right to ask: > What happens when the judge is wrong? Because now your guardrail is: - jailbreakable - prompt-influenceable - non-deterministic You didn’t eliminate risk. You changed its shape. --- ## The bigger picture CrabTrap quietly defines a new architecture layer: > **Agent Runtime ≠ Agent Safety** You now need: - The agent (decision-making) - The tools (capabilities) - The proxy (enforcement) Or more bluntly: > The agent is the brain > The tools are the hands > CrabTrap is the cage --- ## Why this repo matters This isn’t just another GitHub project. It’s an admission: > We are officially past the point where agents can be trusted with direct access to systems. And instead of solving that at the model level, they solved it at the **network layer**. That’s a big shift. --- ## Final take CrabTrap is not perfect. It’s not even philosophically clean. But it’s practical. And right now, practicality is winning. Because if you’re running agents in production without something like this… you’re not building AI systems. You’re just hoping they behave.

now this: https://blog.google/innovation-and-ai/models-and-research/google-labs/stitch-design-md/?utm_source=tldrai

Here’s the post—same tone, but tuned to what Google is *actually* doing with Stitch + `DESIGN.md`. --- ## DESIGN.md: Google just quietly replaced your design team with a text file There’s a shift happening in UI design, and it’s not subtle. We didn’t just move from Figma → AI. We moved from: > “design is visual” to: > **“design is a specification language.”** Google’s Stitch—and specifically `DESIGN.md`—is that shift made explicit. --- ## What Stitch actually is (strip the hype) entity["company","Google","technology company"]’s Stitch isn’t trying to be: - an IDE - a chatbot - or even a design tool in the traditional sense It’s a **UI generation surface**: - prompt → interface - image → interface - idea → interface …and it outputs: - structured UI - HTML / CSS / React - something dangerously close to production-ready frontend citeturn0search1turn0search3 This matters, but it’s not the real story. --- ## The real story is DESIGN.md Buried in the update is the most important piece: > `DESIGN.md` A markdown file that encodes: - colors - typography - spacing - components - layout rules In other words: > **your entire design system… as text** citeturn0search2 --- ## Why this is different (and slightly unsettling) Traditionally, design systems live in: - Figma files - Storybook - human brains (mostly) They are: - visual - interpretive - slightly inconsistent `DESIGN.md` flips that: > design becomes **machine-readable first, human-readable second** It’s not documentation. It’s **input**. --- ## What Stitch is really building Google is quietly assembling a pipeline: ``` Intent → UI → Design System → Code ↑ DESIGN.md ``` Instead of: - designers defining systems - developers interpreting them You now get: - AI generates UI - AI extracts system - AI reuses system Loop closed. --- ## This is “vibe design,” but with constraints Google calls this “vibe design”: - describe intent - generate UI - iterate conversationally citeturn0search0 That sounds loose and creative. But `DESIGN.md` is the opposite: > it **locks the vibe into rules** So the system can: - stay consistent - scale across screens - avoid “AI mush UI” --- ## The subtle power move Here’s what most people miss: `DESIGN.md` is not for you. It’s for: - agents - code generators - pipelines It’s an **intermediate representation**. Like: - `package.json` for dependencies - `schema.sql` for databases Now we have: > **`design.md` for interfaces** --- ## Why developers should care (more than designers) If you’re building with AI: This kills a major bottleneck: - “make it consistent with the rest of the app” Now you can: 1. Extract design system from an existing site 2. Store it as `DESIGN.md` 3. Feed it into any generation step Result: - same buttons - same spacing - same visual language Every time. --- ## The uncomfortable implication Design used to be: > interpretation Now it’s becoming: > constraint satisfaction That’s a big philosophical shift. Because it means: > the “designer” is slowly being replaced by > whoever controls the system definition --- ## The criticism (and it’s valid) There are cracks already: - It’s not truly open (yet) - Likely tied to Stitch ecosystem - Might oversimplify real design systems - Risks homogenizing UI across products Even devs are already asking: > is this a standard—or just another silo? citeturn0reddit18 And they’re right to be skeptical. --- ## Where this fits in the stack Think about what you now have: - Prompt → generates UI - Proxy (like CrabTrap) → controls behavior - `DESIGN.md` → controls appearance We’re building: > **fully programmable software creation pipelines** Where: - logic is generated - UI is generated - constraints are encoded --- ## The real takeaway CrabTrap solved: > “agents shouldn’t be trusted with actions” Stitch is solving: > **“agents shouldn’t improvise design”** So we constrain them with a spec. --- ## Final take `DESIGN.md` looks boring. It’s just markdown. But it represents a bigger shift: > Design is no longer a craft artifact. > It’s becoming a **portable, executable contract**. And once design becomes code-adjacent… it stops belonging exclusively to designers.

now this: https://blog.google/innovation-and-ai/models-and-research/gemini-models/next-generation-gemini-deep-research/?utm_source=tldrai

Here’s the post—same tone, but now we’re dealing with something more dangerous than UI or proxies: This is Google trying to automate **thinking itself**. --- ## Gemini Deep Research: Google is building a junior analyst that doesn’t get tired There’s a quiet rebranding happening in AI. We used to say: > “chatbots” Then: > “assistants” Now Google is saying it out loud: > **“research agents.”** Not tools. Not copilots. Agents that **plan, execute, and synthesize work**. That’s what the new Gemini Deep Research is. --- ## What it actually does (strip the announcement voice) The new system—built on **Gemini 3.1 Pro**—is designed for: - long-horizon research - multi-step reasoning - pulling from web + private data - producing structured, cited outputs Not a paragraph. A **report**. citeturn0search0turn0search7 And crucially: > it doesn’t just answer questions > it **runs a research process** --- ## The upgrade: from “search” to “workflow” Google is pushing three key upgrades here: ### 1. Autonomous planning The agent: - breaks a problem into steps - decides what to search - iterates until it has something coherent This is not prompting anymore. This is: > **task decomposition as a first-class feature** --- ### 2. Native visualizations Outputs now include: - charts - diagrams - structured visual summaries So instead of: > “here’s 2,000 words” You get: > **“here’s the argument, and here’s what it looks like”** citeturn0search0turn0search11 --- ### 3. MCP + tool integration Google is aligning this with agent ecosystems: - external tools - custom data sources - programmable workflows Meaning: > this is not a feature > it’s infrastructure --- ## The real shift: answers → synthesis Old model: - ask question - get response Deep Research model: - define problem - get investigation It: - reads dozens or hundreds of sources - cross-references - builds a structured output The goal is not correctness at the sentence level. It’s: > **coherence at the system level** --- ## This connects to everything else you’ve been looking at Let’s tie it together: - **CrabTrap** → constrains agent actions - **DESIGN.md** → constrains agent output (UI) - **Deep Research** → scales agent cognition Put differently: > we now have agents that can > think, act, and build And we’re scrambling to: - monitor them - constrain them - structure them --- ## The subtle but important detail Deep Research can pull from: - the open web - your internal data (Docs, Drive, etc.) citeturn0search9 That means: > your “research agent” is now context-aware > in a way no human analyst ever was It doesn’t forget: - prior reports - internal documents - preferences Unless you force it to. --- ## The uncomfortable part (again) This sounds incredible. It is. But there are cracks: ### 1. You don’t see the full reasoning You get: - outputs - summaries Not necessarily: - every decision step - every discarded path So: > you’re trusting a process you didn’t observe --- ### 2. It optimizes for completeness, not truth An agent that: - reads 100 sources - synthesizes them …can still: - overweight bad data - converge on confident nonsense Just at a higher level. --- ### 3. It blurs authorship Who wrote the report? - You? (you asked) - The model? (it synthesized) - The sources? (it recombined) Answer: > yes --- ## What Google is really building This is not “better search.” This is: > **knowledge work automation** The target isn’t: - casual users It’s: - analysts - researchers - consultants - anyone paid to “figure things out” --- ## The deeper pattern Google is converging on a stack: ### Cognition layer → Deep Research (thinking) ### Interface layer → Stitch / DESIGN.md (building) ### Execution layer → agents + tools ### Control layer → (what CrabTrap represents externally) --- ## Where this goes next Right now: - you ask for a report Soon: - the agent updates it continuously - tracks changes in the world - alerts you when assumptions break At that point: > it’s not research anymore > it’s **persistent intelligence** --- ## Final take Deep Research isn’t flashy. No viral demos. No “look at this image” moment. But it’s more important than most model upgrades. Because it changes the unit of output from: > “an answer” to: > **“a completed piece of thinking.”** And once AI can reliably produce that… you’re no longer using tools. You’re managing minds.