PAGES
← all tools
◆ AI Runtime Defense & Guardrails

crust

v4.4.0 open-source

Crust is a transparent, local gateway between AI agents and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers that intercepts tool calls and blocks dangerous actions before they execute.

source ↗ website ↗ rss ↗ What is a cyber toolchain?

Summary

crust is an open-source gateway, licensed under Elastic License 2.0, that sits between AI agents and LLM providers and blocks dangerous tool calls — file reads, shell commands, network requests — before they execute. It runs as a local command-line install (a single script sets up the proxy), acting as a transparent gateway rather than a hosted service, and the vendor stresses that data never leaves the machine. It's aimed at teams building or operating AI agents who need runtime guardrails against destructive or unauthorized actions, wrapping MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. or ACP agents directly with no code changes. A paid Crust Pro tier exists for enterprise features, but the core gateway is free to run yourself. With 6 contributors, 435 commits and 10 releases in the past year, and a first commit in 2026, it's an active, very young project.

Crust is a transparent, local gateway between AI agents and LLM providers that intercepts tool calls and blocks dangerous actions before they execute.

How crust helps

Which shell commands is an agent about to run before they hit my system?

intercepts every tool call at the gateway and blocks the ones matching destructive or unauthorized patterns before they execute, so the command never reaches the shell

Which file reads should an agent never be allowed to make?

sits transparently between the agent and the LLM provider and stops file-read tool calls that match its rules, without requiring any change to the agent's code

Is an agent already wrapped and protected right now?

reports which running agents are detected and their current protection status, so you can confirm a given agent isn't running unguarded

What did an agent actually try to do during a session?

follows live activity logs of every tool call passing through the gateway, giving a real-time record of what was requested and what was blocked

Can I stop a new kind of dangerous call without restarting everything?

lets you add custom rules that hot-reload into the running gateway, so newly written checks take effect without dropping the current session

Does my agent's traffic ever leave my machine?

runs entirely as a local proxy between the agent and the LLM provider, so tool-call interception and blocking happen on-machine rather than through a hosted service

Languages

Not documented

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for crust, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail crust puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

17 entries

  1. March 20268
  10. February 20269
    Show

    17 entries

    1. v4.4.0 Mar 24, 2026 · release notes

      Crust v4.4.0 adds in-memory EvalLog reload and a plugin Executor interface

      └──▷ GET THIS VERSION 
      $ git clone --branch v4.4.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v4.4.0
      • Adds In-memory EvalLog to libcrust, allowing rule changes to take effect immediately without restart.
      • Introduces the Executor interface for the plugin system, enabling process-level enforcement capabilities.

      2 details in Everything

    2. v4.3.0 Mar 20, 2026 · release notes

      Crust v4.3.0 introduces unified crust wrap stdio proxy, new detection rules for Cursor/Codex/Roo, and subcommand consolidation.

      └──▷ GET THIS VERSION 
      $ git clone --branch v4.3.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v4.3.0
      • crust wrap handles all stdio proxy modes (ACP + MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. auto-detection) via single command
      • Adds protection rules for .cursor/cli.json, .codex/config.toml, .roo/mcp.json, and *.code-workspace files
      • New status --agents subcommand to view agent status
      • New list-rules --reload subcommand to manage rule reloading
      • CVE tracker expanded to cover 45 real-world vulnerabilities including Cursor workspace RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., Codex CLI config injection, and Roo Code config poisoning

      5 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Removed redundant acp-wrap, mcp gateway, agents, and reload-rules subcommands; use crust wrap and list-rules --reload instead
    3. v4.2.0 Mar 18, 2026 · release notes

      crust v4.2.0 adds libcrust CGO FFI, crust agents CLI, fast TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. hook eval, and /api/security/plugins API

      └──▷ GET THIS VERSION 
      $ git clone --branch v4.2.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v4.2.0
      └──▷ TRY IT
      Get the current status of all loaded security plugins programmatically.
      $ curl http://localhost:8080/api/security/plugins
      Detect which AI coding agents are currently running and check their protection status.
      $ crust agents
      • Adds GET /api/security/plugins endpoint to expose plugin statistics
      • Introduces crust agents subcommand to scan for AI coding agent processes
      • Adds libcrust CGO FFI exports for embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. daemon functionality in native GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. apps
      • Enables fast hook evaluation via a raw TCP socket to the running daemon

      4 details in Everything

    4. v4.1.0 Mar 15, 2026 · release notes

      v4.1.0 adds iOS/CrustKit SDK, DNS loopback detection (Step 4), text DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. auto-redaction, and URL scheme validation.

      └──▷ GET THIS VERSION 
      $ git clone --branch v4.1.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v4.1.0
      • Adds CrustKit Swift SDK with CrustEngine, CrustURLProtocol, and async variants for iOS/Android via gomobile
      • Adds DNS-based loopback detection (Step 4) blocking custom domains pointing to 127.0.0.0/8 or ::1 targeting the management API
      • Adds text DLP auto-redaction for leaked secrets in Anthropic, OpenAI, and OpenAI Responses responses
      • Adds mobile content scanning API exposing scanContent(), scanOutbound(), validateURL(), and scanClipboard()
      • Adds URL scheme validation blocking dangerous schemes including tel:, sms:, facetime:, itms-services:, and app-settings:

      5 details in Everything

    5. v4.0.0 Mar 12, 2026 · release notes

      crust v4.0 introduces a late-stage plugin system with JSON wire protocol and in-process DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./secret detection.

      └──▷ GET THIS VERSION 
      $ git clone --branch v4.0.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v4.0.0
      • Adds a late-stage plugin system supporting the JSON wire protocol, crash isolation, and circuit breaker logic
      • Adds a Sandbox plugin exposing an Exec method for integration with bakelens-sandbox
      • Integrates gitleaks as an in-process Go library for DLP and secret detection without subprocess overhead
      • Adds a stats aggregation API and a new Stats tab to the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency.

      4 details in Everything

    6. v3.2.0 Mar 8, 2026 · release notes

      crust v3.2.0 adds multilingual DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. installer, WS MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway, and agent scan

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.2.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v3.2.0
      └──▷ USE IT
      Check if any local services are exposing unguarded AI agents
      shell 
      crust doctor agent scan
      • Adds BIP39 multilingual DLP detection for Chinese Simplified/Traditional, Czech, English, French, Italian, Japanese, Korean, Portuguese, and Spanish mnemonic seed phrases
      • Adds shell extractor support for Windows cmd.exe-style %VAR% environment variable expansion
      • Adds CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. origin validation to the MCP HTTP gateway with malformed Referer fallback handling
      • Adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. reverse proxy support to the MCP gateway with origin validation
      • Adds crust doctor command to detect unguarded AI agent servers on localhost
      +2 more show less
      • Adds TUI installer for interactive installation with progress display and dependency auto-install
      • Adds --purge flag to uninstall script for non-interactive full data wipe while preserving user-authored rules in rules.d

      7 details in Everything

    7. v3.1.0 Mar 5, 2026 · release notes

      crust v3.1.0 adds PowerShell worker, .NET API detection, and multi-operation command classification

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.1.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v3.1.0
      • Adds persistent PowerShell (pwsh) worker with dual-parse architecture to detect static method calls like [System.Net.WebClient]::new() that the bash parser misses
      • Adds -EncodedCommand support using a temporary file to bypass the Windows 8191-character command-line limit
      • Adds Host extraction gate for network tools (socat, nc, ncat, netcat) to extract hostnames even when their primary operation is execution
      • Adds multi-operation classification via CommandInfo.ExtraOps []Operation allowing rules to match commands with multiple capabilities (e.g., vim as [OpRead, OpWrite])

      4 details in Everything

    8. v3.0.0 Mar 4, 2026 · release notes

      crust v3.0.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. namespace (crust mcp/mcp-discover/mcp-http), OS keyring storage, and locked rules.

      └──▷ GET THIS VERSION 
      $ git clone --branch v3.0.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v3.0.0
      └──▷ TRY IT
      Launch the unified MCP gateway to connect your cyber toolchain to agents like Claude or Cursor.
      $ crust mcp
      Auto-configure local agents by discovering installed servers and patching their config files automatically.
      $ crust mcp-discover
      Expose MCP capabilities via a Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. endpoint for external integration.
      $ crust mcp-http
      • crust mcp unifies the MCP gateway under a single command namespace
      • crust mcp-http provides an MCP Streamable HTTP gateway
      • OS keyring secret storage with file fallback (macOS Keychain, Windows DPAPIDPAPIA Windows OS cryptographic API that encrypts and decrypts secrets tied to a user or machine identity, so applications can store credentials without managing raw keys themselves., Linux Secret Service) and env var fallback
      • Locked rules survive --disable-builtin, protecting self-management endpoints and git hooks
      • 4 new builtin locked rules: protect-system-config, protect-persistence, block-reverse-shell, block-ssrf-metadata
      +2 more show less
      • $HOME expansion in YAML rule patterns
      • Atomic file lock-on-open (O_EXLOCK/O_SHLOCK) eliminating TOCTOU on rule file reads/writes

      7 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !crust mcp-gateway has been renamed to crust mcp
    9. v2.5.0 Feb 28, 2026 · release notes

      crust v2.5.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface./ACP proxy gateways, crypto wallet DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., and hybrid shell extraction

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.5.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v2.5.0
      • crust mcp-gateway subcommand as a stdio proxy for MCP servers with rule engine evaluation
      • crust wrap auto-detect proxy supporting both MCP and ACP protocols
      • Response DLP scanning intercepts secrets in MCP/ACP server and agent responses before they reach the client
      • DLP detection of JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. error response fields
      • Crypto wallet DLP covering BIP39 mnemonics, xprv/yprv/zprv/tprv private keys (base58check), and WIFWIFWorkload Identity Federation is a Google Cloud mechanism that lets external workloads authenticate to Google APIs using short-lived tokens from a trusted identity provider, eliminating the need to manage long-lived service account keys. keys (checksum+version)
      +3 more show less
      • Hardcoded wallet path blocking for 16 chains including Bitcoin, Ethereum, and Solana
      • DLP token patterns expanded from 19 to 34 with support for HuggingFace, Groq, Vercel, Supabase, DigitalOcean, Vault, Linear, Postman, Replicate, Twilio, Doppler, Firebase, and more
      • Hybrid interpreter+ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text. shell extraction mode for higher path coverage in mixed shell scripts

      8 details in Everything

    10. v2.4.0 Feb 26, 2026 · release notes

      crust v2.4.0 introduces ACP stdio proxy wrapper and doctor diagnostic command

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.4.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v2.4.0
      └──▷ USE IT
      Wrap a local agent to intercept file system and terminal actions before the IDE executes them.
      shell 
      crust acp-wrap --agent goose
      Check connectivity to your provider endpoints and generate a sanitized report for bug filing.
      shell 
      crust doctor --report
      • crust acp-wrap wraps any ACP-compatible agent as a transparent security proxy, intercepting fs/read_text_file, fs/write_text_file, and terminal/create before IDE execution.
      • crust doctor command diagnoses provider endpoint connectivity with concurrent checks, proxy support, and --report flag for sanitized GitHub issue reports.

      2 details in Everything

    11. v2.3.0 Feb 24, 2026 · release notes

      Adds hardcoded content-based DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. token detection with optional gitleaks integration

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.3.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v2.3.0
      • Adds dlp.go and dlp_scanner.go implementing Tier 2 scanning with hardcoded content-based patterns for AWS, GitHub, Stripe, OpenAI, Anthropic, etc.

      1 detail in Everything

    12. v2.2.0 Feb 21, 2026 · release notes

      Crust v2.2.0 adds env-var expansion for provider API keys and remote TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. via management API

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.2.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v2.2.0
      • api_key in config.yaml now supports $VAR/${VAR} expansion for per-provider secrets
      • Remote dashboard access via the management API exposed on the proxy port

      2 details in Everything

    13. v2.1.0 Feb 20, 2026 · release notes

      Crust v2.1.0 adds containerization support with --foreground and --listen-address flags

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.1.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v2.1.0
      └──▷ USE IT
      Run Crust as a long-running foreground process inside a Docker container.
      shell 
      crust --foreground --listen-address 0.0.0.0
      • Adds --foreground flag to run the Crust server in the foreground for use as PID 1 in containers
      • Adds --listen-address flag to override the proxy bind address (default 127.0.0.1) and allow external traffic

      2 details in Everything

    14. v2.0.0 Feb 20, 2026 · release notes

      Crust v2.0 introduces PowerShell evasion detection, Unix domain socket management API, concurrent sessions dashboard, and formal Windows/FreeBSD support.

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.0.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v2.0.0
      └──▷ TRY IT
      Fetch per-session telemetry stats from the new management API.
      $ curl --unix-socket ~/.crust/crust-api-8080.sock http://localhost/api/telemetry/sessions
      Monitor live blocked/allowed events in the split-pane UI.
      $ crust status --live
      • Adds PowerShell evasion detection: recursively parses -Command "..." and pwsh -c "..." inner commands; decodes -EncodedCommand base64 UTF-16LE payloads and flags them as evasive
      • Adds new management API endpoints: GET /api/telemetry/sessions and /api/telemetry/sessions/:id/events for per-session stats and event logs
      • Adds concurrent sessions dashboard accessible via crust status --live, replacing the previous single-overview view with a split-pane session list and event log
      • Adds formal Windows support: native Windows daemon, named pipe management API, PowerShell command extraction, LOLBASLOLBASLiving Off the Land Binaries and Scripts — legitimate Windows executables and scripts that attackers abuse to run malicious code, letting cyber tools detect or emulate attacker behavior without custom malware. entries, and backslash path normalization
      • Adds formal FreeBSD support with Unix socket management API and flock-based liveness checks
      +1 more show less
      • Replaces TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. management API with Unix domain sockets at ~/.crust/crust-api-{port}.sock for kernel-enforced access control

      6 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The management API is no longer available over TCP; it is now only exposed via Unix domain sockets (~/.crust/crust-api-{port}.sock) or Windows named pipes
      • !Clients must now support the new MessageRole enum and named API protocol constants instead of raw strings
    15. v1.1.1 Feb 8, 2026 · release notes

      crust v1.1.1 adds web_search and browser tool support for OpNetwork extraction.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1.1 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v1.1.1
      └──▷ USE IT
      Extract browser and search activities for network analysis.
      shell 
      crust extract --tools web_search,browser
    16. v1.1.0 Feb 8, 2026 · release notes

      crust v1.1.0 adds BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. deny-list, intent-aware Landlock mode, and multi-provider proxy support

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v1.1.0
      • Adds install_openclaw.sh install script with binary release support
      • Adds BPF deny-list layer using eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. loader and client (Linux)
      • Added intent-aware Landlock mode derivation from security rules
      • Refactored macOS Seatbelt execution to use JSON policy on stdin
      • Added multi-provider proxy support with provider auto-detection
      +2 more show less
      • Added BPF helper systemd service unit
      • Adds GoReleaser config for automated multi-platform binary builds supporting linux/amd64, linux/arm64, darwin/amd64, and darwin/arm64

      7 details in Everything

    17. v1.0.0 Feb 3, 2026 · release notes

      crust v1.0.0 is a new transparent gateway that intercepts and blocks dangerous LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. tool_calls using Layer 0/1 scanning and OS-level sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls..

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.0.0 https://github.com/BakeLens/crust.git
# already have the repo? check out this version:
$ git checkout v1.0.0
      └──▷ USE IT
      Deploy the gateway to intercept LLM traffic on localhost:9090.
      shell 
      agentshepherd start
      • Adds Layer 0 request-side scanning of tool_calls in conversation history to block dangerous actions before they happen
      • Adds Layer 1 response-side scanning of LLM-generated tool_calls to intercept threats after generation
      • Adds Layer 2 OS-level sandboxing using Landlock/Seatbelt policies
      • Includes 57 built-in security rules with a progressive disclosure schema
      • Supports hot-reload for rule configuration without service restart

      5 details in Everything

    Project health

    Issue, contributor and maintainer activity in BakeLens/crust, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 4 +4 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 1.7 days first maintainer reply 11 hours
    6. Open backlog 0 of 7 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 0
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 439
    Issue themes, last 12 months
    • bugs 29%
    • features 43%
    • other 28%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback