https://cybertoolchain.io/tools/crust New releases and features in crust, tracked by The Cyber Toolchain. en Tue, 24 Mar 2026 01:26:45 GMT https://github.com/BakeLens/crust/releases/tag/v4.4.0 https://github.com/BakeLens/crust/releases/tag/v4.4.0 Tue, 24 Mar 2026 01:26:45 GMT Crust v4.4.0 adds in-memory EvalLog reload and a plugin Executor interface • Adds `In-memory EvalLog` to `libcrust`, allowing rule changes to take effect immediately without restart. • Introduces the `Executor` interface for the plugin system, enabling process-level enforcement capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crust https://github.com/BakeLens/crust/releases/tag/v4.3.0 https://github.com/BakeLens/crust/releases/tag/v4.3.0 Fri, 20 Mar 2026 13:27:43 GMT Crust v4.3.0 introduces unified `crust wrap` stdio proxy, new detection rules for Cursor/Codex/Roo, and subcommand consolidation. • `crust wrap` handles all stdio proxy modes (ACP + MCP auto-detection) via single command • Adds protection rules for `.cursor/cli.json`, `.codex/config.toml`, `.roo/mcp.json`, and `*.code-workspace` files • New `status --agents` subcommand to view agent status • New `list-rules --reload` subcommand to manage rule reloading • CVE tracker expanded to cover 45 real-world vulnerabilities including Cursor workspace RCE, Codex CLI config injection, and Roo Code config poisoning Breaking changes: • Removed redundant `acp-wrap`, `mcp gateway`, `agents`, and `reload-rules` subcommands; use `crust wrap` and `list-rules --reload` instead Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crust https://github.com/BakeLens/crust/releases/tag/v3.1.0 https://github.com/BakeLens/crust/releases/tag/v3.1.0 Thu, 05 Mar 2026 13:28:34 GMT crust v3.1.0 adds PowerShell worker, .NET API detection, and multi-operation command classification • Adds persistent PowerShell (`pwsh`) worker with dual-parse architecture to detect static method calls like [System.Net.WebClient]::new() that the bash parser misses • Adds `-EncodedCommand` support using a temporary file to bypass the Windows 8191-character command-line limit • Adds `Host extraction gate` for network tools (`socat`, `nc`, `ncat`, `netcat`) to extract hostnames even when their primary operation is execution • Adds multi-operation classification via `CommandInfo.ExtraOps []Operation` allowing rules to match commands with multiple capabilities (e.g., `vim` as `[OpRead, OpWrite]`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crust https://github.com/BakeLens/crust/releases/tag/v2.5.0 https://github.com/BakeLens/crust/releases/tag/v2.5.0 Sat, 28 Feb 2026 08:10:01 GMT crust v2.5.0 adds MCP/ACP proxy gateways, crypto wallet DLP, and hybrid shell extraction • `crust mcp-gateway` subcommand as a stdio proxy for MCP servers with rule engine evaluation • `crust wrap` auto-detect proxy supporting both MCP and ACP protocols • Response DLP scanning intercepts secrets in MCP/ACP server and agent responses before they reach the client • DLP detection of JSON-RPC error response fields • Crypto wallet DLP covering BIP39 mnemonics, xprv/yprv/zprv/tprv private keys (base58check), and WIF keys (checksum+version) • Hardcoded wallet path blocking for 16 chains including Bitcoin, Ethereum, and Solana • DLP token patterns expanded from 19 to 34 with support for HuggingFace, Groq, Vercel, Supabase, DigitalOcean, Vault, Linear, Postman, Replicate, Twilio, Doppler, Firebase, and more • Hybrid interpreter+AST shell extraction mode for higher path coverage in mixed shell scripts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crust https://github.com/BakeLens/crust/releases/tag/v2.4.0 https://github.com/BakeLens/crust/releases/tag/v2.4.0 Thu, 26 Feb 2026 13:47:06 GMT crust v2.4.0 introduces ACP stdio proxy wrapper and doctor diagnostic command • `crust acp-wrap` wraps any ACP-compatible agent as a transparent security proxy, intercepting `fs/read_text_file`, `fs/write_text_file`, and `terminal/create` before IDE execution. • `crust doctor` command diagnoses provider endpoint connectivity with concurrent checks, proxy support, and `--report` flag for sanitized GitHub issue reports. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crust https://github.com/BakeLens/crust/releases/tag/v2.3.0 https://github.com/BakeLens/crust/releases/tag/v2.3.0 Tue, 24 Feb 2026 08:51:27 GMT Adds hardcoded content-based DLP token detection with optional gitleaks integration • Adds `dlp.go` and `dlp_scanner.go` implementing Tier 2 scanning with hardcoded content-based patterns for AWS, GitHub, Stripe, OpenAI, Anthropic, etc. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crust https://github.com/BakeLens/crust/releases/tag/v2.2.0 https://github.com/BakeLens/crust/releases/tag/v2.2.0 Sat, 21 Feb 2026 15:11:55 GMT Crust v2.2.0 adds env-var expansion for provider API keys and remote TUI via management API • `api_key` in `config.yaml` now supports `$VAR`/`${VAR}` expansion for per-provider secrets • Remote dashboard access via the management API exposed on the proxy port Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crust https://github.com/BakeLens/crust/releases/tag/v2.0.0 https://github.com/BakeLens/crust/releases/tag/v2.0.0 Fri, 20 Feb 2026 04:21:06 GMT Crust v2.0 introduces PowerShell evasion detection, Unix domain socket management API, concurrent sessions dashboard, and formal Windows/FreeBSD support. • Adds PowerShell evasion detection: recursively parses `-Command "..."` and `pwsh -c "..."` inner commands; decodes `-EncodedCommand` base64 UTF-16LE payloads and flags them as evasive • Adds new management API endpoints: `GET /api/telemetry/sessions` and `/api/telemetry/sessions/:id/events` for per-session stats and event logs • Adds concurrent sessions dashboard accessible via `crust status --live`, replacing the previous single-overview view with a split-pane session list and event log • Adds formal Windows support: native Windows daemon, named pipe management API, PowerShell command extraction, LOLBAS entries, and backslash path normalization • Adds formal FreeBSD support with Unix socket management API and flock-based liveness checks • Replaces TCP management API with Unix domain sockets at `~/.crust/crust-api-{port}.sock` for kernel-enforced access control Breaking changes: • The management API is no longer available over TCP; it is now only exposed via Unix domain sockets (`~/.crust/crust-api-{port}.sock`) or Windows named pipes • Clients must now support the new `MessageRole` enum and named API protocol constants instead of raw strings Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crust