Brex shifts AI governance to network traffic monitoring with open-source LLM proxy

Brex tried the obvious approach to keeping AI agents in line: govern the code. It didn’t work. So the fintech company built something different, an HTTP/HTTPS proxy called CrabTrap that monitors what AI agents actually do at the network level, using a language model to make judgment calls on unfamiliar traffic patterns. The company open-sourced CrabTrap on April 21, 2026, and the project has already racked up more than 700 stars on GitHub. Why code-level governance fell short Brex’s journey to CrabTrap started with a problem most companies building AI agents will eventually hit. Their earlier OpenClaw agent framework revealed that traditional SDK-level governance, the kind that tries to constrain agent behavior through code-level controls, was fundamentally inadequate for agents that hold sensitive credentials like API keys and OAuth tokens. Pedro Franceschi, Brex’s co-founder and CEO, described the network layer as an “untapped enforcement point” for agent governance. How CrabTrap actually works CrabTrap routes all outbound requests from AI agents through its proxy. The system uses a dual-layer architecture that balances speed with intelligence. The first layer consists of static ...