AI tool comparison
CrabTrap vs Skills (mattpocock)
Which one should you ship with? Here is the side-by-side panel verdict, pricing read, reviewer split, and community vote comparison.
Developer Tools
CrabTrap
Open-source HTTP proxy that enforces security policies on AI agent API calls
50%
Panel ship
—
Community
Paid
Entry
CrabTrap is an open-source HTTP/HTTPS proxy built by Brex's engineering team that sits between AI agents and the external internet, evaluating every outbound request against configurable security policies before it reaches any third-party API. It uses a two-tier evaluation system: fast deterministic static rules handle the obvious cases (block this domain, require this header), while an LLM-as-a-judge handles ambiguous requests that need semantic understanding — like determining whether a request to send an email is within scope of the current task. Built in Go with a TypeScript frontend, CrabTrap ships with a PostgreSQL-backed audit log and a web UI for policy management. It supports MITM inspection of HTTPS traffic, request/response logging, and policy versioning — making it suitable for production agentic systems where compliance or security teams need a paper trail. Version 0.0.1 was released April 17, 2026 and is MIT licensed. The problem it solves is real: as AI agents gain more autonomy and access to external APIs, the attack surface grows. A compromised or misbehaving agent that can freely call any URL is a significant risk. CrabTrap gives engineering teams a single chokepoint to enforce least-privilege access — something that's been missing from most agentic frameworks that assume a trusted execution environment.
Developer Tools
Skills (mattpocock)
Real-world agent skills for engineers — install via npm, not vibes
75%
Panel ship
—
Community
Free
Entry
Skills is a curated library of AI agent prompts and workflows for real software engineering, created by TypeScript educator Matt Pocock. The project trended to 28,000 GitHub stars with its blunt tagline: "Agent skills for real engineers — not vibe coding." It's a deliberate pushback against chaos-first AI coding in favor of structured, methodical engineering. The library organizes into four categories: Planning & Design (to-prd for converting conversations into PRDs, grill-me for stress-testing plans), Development (tdd for test-driven AI assistance, triage-issue for bug investigation), Tooling & Setup (pre-commit hooks, git safety guards), and Writing & Knowledge (documentation utilities, Obsidian integration). Each skill installs with a single npx command — npx skills@latest add mattpocock/skills/tdd — and plugs into Claude agent setups. With 28,000 stars and 2,200 forks after trending on GitHub on April 27, 2026, Skills has clearly struck a nerve. It's as much a cultural statement as a product: AI coding tools should be used deliberately, with tests, with planning, and with guardrails. The TDD and triage-issue skills address real gaps in how current AI coding agents handle existing codebases rather than greenfield projects.
Reviewer scorecard
“This fills a gap that every production agentic system needs but almost no one has solved yet. The two-tier policy engine — static rules for speed, LLM for ambiguity — is the right architecture. The fact that Brex built and open-sourced this suggests they've already battle-tested it against real agent deployments.”
“The tdd skill alone is worth the install. Watching a Claude agent plan tests before writing implementation is exactly how I want AI to assist me. Matt's framing of 'real engineering vs. vibe coding' is the right cultural correction for 2026.”
“v0.0.1 with 126 GitHub stars is a weekend project right now, not infrastructure you should bet your production agents on. The LLM-as-a-judge for policy evaluation is also expensive and introduces its own latency — you're adding an AI call to evaluate every AI agent call. The operational complexity of running MITM HTTPS inspection in production is non-trivial.”
“These are sophisticated markdown prompts, not magic. If you're already a disciplined engineer, the skills add ceremony without much acceleration. The 28K stars partly reflect Matt's Twitter following — evaluate the actual skills before star-chasing.”
“Agent security tooling is where network security tooling was in the early 2000s — primitive, fragmented, and urgently needed. CrabTrap is an early bet on a category that will be worth billions once enterprises start mandating audit trails for agentic systems. Brex building this in-house and open-sourcing it is a strong signal of what production agent operators actually need.”
“Community-curated skill libraries installed via package managers will become standard infrastructure — as natural as installing a linting config. Skills is the early prototype of a skills ecosystem that will matter at scale.”
“This is deeply in the DevOps/infrastructure lane — not something a creator or designer would ever touch directly. But if the tools you use to generate content are backed by CrabTrap-style security, you'd want that. For now, it's a ship for the engineers who configure your AI stack, a skip for everyone else.”
“The writing and knowledge skills are underrated. The article-editing and Obsidian integration skills bring structured AI assistance to documentation workflows that most agent tools ignore entirely. Install even if you're not primarily a developer.”
Weekly AI Tool Verdicts
Get the next comparison in your inbox
New AI tools ship daily. We compare them before you waste an afternoon.