Custos

Custos ships as a single Rust binary requiring Rust 1.88 or newer, targeting Linux, macOS, BSD, and Windows under the MIT license. Production installation includes OS firewall setup for pf, nftables, ipset, or netsh, and the repository documents a quick start plus a configuration reference.

The project cites roughly $0.00009 per 4-actor batch. Benign static GET and HEAD traffic is filtered at Tier 1 for $0, and cached exploit signatures avoid additional AI calls.

Bodies, cookies, raw protocol headers, and application authorization context are not inspected. The project advises using application authorization and an upstream WAF for controls that must reject an initial exploit request.

Yes. It can be used as a Rust library with Axum middleware that rejects existing IP bans and validated cached signatures before the handler runs. Standalone signature checks require original request metadata from the trusted proxy.

Missing answers, invalid classes, and out-of-range probabilities fail analysis and retain the batch for retry. Window expiration runs during ingestion even while Jev is unavailable, and expired suspicious windows use a bounded backlog.

Limits are 64 KiB per log record, 8 KiB for the inspected path and query, 1 KiB for User-Agent, and 32 bytes for the method. Oversized HTTP fields are truncated before queuing; oversized log records are discarded through their newline.