CrewAI's execution-hooks documentation answers most of this comparison in one example. Under the heading "Safety guardrails," it shows a hook registered at PRE_TOOL_CALL that checks the tool name against a set — {"delete_file", "drop_table", "system_shutdown"} — and raises HookAborted if it matches.
That is real pre-execution enforcement. The tool does not run. The abort reason propagates into telemetry. Anyone who tells you CrewAI only observes its agents has not read the docs.
It is also a Python set literal, in your repository, maintained by whoever last touched that file. CrewAI ships the interception point. You ship the policy. That division is the whole comparison.
CrewAI is an open-source multi-agent framework — role-based agents, crews, flows, memory, checkpointing, and native MCP support — paired with a commercial layer called CrewAI AMP (Agent Management Platform) that adds managed deployment, traces, RBAC, SSO, secrets management, human-in-the-loop review for flows, and trace-level PII redaction. Waxell is an AI control plane where policy is administered centrally and applies to agents regardless of what they were built with: Observe instruments any agent in two lines and evaluates every run against 50+ policy categories before the next step executes, the MCP Gateway governs tool calls across 160+ upstream connectors, Runtime gates each step of high-stakes workflows, and Endpoints governs AI on employee machines. CrewAI governs the agents you build on CrewAI. Waxell governs the agents, wherever they came from.
What is CrewAI built for?
CrewAI is a build platform first, and a very good one. Its own positioning is unambiguous: "Enabling business and technical teams to build agents while giving platform teams the control to govern them." Build comes first in that sentence for a reason.
The open-source framework is mature. Agents are defined by role, goal, and backstory in YAML or code; crews compose them; flows wrap crews in a state machine with Pydantic-typed state, conditionals, and branching. Memory is described as a cognitive layer that "resolves contradictions, forgets intentionally, and knows when it lacks context" rather than plain vector search. Checkpointing captures runtime state at every step so a run can be replayed or forked. There is native MCP support across stdio, SSE, and streamable HTTP, A2A for agent-to-agent discovery, sandbox execution through E2B and Daytona, and hundreds of prebuilt tools. CrewAI says the framework is used by 65% of the Fortune 500.
The governance story is stronger than most write-ups give it credit for, and it comes in two distinct layers.
In the framework, the @on decorator exposes one interception contract across execution boundaries, model calls, tool calls, and task or flow steps. A hook can proceed, mutate the payload in place, replace it by returning a new value, or abort by raising HookAborted. Input validation, output sanitisation, loop guards, per-tool blocking, and synchronous human approval prompts are all documented patterns. Task Guardrails validate a task's output before it is accepted, and the Hallucination Guardrail scores output faithfulness against reference context with a configurable threshold.
In AMP, the commercial layer adds what a platform team actually asks for: SSO across Entra ID, Okta, Keycloak, WorkOS, and Auth0; role-based access control with custom roles and per-automation visibility whitelists; a secrets manager with workload-identity federation for AWS, Azure, and GCP; execution traces with cost accounting; webhook streaming; and a self-hosted deployment option called Factory. The Flow HITL system is genuinely well built — email-first review that requires no platform account, wildcard routing rules, dynamic assignee resolution from flow state, SLA tracking, HMAC-signed webhooks, and an immutable decision log. CrewAI maintains a public trust center showing SOC 2 Type 2 certification and a February 2026 HIPAA audit report.
None of that is a thin veneer. It is a coherent enterprise story built outward from a framework.
Where does CrewAI's governance perimeter sit?
These are consequences of building governance outward from a framework, and CrewAI documents nearly all of them plainly in its own pages.
Policy is application code, with the operational properties of application code. The interception points ship with CrewAI; the rules that run inside them do not. A blocked-tool list, a spend ceiling, a PII regex — each is a function a developer writes, registers, and maintains in the same repository as the agent it governs. That is excellent ergonomics for the team building the agent. It also means policy is versioned, reviewed, and deployed on the agent's release cycle rather than administered centrally. A disciplined team can factor its hooks into a shared internal package; the rollout is still a dependency bump per service rather than a setting changed once.
Hooks fail open by design. CrewAI's documentation states it directly: HookAborted propagates and stops the chain, but "any other exception raised by a hook is swallowed (fail-open) so a single buggy hook can't crash a run." That is a defensible reliability choice, and the docs are admirably clear that you should not rely on raising ValueError to stop a run. It is also worth knowing before you treat a hook as a security control, because a control that silently no-ops on an unexpected exception has a different risk profile than one that fails closed.
AMP's access control governs people and deployments, not agent actions. Read the RBAC feature matrix and the unit of control is clear: crews_dashboards, tools, agents, environment_variables, llm_connections, studio_projects, each set to Manage, Read, or No access. Entity-level permissions on an individual automation are run, traces, manage_settings, human_in_the_loop, and full_access. This is well-designed access control for who may deploy, view, run, and approve. It is a different axis from what a running agent is permitted to do next.
The managed PII feature redacts traces. The page is titled "PII Redaction for Traces," and the mechanism is stated as masking sensitive data "before it's stored in traces," across roughly seventeen built-in entity types plus custom regex and deny-list recognisers. It is a strong telemetry-privacy control and it is the right way to keep customer data out of an observability store. It is not a data-flow control: the redaction applies to the record of the run, not to what reaches the model or the tool. In-flight redaction is available, but as a hook you author yourself. The managed feature also requires the Enterprise plan, deployment version 1.8.0 or higher, and manual enablement on each deployment individually.
Managed human review covers Flows, not Crews. CrewAI's own callout says so: the HITL management features "apply specifically to Flows, not Crews." Review points are placed by a developer with the @human_feedback decorator at chosen flow methods, which means approvals attach to workflow steps someone anticipated rather than to a category of action such as any destructive tool call. Auto-response is available and CrewAI lists "auto-approve low-risk requests after timeout" as a use case, with its own warning to enable it carefully.
Tool-metadata prompt injection is documented as a trust decision. CrewAI's MCP security page identifies the risk precisely — a malicious server can embed instructions in tool names and descriptions, and "this attack can occur simply by connecting to a malicious server and listing its tools, even if your agent never explicitly decides to use any of those tools." The stated mitigation, under the heading "Extreme Caution with Untrusted Servers," is to only connect to servers you fully trust. That is honest and correct advice. It is also a procedural control rather than a technical one, and it depends on a server you trusted last quarter still deserving it today.
Governance sits in the custom-priced tier. CrewAI's pricing page lists two plans. Basic is free and covers the visual editor and AI copilot, GitHub integration, and 50 workflow executions per month. Enterprise is custom-priced and is where "Governance from the start: SSO, RBAC, workload identity, PII redaction, and policies" lives, alongside VPC and on-premises deployment and a 45-day onboarding. There is no published figure and no self-serve middle tier.
And it governs CrewAI. The hooks are CrewAI's hooks; the traces are CrewAI's traces; AMP deploys CrewAI automations. A LangChain service, a bespoke asyncio agent, a Cursor install on a developer's laptop, or ChatGPT in a browser tab are outside the perimeter by construction. For a team standardised on CrewAI that is a feature, not a gap.
What Waxell adds
Waxell starts from the opposite end: policy as an administered artifact, agents as the thing it is applied to.
Observe installs with pip install waxell-observe, instruments an agent in two lines with no rebuilds, auto-instruments 200+ libraries — CrewAI among them, alongside LangChain, LlamaIndex, AutoGen, Semantic Kernel, and LiteLLM — and evaluates every run against 50+ policy categories at 0.045ms p95 across 1000+ policies. The categories ship with the platform: Audit, Content, Control, Cost, Kill, LLM, Operations, Quality, Rate-Limit, Safety, Scheduling, Compliance, Delegation, Identity, Privacy, Reasoning. Nobody writes the regex. They map to OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR, and HIPAA, so the enforcement that stops an action also produces the attestation an auditor asks for.
The MCP Gateway is one URL per tenant in front of 160+ upstream connectors, with three auth modes and 30-second policy propagation. It answers the tool-metadata risk CrewAI's own security page describes with a technical control rather than a trust decision: tool descriptions are scanned for prompt injection at fingerprint time, before any agent calls them, and every tool is tracked through a five-state trust model — Pending, Drift, Trusted, Blocked, Removed — so a server that quietly rewrites its own definitions is flagged as drift rather than trusted by inertia. PII is redacted and secrets are blocked in flight, not on the way into the log. Destructive actions park for a human by policy, with the MCP connection held open during approval, and offboarding revokes every upstream OAuth grant in one transaction.
Past the request path, Runtime gates each step of financial, clinical, and infrastructure workflows with isolated execution, kill switches at every level, durable checkpoint-and-resume, and US or EU data residency. Endpoints discovers AI across employee machines — 60+ provider domains, signed macOS and Windows agents, MDM-deployable through Jamf, Intune, Kandji, Hexnode, and Mosyle — reading the TLS handshake hostname rather than decrypting traffic, with capture off by default.
Feature comparison
| Capability | Waxell | CrewAI |
|---|---|---|
| Architecture | ||
| Primary product | ✅ Governance control plane | ✅ Multi-agent build framework + management platform |
| Agent authoring framework | ❌ Not a Waxell product | ✅ Yes (crews, flows, roles, memory, checkpointing) |
| Governs agents built on other frameworks | ✅ Yes (200+ libraries auto-instrumented) | ⚠️ Scoped to CrewAI agents and automations |
| Governs assistants nobody on the team built | ✅ Yes (Gateway, Endpoints) | ⚠️ Not stated |
| Where policy comes from | ||
| Policy categories shipped with the platform | ✅ 50+ named categories | ⚠️ Interception points shipped; rules authored by the developer |
| Central administration of rules across agents | ✅ Yes (30s propagation) | ⚠️ Hooks registered in application code |
| Failure mode of a broken control | ✅ Policy engine, not app code | ⚠️ Non-abort exceptions swallowed (documented fail-open) |
| Enforcement | ||
| Documented pre-execution blocking | ✅ Yes (policy gates before each step) | ✅ Yes (PRE_TOOL_CALL + HookAborted) |
| Output validation / quality gates | ✅ Yes (Quality, Content categories) | ✅ Yes (Task Guardrails, Hallucination Guardrail) |
| In-flight PII redaction | ✅ Yes (Gateway, in flight) | ⚠️ Managed feature redacts traces; in-flight via self-authored hook |
| Secret blocking before egress | ✅ Yes (never leaves gateway) | ⚠️ Not stated |
| Kill switches | ✅ Yes (every level) | ⚠️ Loop guards and aborts via hooks |
| Human in the loop | ||
| Managed approval workflow | ✅ Yes (destructive actions, by policy) | ✅ Yes (email-first, routing, SLA, audit log) |
| Scope of managed approvals | ✅ Any governed action | ⚠️ Flows only, at developer-placed checkpoints |
| Auto-approve on timeout | ⚠️ Not stated | ✅ Yes (configurable, CrewAI advises caution) |
| MCP governance | ||
| Native MCP client support | ✅ Yes | ✅ Yes (stdio, SSE, streamable HTTP) |
| Per-agent tool scoping | ✅ Yes (policy) | ✅ Yes (apps=['gmail/send_email'], per-agent MCP config) |
| Upstream connector catalogue | ✅ 160+ | ⚠️ 17 named apps in the AMP catalogue ("more to come") |
| Tool-description injection scanning | ✅ Yes (at fingerprint time) | ⚠️ Risk documented; mitigation stated as server trust |
| Tool drift detection across versions | ✅ Yes (five-state fingerprinting) | ⚠️ Fingerprints identify agents/crews/tasks, not tool definitions |
| One-transaction offboarding of upstream grants | ✅ Yes | ⚠️ Not stated |
| Scope & operations | ||
| Shadow AI on employee devices | ✅ Yes (Endpoints, 60+ domains) | ⚠️ Not stated |
| Execution traces with cost accounting | ✅ Yes | ✅ Yes (AMP Traces) |
| SSO / RBAC | ✅ Yes | ✅ Yes (Entra ID, Okta, Keycloak, WorkOS, Auth0) |
| Compliance certification | ✅ SOC 2, HIPAA, PCI-DSS profiles | ✅ SOC 2 Type 2, HIPAA audit report (Feb 2026) |
| Self-hosted option | ✅ Yes (same image, customer VPC) | ✅ Yes (Factory; Enterprise tier) |
| Published price figures | ✅ Yes | ❌ Free tier only; Enterprise is custom-quoted |
| Governance available on the free tier | ✅ Yes | ❌ Governance listed under Enterprise |
Three scenarios, two different centres of gravity
Scenario: you are building a multi-agent system from scratch and want structure, memory, and orchestration.
CrewAI, comfortably. Roles, crews, flows with typed state, a memory layer that resolves contradictions, checkpointing, A2A, native MCP, and hundreds of tools is a strong foundation, and the hook system means you can enforce meaningful rules without leaving the framework. Waxell does not compete for this and does not try to.
Scenario: your agents are all CrewAI, one team owns them, and that team writes the rules.
CrewAI AMP is a reasonable single-vendor answer. Price the Enterprise tier early, since SSO, RBAC, workload identity, PII redaction, and policies all live there, and budget the engineering time to write and maintain the hooks — they are your policy, not CrewAI's.
Scenario: your estate is CrewAI plus LangChain plus something a contractor wrote, and Security is asking who approved the agent that emailed a customer.
Waxell. The same 50+ policy categories evaluate in-process across every framework, the Gateway governs tool calls with injection scanning and drift detection, Runtime gates high-stakes workflows step by step, and Endpoints finds the assistants nobody registered. One control plane, one audit trail, no requirement that everything be built the same way.
When to use CrewAI
- You are building the agents, and you want the framework, the orchestration, and the management platform from one vendor.
- Your team is comfortable writing and maintaining enforcement as code, and prefers policy living next to the agent it governs.
- Flow-level human review with email routing, SLA tracking, and an immutable decision log matches how your approvals actually work.
- You want opportunity discovery — CrewAI Discovery cross-references your environment against its own corpus of agent runs to rank where to automate, which nothing in this comparison set matches.
When to use Waxell
- Governance has to apply the same way across CrewAI, LangChain, LlamaIndex, and code nobody documents.
- You want 50+ policy categories that ship with the platform and are administered centrally, rather than interception points you fill in yourself.
- Third-party MCP tools are a live risk surface and "only connect to servers you trust" is not a control you can evidence to an auditor.
- Your perimeter includes employee laptops and assistants your platform team never installed.
- You need mapped compliance evidence — OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR, HIPAA — falling out of the same enforcement that stops the action.
How Waxell handles this: Waxell is an AI control plane where enforcement is the primitive and observability is what enforcement produces. Observe instruments any agent in two lines of code, auto-instrumenting 200+ libraries including CrewAI, and evaluates every run against 50+ policy categories at 0.045ms p95 across 1000+ policies — cost ceilings that halt execution, PII redaction, content and safety gates, kill switches — mapped to OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR, and HIPAA so the same enforcement yields an audit you can hand over. The MCP Gateway governs tool calls across 160+ upstream connectors, scanning tool descriptions for prompt injection at fingerprint time and tracking every tool through a five-state trust model that catches a server silently changing its definitions. Runtime gates each step of workflows where being wrong is expensive, and Endpoints finds the AI running on employee machines. A dashboard after the fact is not governance. It's an autopsy.
FAQ
Is Waxell a CrewAI alternative?
Not for building agents — CrewAI is a framework and Waxell is not. For governing them, yes. Waxell auto-instruments 200+ libraries including CrewAI, so a common pattern is building on CrewAI and governing with Waxell rather than choosing between them. The choice becomes exclusive only if you were planning to buy CrewAI AMP specifically for its governance layer.
Does CrewAI actually block agent actions, or only observe them?
It blocks. The @on(InterceptionPoint.PRE_TOOL_CALL) hook runs before a tool executes, and raising HookAborted stops the operation and propagates the reason into telemetry. Model calls, execution boundaries, and task or flow steps have equivalent interception points. Two things are worth knowing: the rules inside those hooks are code you write and maintain, and CrewAI's documentation states that exceptions other than HookAborted are swallowed so a buggy hook cannot crash a run.
What does CrewAI cost?
CrewAI publishes two plans. Basic is free and includes the visual editor and AI copilot, GitHub integration, and 50 workflow executions per month. Enterprise is custom-priced and is where CrewAI lists SSO, RBAC, workload identity, PII redaction, policies, deployment to CrewAI cloud or your own VPC or infrastructure, and a 45-day onboarding. There is no published Enterprise figure and no self-serve tier in between, so governance requires a sales conversation.
Does CrewAI redact PII from agent traffic?
CrewAI AMP's managed feature is documented as PII Redaction for Traces — it detects and masks sensitive data before it is written into execution traces, across around seventeen built-in entity types plus custom regex and deny-list recognisers. That protects the observability record. Redacting data in flight, before it reaches a model or a tool, is possible in CrewAI but is a hook you write yourself. Waxell's Gateway redacts PII and blocks secrets in flight as a shipped policy.
How do the two handle malicious MCP servers?
CrewAI's MCP security documentation describes the tool-metadata prompt-injection risk accurately, including that simply listing a malicious server's tools can compromise an agent, and its stated mitigation is to only connect to servers you fully trust. Waxell's MCP Gateway adds technical controls on top of that judgement: tool descriptions are scanned for prompt injection at fingerprint time before any agent calls them, and each tool carries one of five trust states so a definition that changes after approval surfaces as drift.
Can I use CrewAI and Waxell together?
Yes, and it is the common case. CrewAI handles authoring and orchestration; Waxell's SDK instruments the running crew in two lines and applies the same policy set that covers the rest of your estate, the Gateway governs the MCP tools those agents reach, and Endpoints covers the assistants outside the platform entirely.
Sources
- CrewAI, Homepage — accessed August 3, 2026.
- CrewAI, Agent Management Platform — accessed August 3, 2026.
- CrewAI, Pricing — accessed August 3, 2026.
- CrewAI, Open Source — accessed August 3, 2026.
- CrewAI Docs, Execution Hooks — accessed August 3, 2026.
- CrewAI Docs, Tool Call Hooks — accessed August 3, 2026.
- CrewAI Docs, MCP Security Considerations — accessed August 3, 2026.
- CrewAI Docs, Production Architecture — accessed August 3, 2026.
- CrewAI Docs, Fingerprinting — accessed August 3, 2026.
- CrewAI Platform Docs, Role-Based Access Control (RBAC) — accessed August 3, 2026.
- CrewAI Platform Docs, PII Redaction for Traces — accessed August 3, 2026.
- CrewAI Platform Docs, Flow HITL Management — accessed August 3, 2026.
- CrewAI Platform Docs, Tools & Integrations — accessed August 3, 2026.
- CrewAI Platform Docs, Single Sign-On (SSO) — accessed August 3, 2026.
- CrewAI, Trust Center — accessed August 3, 2026.
- Waxell,
waxell/competitor-intel/crewai.mdresearch brief — researched July 13, 2026.
Originally published on the Waxell blog.
Your framework gives you the hook. Who writes what goes inside it? Get started with Waxell.
Top comments (0)