The control layer for AI agents

Your agents are running. Who is stopping them?

AgentGuard catches the runaway before it burns your limit, caps what an agent can spend, and signs a record of what it did. It runs in your process. It is not a proxy, and it never sees your prompts.

$npx @agentguard-run/burn replay

Start here. It reads your own agent history and shows what it would have stopped. Installs nothing.

agentguard-burnREPLAY
$npx @agentguard-run/burn replay
scanning ~/.claude/projects 394/394 sessions
35%
of everything you burned came after a point it would have blocked
26.6B
observed
9.43B
after STOP
$4,229
API-list, scenario
≈ all of English Wikipedia, 1.3×
3 STOP   2 WARN   389 clean   across 394 sessions, 528 spawns
▁▁▂▂▂▃▃▃▄▄▄▅▅┃▅▆▆▆▇▇▇███
SUSTAINED STOP
eac59c9e · 9.15B · 26 spawns · stop near 5.05B, tail 4.10B
▁▁▁┃▂▂▃▃▃▄▄▄▅▅▅▆▆▆▇▇▇███
FAN-OUT STOP
2392f14c · 4.37B · 179 spawns · before spawn 41, tail 3.99B
▁▁▂▂▂▃▃▃▄▄▅▅▅▆▆▆▇▇▇██
WARN
ca5cdf32 · 3.56B · 19 spawns
… 390 more, all clean
next  agentguard-burn init  ·  shadow mode, blocks nothing until you say so

Real output from the author's machine: 394 sessions, 3 runaways, 389 clean. How it works →

One control layer, three surfaces

Same policy engine, same signed receipts, same rule: nothing leaves your machine.

● live · free

Burn

A circuit breaker for runaway agents. Fan-out cap, sustained-burn ceiling, and a boxed STOP with three things to do. Ships in shadow mode; blocks nothing until you have watched it be right.

npx @agentguard-run/burn replay

● live · free tier

Spend

Hard budget caps, a loop breaker, and a destructive-tool gate for any agent that calls a model. Ed25519-signed, content-free receipts you verify offline. Free to 10,000 enforcement calls a month.

npm i @agentguard-run/spend

○ next

Scan

Inspect an MCP server or agent skill before you install it. Zero target code is executed. Declared powers versus what the code actually does, dangerous capability combinations, injection in tool descriptions.

npx agentguard scan <pkg>

Three promises, kept in the architecture

Not a proxy.Your runtime calls your provider directly. AgentGuard evaluates policy in your process before dispatch. Prompts, keys, and completions never route through us.
Content-free receipts.When you configure signing keys, every governed decision gets an Ed25519 record with counts, digests, and verdicts. No prompt text. Verify it in a browser, offline.
Shadow before enforce.Every blocker starts by recording what it would have done. It earns enforcement by being right, in front of you, for a week.

The model is not the limit anymore. What is around it is.

Every model wins every benchmark eventually. What decides whether an agent is safe to run is what it can spend, what it can call, and whether it stops. That layer is AgentGuard, and it has to be neutral: no vendor will ever govern its competitors' agents.

Developers running agent swarmsClaude Code, Cursor, Codex, or your own orchestrator on Ollama. You spawn subagents, they re-read the tree, the limit is gone. Burn catches it at spawn 41 under one policy, whichever tool did it. Free, local, one command. Teams shipping agents to productionBudget caps and capability ceilings in code, not in a prompt. Signed receipts for the auditor. Org policy across every tool your engineers use.
Replay your history, freeRead the SDK docsPricing

Also: sovereign deployment · verify a receipt · platform leads · law firms