For developers

Prefer the SDK path?

Use the TypeScript SDK or verify a signed receipt in the browser. The SDK evaluates policy in your process before provider dispatch.

Running open-source models on your own hardware? Signed records capture the resolved model ID, registry weights origin, and configured hosting jurisdiction. Sovereign AI governance →

Governing a multi-agent payment capability? See a static walkthrough of the SDK gate: the runnable local example grants an intact signed chain and denies an altered one. No payment is sent. Open the attestation walkthrough →

See it: an AI agent tries to go rogue and gets caught, with receipts you verify yourself. Drive the demo → Verify a receipt →

AgentGuard for Claude Code: impulse control for your coding agent. See the docs →

$ npm install @agentguard-run/spend $ pip install agentguard-spend $ npx -y @agentguard-run/mcp Verify a receipt →

Route. Govern. Verify.

Route a governed call and inspect its decision metadata. No inference proxy.

The router selects a capable model, applies the configured cap, and can try a fallback provider. With signing keys configured, it appends a receipt. AgentGuard maps law, accounting, insurance, real estate, and e-commerce outcomes to model and reasoning-effort routes built from the OpenRouter catalog.

High-stakes steps can require a second pass: a configurable rule escalates to a higher-effort review before the action is allowed.

The site refreshes its OpenRouter catalog daily. Regulated-vertical rules can exclude China-origin model families before selection.

law.medical_chronology -> low effort drafter
insurance.policy_variance -> high effort reviewer
ecommerce.fba_claim -> draft plus reviewer
Caps still win. Downgrade or block happens before dispatch.

      What the market is calling for
    

Approval flows. Audit logs. Easy rollback.

AgentGuard evaluates configured spend, workflow, and declared-capability limits before supported provider dispatch. When signing keys are configured, it can append a content-free decision record.

Implemented

Approval flows

Calls routed through supported bindings can be evaluated before dispatch. A policy can require a verified DAG from trusted signers for configured capability escalation. Signing requires keys.

Implemented

Audit logs

Parent-linked DAG nodes can use multiple configured signers. The verifier checks signatures, signed fields, parent references, sequence uniqueness, and cycles under trusted public keys.

Implemented

Easy rollback

Configured scope caps, workflow envelopes, and an opt-in circuit breaker can block before dispatch. Signing keys add a content-free record of the decision.

“Agents make a billion requests in three seconds, so you need approval flows, inboxes that summarize what happened, logs, and easy rollback.” Dan Shipper · Every podcast · May 2026

      What it does
    

Six guardrails. One SDK.

Calls made through a supported binding are evaluated in process before provider dispatch.

01 · Sign

Configure Ed25519 keys to append hash-chained decision records with sequence numbers.

02 · Block

In enforce mode, a cap block stops the wrapped call before provider dispatch.

03 · Route

A cap configured with a downgrade action can replace the requested model when its threshold is exceeded.

04 · Gate

Capability tiers (read · write · payment) gate what an agent is even allowed to attempt.

05 · Log

Signed decisions can append to the exported in-memory or NDJSON log, or a custom store implementation.

06 · Verify

Supported linear and DAG receipt formats verify with the public key and local verifier.

No AgentGuard inference proxy.

Read the docs GitHub →

      Deploy it your way
    

Govern your agents your way.

Both paths use the same in-process policy checks. Ed25519 receipt signing is available when keys are configured, and governed-call prompts do not pass through AgentGuard infrastructure.

In process · no AgentGuard inference proxy

The SDK runs inside your code.

Policy checks run in your process. For a remote model, prompts and credentials go directly to the selected provider and do not traverse AgentGuard infrastructure. A self-hosted model can keep inference local.

· No AgentGuard network hop in the governed call path
· Provider credentials go only to the selected provider
· Exported in-memory and NDJSON logs, plus a custom-store interface

Managed · key provisioning and hosted flows

We provision OpenRouter access and host dashboard flows.

Managed plans can provision an OpenRouter key that the customer runtime fetches. The site dashboard records receipt summaries for supported hosted assistant flows. The supplied SDK does not fetch team policy or stream arbitrary runtime receipts.

· Provisioned OpenRouter key fetched by the customer runtime
· Hosted dashboard summaries for supported site flows
· Provider traffic still dispatches directly from the runtime

No AgentGuard inference proxy in either path.

Scan your agent, free → Read the docs

⚠ THE PROBLEM

"An AI consultant tells Axios one of their clients recently spent half a billion dollars in a single month after failing to put usage limits on Claude licenses for employees."

Axios · May 28, 2026 · axios.com

⬡ THE ANSWER

AgentGuard ships blocking caps and an opt-in circuit breaker.

A guarded call can be refused before provider dispatch when projected spend exceeds a blocking cap. The circuit breaker can also block repeated call fingerprints, plan churn without progress, and configured reasoning-step limits.

SpendGuard configuration

const config = {
  policy,
  circuitBreaker: {
    enabled: true,
    repeatThreshold: 3,
    stepCap: 50
  },
  signingKeys
};

Blocking caps remain in policy.caps.

Read cap behavior → See pricing →

COST VISIBILITY

Where did the tokens go? Answer the CFO before they ask.

For a governed call with known pricing, AgentGuard projects token cost before dispatch. It records scope and cost metadata in a signed ledger when keys are configured. Prompt content and provider keys go directly to the selected provider, not through an AgentGuard inference proxy.

PRICED UP FRONT

Governed calls with known model pricing are projected in cents before dispatch. Local overrides can replace table values.

TRACKED BY SCOPE

A configured scope key can include tenant, user, team, agent, task, and provider dimensions across supported cap windows.

SHADOW OR ENFORCE

Run in shadow mode to just watch real cost and block nothing. Flip to enforce when finance is ready. Same code.

YOUR LEDGER

With signing keys configured, decision metadata appends to an Ed25519-signed, hash-chained log.

EXAMPLE  ·  SPEND BY MODEL  ·  30 DAYS

             tenant=acme
          

MODEL

CALLS

TOKENS

SPEND

claude-sonnet-4.6

1,284

3.4M

$41.20

claude-opus-4.8

213

0.9M

$28.60

gpt-4o

5,120

6.1M

$22.40

gemini-3-flash

8,004

9.2M

$6.10

total

14,621

19.6M

$98.30

        Computed locally from the signed decision log. Runs in your storage. No proxy, no data plane.
      

See the live demo dashboard →

Stop runaway AI spend. Before the provider charges you.

A supported binding evaluates the governed call before dispatch. In enforce mode, a call that exceeds a configured blocking cap is not sent to the provider and cannot incur that provider call's charge.

HOW IT WORKS

Watch outcome-based AI governance in action
with two queries and one cryptographically checked log.

Inspect the x402 license catalog. Settlement activates only when signing, wallet, facilitator, and durable storage are configured.

LIVE FLOW

              
              session $0.20
            

            ●
            policy ~/.agentguard/policy.yaml
             ·  posture compliance
             ·  scope tenant=acme-law
          
> Redline this NDA from Acme Corp.

              · capability data_write
               · model claude-sonnet-4.6
               · $0.08
               → contract_redlined
            

              indemnification clause (§7.2) limits to $1M, recommend $5M floor
            

              ✓ settled $0.08  ·  receipt ag_8af4d2c1
            
> Run a research memo on California Civil Code §1102 disclosures.

              · capability read_only
               · model claude-opus-4.7
               · $0.10
               → research_memo_delivered
            

              California §1102 TDS required on all residential transfers; wildfire-zone updates per AB 38 apply to any property in or adjacent to a state-mapped fire hazard severity zone.
            

              ✓ settled $0.10  ·  receipt ag_8af5e019
            
> Show me the matter-2026-005 audit log so far today.

              · query_audit_log  ·  matter-2026-005  ·  $0.02  →  3 outcomes, all receipts verified
            
OUTCOME
CAP
SPENT
RECEIPT
VERIFIED
contract_redlined
$2.00
$0.08
ag_8af4d2c1
✓
research_memo_delivered
$3.00
$0.10
ag_8af5e019
✓
audit_log_queried
$0.10
$0.02
ag_8af6f72d
✓

              ✓ settled $0.02  ·  audit log  ·  receipt ag_8af6f72d
            

        ● attempted
        ● authorized
        ● cost
        ● succeeded
        one signed receipt per outcome
      

LIVE FLOW VARIANTS

LAW FIRM

The TypeScript package exports bindings for OpenAI, OpenRouter, Anthropic, Bedrock, LangChain.js, Vercel AI SDK, Claude Code, Hermes, and Hermes Kanban. The Python package separately includes OpenAI, Anthropic, Bedrock, OpenRouter, LangChain, CrewAI, LlamaIndex, Hermes, and Hermes Kanban integrations.

supported frameworks

TypeScript: OpenAI TypeScript: OpenRouter TypeScript: Anthropic TypeScript: AWS Bedrock TypeScript: LangChain.js TypeScript: Vercel AI SDK TypeScript: Claude Code TypeScript: Hermes TypeScript: Hermes Kanban Python: LangChain Python: CrewAI Python: LlamaIndex

        Node SDK: npm install @agentguard-run/spend · Python SDK: pip install agentguard-spend · Cross-language byte-identical canonical JSON + Ed25519 signatures.
      

built for AI assistants too

Don't know how to wire it up? Let your AI do it.

Paste the prompt below into Claude, GPT, Cursor, Cline, Continue, Devin, or any AI coding assistant. The assistant reads agentguard.run/llms.txt and generates the integration code for your specific provider and framework.

Please read https://agentguard.run/llms.txt and help me integrate AgentGuard Spend into my codebase. Ask which package language, provider, and shipped binding I use. Configure one explicit scope and a per-day cap with a block action. If I opt into receipts, show Ed25519 signing keys and a decision store. Do not invent an adapter.

view /llms.txt ~10KB markdown · full SDK reference + integration recipes

WHO RUNS AGENTGUARD

Software is moving in-house. Govern the fleet like you own the stack, because you do.

When the agent fleet runs in your stack, the policy can run there too: a library in your process, caps enforced before dispatch, and an optional signed ledger in your storage. AgentGuard does not proxy provider traffic.

ENTERPRISE PLATFORM TEAMS

You brought software development in-house with agent fleets. Now finance wants the bill explained and reviewers want inspectable records. AgentGuard projects governed calls with known pricing and can write signed decision metadata that verifies offline. Procurement reviews a library, not a data vendor.

MULTI-TENANT AI PRODUCTS

One provider account can serve many customers. Configure a separate scope and policy for each tenant, user, or agent. Downgrade and block actions are enforced in process before dispatch. Managed service is available when you want provisioned keys.

BUILDERS AND SMALL TEAMS

npm install, wrap your client, set a cap. Free under 10K enforcement calls a month, no card. Configure signing keys when you need a hash-chained decision record alongside enforcement.

EMBED IT: OEM LICENSING

Building software for clients with agent fleets? Configure per-client scopes and signed metadata records. For local or air-gapped deployments, core policy evaluation and receipt verification can run offline. Optional license, consent, telemetry, catalog, managed-key, and timestamp features are separate networked paths. Contact us to discuss embedded licensing.

OEM inquiry →

Built for applications sharing one provider account.

Create a distinct guard or policy for each user, agent, or team while reusing the same provider account. Each policy has one compound scope key. With signing configured, records bind the caller-supplied scope and cost metadata.

one compound scope per policy

policy A: tenant + user
policy B: tenant + agent
policy C: tenant + team
policy D: tenant + task

Caps inside one policy are evaluated together, and the most restrictive triggered action wins. Applications compose separate policies when they need both actor-specific and aggregate limits.

separate policy examples · one provider account
alice$50 / day
bob$50 / day
carlos$200 / day
finance-bot$200 / day
research-team$1,000 / month
aggregate tenant policycomposed separately

who this is for

Solo founders running Hermes, OpenClaw, or any custom orchestrator overnight on a personal Anthropic key.

SMBs with 2-20 employees sharing one Claude Teams or OpenAI Workspace account.

Agencies running 10+ client agents on one provider key, where one client's runaway loop eats the agency's margin.

Engineering teams where every IC has Cursor or Claude Code open all day and nobody can attribute spend back to specific projects.

IP

Patent-pending

Content-free

Spend receipt schemas reject prompts, completions, provider keys, and email fields

npm + PyPI

Live on both registries · cross-language byte parity

In process

Policy checks and optional receipt signing run inside your application

Overview

Tamper-evident when signed.

With Ed25519 keys configured, changing a signed field invalidates receipt verification. A valid signature establishes key possession and record integrity, not the truth of an external event.

Framework agnostic.

Exports integrations for LangChain.js, Claude Code, Vercel AI SDK, OpenRouter, OpenAI, Anthropic, Bedrock, Hermes, and Hermes Kanban. Custom stacks can use the core policy and store interfaces.

Spend caps with signed receipts.

Spend policy is enforced in the application process. Configure signing keys when reviewers also need a cryptographically verifiable decision record.

DAG trust chain.

The distinct DAG receipt path links signed nodes to explicit parents. A verifier checks node integrity, signatures, parent references, sequence uniqueness, and cycles offline.

The ecosystem.

Spend SDK · Live

AgentGuard Spend

Local-runtime spend caps and capability-gated model routing. Separate bindings cover OpenAI-compatible chat completions, Anthropic Messages, and Bedrock InvokeModel. Signing keys enable Ed25519-signed, hash-chained decision records.

npm install @agentguard-run/spend →

Receipt modules · Included

Decision logs and DAG receipts

The supplied Spend package includes linear decision logs and a distinct parent-linked DAG receipt module. Changes to signed fields invalidate verification.

Integration guide →

Chargeback SDK · Public

AgentGuard CB

Open-source chargeback receipt package compiler for Stripe / Visa CE 3.0 disputes. MIT-licensed npm package. Builds signed receipt packages locally, never submits, never proxies. Sibling to Spend in the AgentGuard family.

npm install @merchantguard/agentguard-cb →

In production.

Internal infrastructure

Autonomous operations stack

14 custom agent skills managing Dunecrest's production properties without human intervention. 5 scheduled jobs run continuously: infrastructure health monitoring, CVE scanning across active repos, evidence harvesting, shadow QA verification, and cloud billing audit. The same agent architecture that ships in the AgentGuard SDK, running on our own stack.

14 agent skills 5 cron jobs 5 production properties Launchd gateway

START NOW

Three ways to ship your first signed receipt.

Start with the local SDK, the signed demo, or an intake conversation. Provider traffic does not pass through an AgentGuard inference proxy.

FREE TIER

Install the SDK

Local-runtime spend caps with separate provider bindings and optional Ed25519 receipts. The package license permits production up to 10K enforcement calls per calendar month.

npm install @agentguard-run/spend

Get started →

NEW

X402 CATALOG

Inspect the machine-readable offer

An x402-compatible runtime can inspect the catalog. Purchases work only when the response reports active payments and the settlement dependencies are configured.

GET /api/x402/license?tier=list

See merchant catalog →

ENTERPRISE / IP

Talk to our intake team

For bulk seats, custom postures, or evaluating AgentGuard for strategic acquisition, reach our intake team.

[email protected]

Email our intake team →

↗ Verify a receipt in your browser See the 5 outcomes Read /llms.txt

The in-process policy layer for AI agents.
Enforced before dispatch. Signed when you configure keys.

Hard budget caps for multi-day agent runs.

Prefer the SDK path?

Route a governed call and inspect its decision metadata. No inference proxy.

Approval flows. Audit logs. Easy rollback.

Six guardrails. One SDK.

Govern your agents your way.

AgentGuard ships blocking caps and an opt-in circuit breaker.

Where did the tokens go? Answer the CFO before they ask.

Stop runaway AI spend. Before the provider charges you.

Watch outcome-based AI governance in action
with two queries and one cryptographically checked log.

Don't know how to wire it up? Let your AI do it.

Software is moving in-house. Govern the fleet like you own the stack, because you do.

Built for applications sharing one provider account.

Overview

The ecosystem.

In production.

Live DAG attestation.

Three ways to ship your first signed receipt.

Install the SDK

Inspect the machine-readable offer

Talk to our intake team

Hard budget caps for multi-day agent runs.

Prefer the SDK path?

Route a governed call and inspect its decision metadata. No inference proxy.

Approval flows. Audit logs. Easy rollback.

Six guardrails. One SDK.

Govern your agents your way.

AgentGuard ships blocking caps and an opt-in circuit breaker.

Where did the tokens go? Answer the CFO before they ask.

Stop runaway AI spend. Before the provider charges you.

Watch outcome-based AI governance in action with two queries and one cryptographically checked log.

Don't know how to wire it up? Let your AI do it.

Software is moving in-house. Govern the fleet like you own the stack, because you do.

Built for applications sharing one provider account.

Overview

The ecosystem.

In production.

Live DAG attestation.

Three ways to ship your first signed receipt.

Install the SDK

Inspect the machine-readable offer

Talk to our intake team

Watch outcome-based AI governance in action
with two queries and one cryptographically checked log.