Claude Code · Codex · ChatGPT Work

Your agents can launch copies of themselves.
AgentGuard caps it.

A free plugin for Claude Code and Codex. Each copy your agent launches runs its own token meter; AgentGuard refuses the copy past your limit, checks every tool call against your rules, and keeps a signed record on your machine. Free on one machine, no account, no key.

Hook
Policy
Decision
Signed record

Enforce is free for one machine

No key is needed. Enforce is free for one machine with no account or time limit.

No email needed.

Install now with no account or key. Full Enforce, local signed receipts and Burn are free for one machine.

  1. codex plugin marketplace add MerchantGuard/agentguard-codex-plugin
  2. codex plugin add agentguard@agentguard
  3. npm ci
  1. claude plugin marketplace add MerchantGuard/agentguard-codex-plugin
  2. claude plugin install agentguard@agentguard
❯ Spawn one agent to reply READY. Do not retry if blocked. ⏺ Agent(Reply READY) ⎿ Initializing… ⎿ Error:
AGENTGUARD STOP agent spawn blocked
16 spawns in the last 15 active minutes. 154.0M tokens · 15 spawns · depth 1 DO NOW 1. Queue agents instead of launching them in parallel; the limit is shared across all of them. 2. Most of this burn is cached context re-sent per agent. Fewer, longer-lived agents beat many short ones. override once: agentguard-burn resume --once --reason "..."
$ agentguard-burn blocks 
Session 7f0c0270: its own child transcripts
Children  Count  Measured  Median tokens  Max tokens  Median list USD  Max list USD
All       15     15        10,000,000     20,000,000  $4.99            $15.00
Forks     8      8         6,500,000      10,000,000  $3.19            $4.99
Fresh     7      7         14,000,000     20,000,000  $8.62            $15.00
The card above is the real STOP output, recorded with a prepared session. The clip is a deliberate fan-out test on one of our machines on Sep 23 2026, replayed at 16x from the signed ledger: fifteen copies launched in 36.6 seconds, the next three attempts refused at the ceiling, five more refused when the copies tried to launch their own, 29,997,622 tokens at $78.21 list price (not a bill). watch the clip

What one block is worth

This session had 15 child agents at a median 10,000,000 tokens and $4.99 list price each, max 20,000,000 tokens and $15.00. The sixteenth spawn was stopped and recorded.

List-price equivalents from the session's own transcripts, not a bill and not a billing figure.

Your policy, at the tool boundary.

The policy is a file you can read. The record is a signed row you can verify.

policy.json
{
  "version": 1,
  "mode": "enforce",
  "allowedTools": ["^Read$", "^Grep$", "^Edit$"],
  "deniedTools": ["^mcp__payments__"],
  "caps": [{ "window": "per_day", "amountCents": 1500 }]
}
signed decision, example row
{
  "sequence": 447,
  "decision": { "action": "allow", "timestamp": "2026-09-19T00:11:10.265Z" },
  "previousHash": "9c2f...e41a",
  "entryHash": "3a449e32...",
  "signature": "ed25519, on this machine"
}

See where your session's tokens went.

One of our machines · 2026-09-23 (America/Panama) · 393 sessions

npx @agentguard-run/burn replay
27.94B
Observed tokens
1.03B
Tokens after the first STOP point
3.7%
Share of recorded tokens
2 STOP · 7 WARN · 384 clean · 764 spawns

A local replay snapshot, not a billing claim or a share of the bill. The post-STOP tail is an upper bound. Replay's legacy counters can differ from the response-reconciled why report. Read the generated totals.

Free

One machine, full Enforce, local signed receipts and Burn. No account or key.

See pricing

Solo $19 a month

A license key for up to three machines, the dashboard, receipts export and email support.

See pricing

Team $199/month or $1,990/year for 10 seats

Ten seats, one org policy every seat runs, seats you add and revoke, one invoice.

See pricing