Open source · circuit breaker for AI agents

Your agents can't
outspend you.

A hard dollar budget on the workflow itself — hierarchical across sub-agents, enforced between steps, never a mid-flight 429. When a loop runs away, Breakerbox trips. Safely.

Get started →View on GitHub

MIT · Python 3.11+ · in-process · no server, no stored keys

● live run
planner$0.00web_searchtool · safewriter$0.00publishside-effectinggated
# generated by breakerbox builder — edit freely, it's yours from langgraph.graph import StateGraph, START, END from langgraph.checkpoint.memory import MemorySaver from breakerbox import guard def planner(state): # model: gpt-4o · sub_budget=$0.40 ... # TODO: your planner logic return state def writer(state): # model: claude-sonnet · sub_budget=$0.35 ... return state builder = StateGraph(dict) builder.add_node("planner", planner) builder.add_node("writer", writer) builder.add_edge(START, "planner") app = guard( builder.compile(checkpointer=MemorySaver()), budget_usd=0.90, velocity_usd_per_min=2.0, sub_budgets={"planner": 0.40, "writer": 0.35}, on_trip="pause", )
run receipt · research_pipeline · tripped at hop 12 · spent $0.82 of $0.90
hop 1planner$0.06
hop 2web_search$0.00
hop 3writer$0.09
hop 5planner ↺$0.07
hop 7writer ↺$0.11
hop 9planner ↺$0.14
hop 11writer ↺$0.19
⏻tripped — velocity · next hop blocked · state checkpointed · 0 side effects fired$0.82
The accounting

Reserve. Execute. Reconcile.

The same pattern your credit card uses — because knowing a call's true cost only after it finishes is exactly the hotel-checkout problem.

01

Reserve

Before dispatch: hold the maximum possible cost — input tokens + max_tokens × price. The hold counts as spent, so parallel branches can't race past the ceiling.

02

Execute

The call runs to completion, always. Streaming output is metered chunk by chunk. Nothing is ever interrupted mid-flight.

03

Reconcile

Actual cost is recorded, the difference released back to the pool — and the next hop only dispatches if the budget allows it.

Budget-first by design

The only builder where money
is on the canvas.

Other tools show you cost after the run. In Breakerbox, budget is part of the graph itself — allocated while you design, enforced while you run.

Hierarchical escrow

A parent workflow holds $5.00. Sub-agents draw from it; a child can never exceed its slice. Reserve before dispatch, reconcile after — like a card hold. Parallel branches can't race past the ceiling.

Stops that don't corrupt

Enforcement happens between steps, never mid-call. pause checkpoints state so you resume, not restart. kill lists every side effect that already fired — so you compensate, not guess.

Catches runaways

A loop spinning on near-identical calls trips before the budget pays for it — no LLM, just fuzzy repeat detection. A live $spent / $budget counter climbs in your terminal as it runs, and max_depth caps sub-agent nesting so a run can't spawn its way around its own cap.

Code you own

The visual builder generates readable Python wrapped in the guard — codegen only. Scaffolding you outgrow, not a platform you live in. Edit every line.

Design-time cost forecast

Know the cost
before the first token.

Every other visual builder shows you cost after a run, on their key. Breakerbox forecasts it on the canvas — a p50–p95 band per node and across the whole graph, before a single token is spent. Drag the loop count or swap a model and the number moves live.

An estimate, not a quote — calibrated by your own run receipts.

Forecast · est.$0.82–$3.14
budget $5.00p50 → p95
loops ≈ 3×drag to simulate
plannerrun ≈ $0.06–$0.10
↻ writerrun ≈ $0.21–$1.68
try Haiku on writer → −67% on this branch
Five lines

Wrap it.
That's the integration.

  • No proxy, no gateway, no Docker — in-process with your LangGraph app
  • Dollar budgets, not token counts — across every model in the chain
  • Cost-velocity tripwire catches loops that step limits miss
  • A shareable HTML receipt from every run — where the money went, hop by hop
from breakerbox import guard

app = guard(
    my_langgraph_app,
    budget_usd=5.00,
    max_hops=50,
    velocity_usd_per_min=2.0,
    on_trip="pause",
)

# same invoke you already call
result = app.invoke(inputs)
Complements, not competitors

Your gateway caps the org.
Breakerbox governs the workflow.

Run both. A gateway like LiteLLM caps org-wide key spend; a builder like Langflow is great for prototyping. Neither governs the dollar-budget or internal structure of a single multi-agent run — that’s the gap Breakerbox fills: it guards the workflow and runs nothing.

Gateways · LiteLLM
Builders · Langflow
breakerbox
Per-key / org dollar budgets
✓
—
— use your gateway
Hierarchical per-agent escrow
flat session
—
✓
Stop at hop boundary, resume from checkpoint
429 mid-flight
—
✓
Catches a runaway run under the org ceiling
never fires
—
✓
Cost forecast before you run
after the fact
after a run
✓ on the canvas
Visual builder output
n/a
hosted flows
plain Python
Executes your code server-side
n/a
yes
never
Stores your provider keys
yes (proxy)
yes
never
The catch most gateway users miss

A key limit has to sit high enough not to block real work — so a single runaway run can burn $180 while still under a $500 ceiling. The key never fires until the damage is already account-wide, and then it 429s everyone. Breakerbox trips that one run at $2, at a hop boundary, before the org ceiling ever notices.

A key limit is the fuse box for the building. Breakerbox is the breaker on this circuit.

Facts as of launch — see the README comparison for sources and specifics.

Why no run button

The safest server is the one
that doesn't exist.

Flow-building platforms that execute workflows server-side — with your API keys stored next to them — became one of this year's favorite attack surfaces: unauthenticated RCEs, active exploitation, a spot on CISA's must-patch list. Not because of sloppy code. Because a server that runs user flows and holds credentials is a target by definition.

So we removed the target. Breakerbox generates code instead of hosting it. Your graph becomes plain Python; it runs on your machine, where your keys already live.

NEVERserver-side execution of your graphs
NEVERstoring your provider API keys
NEVERan LLM supervising the hot path
0
servers to patch
0
keys stored
0
line to integrate
0%
your code · MIT forever

"Dashboards are autopsies. A budget that trips between steps is a seatbelt. Agents need seatbelts."

— the thesis behind breakerbox
Open source · MIT forever

Flip the switch
before your agents do.

Read the docs
Questions · Collaboration

Need a hand,
or want to build together?

Wiring a budget into your agent and hit a wall, or wondering whether Breakerbox fits your stack? Ask in the open — you'll usually get a faster answer and it helps the next person. Building something adjacent, want to partner, or need hands-on help? Reach out directly.

Ask on GitHub DiscussionsEmail me

Found a bug? Open an issue. Prefer email? amit.cellebrite@gmail.com.