guard(app) with no budget is observe mode — nothing enforced. It records the real dollar cost of every run, learns your true distribution, and hands you a cap to accept. Then it enforces that number in-process, between every hop.
Agents call models in loops. A retry loop. A "let me try one more approach." An infinite tool loop. Nothing crashes — the run looks healthy right up until accounting reads it back to you.
Org-wide and coarse. A runaway run burns $180 while still under a $500 key ceiling — and when the key finally trips, it 429s everyone, mid-flight.
They show cost after it happened, beautifully. Observation, not enforcement. A smoke detector is not a sprinkler.
Outside the process, blind to internal structure — sub-agents, loops, checkpoints. And they hold your keys.
A key limit is the fuse box for the building. Breakerbox is the breaker on this circuit.
One callback handler propagates down the entire run tree — nodes, sub-agents, subgraphs. One wrap meters everything. No LLM in the hot path. Deterministic. In-process.
Before each call, hold the maximum possible cost against the budget. Parallel branches cannot race past the ceiling.
Run the call to completion — never severed mid-flight. You never pay for a half-finished token stream.
Settle the hold against actual usage. Enforcement lands at the hop boundary — the next step simply never dispatches.
Parent holds $5.00; sub-agents draw slices they cannot exceed. sub_budgets={"researcher": 2.00}
Fuzzy repeat matching, no LLM. Trips a spinning loop before the budget pays for it.
on_trip="pause" checkpoints state so you resume. kill lists every side effect that already fired.
A static, worst-case dollar ceiling computed from the spec — before the run, with zero API calls. DAGs sum their worst cases. Capped loops multiply hops by the costliest call.
And when a loop has no cap, it prints UNBOUNDED instead of inventing a number. An estimate you can't trust at the tail is worse than no estimate.
$ breakerbox ceiling spec.json method static analysis · 0 API calls rule DAG → Σ worst-case(node) plan → research → draft → review 4 nodes · 0 unbounded ┌──────────────────────────────┐ │ CEILING $2.09 │ └──────────────────────────────┘ this file cannot cost more than $2.09
Prompt-level red-teamers grade text. Breakerbox asserts properties at the tool-call level, at runtime. Four commands, one finding format, composable into CI.
Names the uncapped loop as the attack surface and prices the worst case per invocation.
Scans exported Langflow flows for the CVE-2026-55255 class, plus untrusted→action paths with no approval gate.
Hardcoded secrets, unpinned npx @latest supply chain, non-TLS remotes.
Accept today's findings once; CI then fails only on new ones.
guard(capability_lock=True)
mark_untrusted(tool)After untrusted content enters the run, side-effecting tools are blocked before they execute — not flagged afterwards.
app = guard( compiled, budget_usd=5.00, # hard dollar ceiling sub_budgets={"researcher": 2.00}, # hierarchical escrow max_hops=40, max_depth=3, ttl_seconds=900, velocity_usd_per_min=0.50, # burn-rate rail detect_loops=True, # semantic, no LLM capability_lock=True, # block side effects post-untrusted on_trip="pause", # or "kill" live=True, alerts=..., tags=..., otel=True, )
lock --checkPin prices and ceilings; fail the build on drift.diff --fail-on-increaseBudget delta between commits, as a sticky PR comment.breakerbox.yamlPolicy-as-code: the build refuses to emit violating code.tags · otelPer-team cost attribution and OpenTelemetry spans.A React Flow canvas that emits plain guarded Python. Codegen only — nothing executes server-side, keys never leave the browser. Live run timeline, remote pause/kill with per-run control keys, shareable receipt links.
No server. No stored keys. No LLM in the hot path. Add it to one run and the ceiling is real from the next hop onward.
$ pip install breakerbox from breakerbox import guard app = guard(compiled, budget_usd=5.00, on_trip="pause") app.invoke(state)