Enforcement, not monitoring

Kill the runaway agent before it kills your bill.

Hard dollar and token caps per agent, checked before every call. Agent sessions burn 10 to 50x the tokens of a normal chat. Uber torched its entire 2026 AI coding budget in 4 months.

Put a cap on it → See how the kill works

HN on the Uber burn402 pts

Tokens vs a normal chat50x

One stuck loop, one night$800

Budget check per call<5 ms

SCROLL ▾

Live spend, and the kill

You read every agent like a statement. The proxy pulls the plug at the cap.

Killswitch sits between your agent and the LLM API. Every call is attributed to an agent, priced from a model table, and checked against the cap in under 5ms. Cross the line and the next call is rejected, logged, and replayed.

killswitch / org / checkout-agent WINDOW: sessionKILL ARMED

SESSION SPEND vs CAP ($50.00)$49.10

98.2% of cap

TOKENS THIS SESSION vs CAP4.12M

71% of token cap

gpt-4o · call 0341$0.42OK
gpt-4o · call 0342$0.51OK
gpt-4o · call 0343$0.47OK
gpt-4o · call 0344BLOCKEDKILL

call 0344 would have pushed spend to $50.61, past the $50.00 cap. Rejected before it reached the provider. $0.00 charged.

What's on the ledger

Six line-items. One job: no agent spends past its cap.

Every feature is enforcement or the observability around it. Built for the team that got the surprise bill, not the one reading a dashboard after the fact.

01Hard budget caps at the proxy layerRegister each agent with a dollar cap, token cap, and window. The proxy checks projected spend before it forwards a call and rejects it the instant a cap would break. The kill lands before the provider charges.session / daily / monthly

02Every call priced and attributedAn append-only ledger records model, tokens, dollar cost, and status for every call, keyed to an agent and project. Running totals stay hot so the engine reads current spend fast.<5ms spend read / call

03Warnings before the killFire a webhook, Slack, or email at 75% and 90% of cap. You get time to raise the cap or inspect the agent before the kill trips at 100%.75% / 90% / 100%

04Swap one base URLPoint OPENAI_BASE_URL at Killswitch and keep your agent code. OpenAI, Claude, and Gemini via the OpenAI-compatible shape, streaming passed through byte for byte.3 providers, zero code changes

05Org > Project > Agent budgetsSet a monthly org cap, a per-project sprint cap, and a per-agent session cap. A call is checked against all three and the exceeded level is named in the kill.3-level enforcement

06The $800 post-mortemEvery killed session is captured as a replay: the call sequence, cumulative spend per step, and a flag when the same prompt repeats 3+ times. The telltale of a stuck loop, made readable.loop flagged at 3x repeat

Pre-launch · the receipts

No testimonials yet. Here is the demand, in public.

Killswitch is pre-launch, so there is nothing fake here. These are 6 real sources on the exact problem: 4 Hacker News threads, a GitHub repo, and a benchmark report. Every number below is theirs.

"Built this after watching a friend's side project rack up $800 in one night from a stuck loop."

dipampaul17, author of AgentGuard · 168 stars on the OSS kill-switch · github.com/dipampaul17/AgentGuard

Hacker News402 pts

Uber torches 2026 AI budget on Claude Code in four months

No per-agent caps, no kill switches. Finance found out at the quarterly close.

Hacker News306 pts

Are the costs of AI agents also rising exponentially?

Consensus: agentic loops consume 10 to 50x the tokens of a single-shot prompt. No clean answer for hard enforcement.

Benchmark200 deploys

AI agents burn 50x more tokens than chats

LeanOps benchmarked 200 enterprise deployments. One stuck agent can eat a week's budget in an afternoon.

GitHub168 stars

AgentGuard: auto-kill agents before they burn the budget

Clear demand. But free OSS, single maintainer, no dashboard, no teams, no pre-kill alerts, no MCP.

Show HN73 pts

The missing pieces around the kill

Comments ask for multi-team policies, real-time dashboards, MCP-native enforcement, and alerts before the kill.

Hacker News28 pts

Uber blows through its AI budget in 1 quarter

Leaked internal report: the org-level API key had no sub-limits. No per-project or per-agent enforcement.

Questions

The parts people ask about first.

No. You point OPENAI_BASE_URL at the proxy and swap your key for a proxy key scoped to an agent. The agent code stays exactly the same.

Yes. OpenAI, Claude, and Gemini through the OpenAI-compatible request shape, plus a passthrough mode for others. Streaming is proxied byte for byte after the budget check.

It stops the call. The proxy rejects the request before it reaches the provider, so the kill happens before you are charged, not after. Soft SDK limits only advise; a stuck agent can walk past them.

The engine uses a conservative upfront estimate to run the budget check, then reconciles the real cost on the stream-close event and writes it to the ledger.

The running spend for each agent is kept hot, so the budget check reads current spend in under 5ms before forwarding.

AgentGuard proved the demand with 168 stars, but it is a single-maintainer OSS library: the kill only, no dashboard, no org and project budgets, no pre-kill alerts, no MCP. Killswitch adds the enforcement layer plus the team governance and observability around it.

Close the account

Set the cap once. Never read a surprise bill again.

Point your base URL at Killswitch, set a dollar and token cap per agent, and let the proxy pull the plug at 100%. Alerts at 75% and 90% give you the warning first.

Put a cap on it →

Pre-launch. 6 real demand sources. Enforcement at the network layer, not a dashboard after the fact.