Product
A firewall for what your agents spend.
Guardrail is a single binary that runs on your machine, between your coding tools and their providers. It meters every call as it passes through, and refuses the ones that break the budget you set — before they are sent, so they cost nothing.
How it works
The life of one request.
Your tool sends its request to localhost:4000 instead of the provider. Six things happen, in this order, and the third is the one that saves you money.
Authorize
Guardrail checks the request came from a tool on this machine. It binds to localhost, so nothing off the machine can reach it.
Resolve the session
The call is attributed to a session, and through it to a project — which is what makes a per-session budget mean anything.
Check your policies
Spend, request, token and rate limits are evaluated now, before any network call. Over budget and the request stops here: your tool gets a clean 429 and the provider is never contacted.
Swap auth and forward
Your own credential is relayed untouched and the body is forwarded byte for byte. Guardrail does not rewrite your prompt, add instructions, or change your model.
Read the response as it streams
The reply streams to your tool while a copy is scanned for the usage numbers — model, tokens, cache reads and writes, reasoning tokens. Nothing is buffered or delayed.
Record the metadata
Cost is estimated from those numbers and written to a local SQLite file with the timings and status. The prompt and the response are discarded.
Supported tools
What it sits in front of.
Available now
Claude Code
Routed with ANTHROPIC_BASE_URL. Your existing subscription login is relayed untouched, so there is no API key to hand over. Full metering and full enforcement.
Available now
Codex
Routed as a custom model provider, and auto-detected per request: an API-key login is proxied and metered in full, while a ChatGPT-subscription login is tracked from the usage telemetry Codex emits.
Private preview
Agent frameworks
Anything speaking the OpenAI Chat Completions API — LangChain, LangGraph, CrewAI, the OpenAI Agents SDK — is metered by pointing OPENAI_BASE_URL at Guardrail. No SDK swap, no changes to your agent code.
Coming soon
Cursor
Cursor support is in progress through Cursor Hooks, giving per-session activity metering and enforcement alongside the tools above.
Policies
Budgets checked before the call.
Set a limit and Guardrail evaluates it on every request. When one trips, your tool gets a provider-shaped 429 carrying the reason — an error it already knows how to handle — and the provider is never contacted, so the blocked call costs nothing.
Spend caps
A maximum estimated cost per session. The next call over the line is refused rather than sent.
Volume caps
Maximum requests, maximum tokens, or a requests-per-minute ceiling — the shape that catches a retry loop early.
Model rules
A denylist, so an expensive model cannot be reached from a project that should not be using it.
session spend cap $2.00 per session block requests per session 200 block requests per minute 40 warn model denylist claude-opus-* block
Team plans push a shared set of project caps to every member’s machine, where they are enforced locally — so a cap keeps working even when the laptop is offline. Full detail in budgets and policies.
In the product
Where the money went.
Sessions are the unit: each carries its requests, tokens, cache behaviour and estimated cost. The hidden-cost view attributes the spend a plain token counter leaves unexplained — the cache write on a first turn, the reasoning tokens you never see.
Privacy
It reads the receipt, not the letter.
Guardrail has to see a request to forward it, and keeps almost none of it. What lands in the database is the accounting: which model, how many tokens, what it cost, how long it took, whether a policy stopped it.
Never written to disk
- Prompt text and system prompts
- Model responses and completions
- Your source code and file contents
- API keys, tokens and credentials
- Tool call arguments and results
- Raw request and response bodies
Enforced by tests that send a known secret through the proxy and scan every byte written to disk for it. The full field-by-field model is in the privacy documentation.
Getting started
Three commands, then a budget.
Install, activate, start — then point a tool at it with guardrail connect, which edits that tool’s own config and can be undone. The dashboard is at localhost:4000.
Runs on macOS, Linux, and Windows through WSL2.
Roadmap
Being built next.
Listed so you can tell what ships today from what is coming.
Cursor support
Per-session activity metering and enforcement through Cursor Hooks.
Agent frameworks, generally available
LangChain and other OpenAI-compatible stacks work today in preview; per-agent attribution is in progress.
Fail-open relay
Traffic passes through untracked when the daemon is down, so stopping Guardrail can never interrupt your tools.