Product

A firewall for what your agents spend.

Guardrail runs on your machine. For supported proxy integrations, it meters requests and refuses those that violate your configured policies before forwarding them. Telemetry-only integrations show usage but do not block requests.

How it works

The life of one request.

In a supported proxy integration, your tool sends its request to localhost:4000 instead of the provider. Six things happen, in this order, and the third is the one that saves you money.

1

Authorize

Guardrail checks the request came from a tool on this machine. It binds to localhost, so nothing off the machine can reach it.

2

Resolve the session

The call is attributed to a session, and through it to a project — which is what makes a per-session budget mean anything.

3

Check your policies

Spend, request, token and rate limits are evaluated now, before any network call. Over budget and the request stops here: your tool gets a clean 429 and the provider is never contacted.

4

Swap auth and forward

Your own credential is relayed untouched and the body is forwarded byte for byte. Guardrail does not rewrite your prompt, add instructions, or change your model.

5

Read the response as it streams

The reply streams to your tool while a copy is scanned for the usage numbers — model, tokens, cache reads and writes, reasoning tokens. Nothing is buffered or delayed.

6

Record the metadata

Cost is estimated from those numbers and written to a local SQLite file with the timings and status. The prompt and the response are discarded.

Tool & login compatibility

Know what is protected before you connect.

Blocking requires a supported proxy integration. Codex with a ChatGPT subscription is visibility only; Cursor support is planned.

5 matching integrations.

Documentation reviewed 2026-09-11. Minimum binary versions have not been recorded for these entries; this is not a version-certification tool. Run guardrail doctor and check the integration guide.

Agent frameworks

Private preview

OpenAI-compatible Chat Completions API

Visibility
Metering in preview
Pre-send blocking
Preview

Proxy integration is in preview; confirm your framework and policy behavior before relying on it.

Read policy documentation

Cursor

Planned

Integration in development

Visibility
Not available yet
Pre-send blocking
Not available

Cursor support is planned. Do not rely on Guardrail to meter or enforce Cursor sessions today.

Read integration details

Policies

Budgets checked before the call.

On a supported proxy integration, Guardrail evaluates configured limits before forwarding a request. When one trips, your tool gets a provider-shaped 429 carrying the reason — an error it already knows how to handle — and the provider is never contacted, so the blocked call costs nothing.

Spend caps

A maximum estimated cost per session. The next call over the line is refused rather than sent.

Volume caps

Maximum requests, maximum tokens, or a requests-per-minute ceiling — the shape that catches a retry loop early.

Model rules

A denylist, so an expensive model cannot be reached from a project that should not be using it.

guardrail · protections
session spend cap        $2.00 per session      block
requests per session     200                    block
requests per minute      40                     warn
model denylist           claude-opus-*          block

Team plans push a shared set of project caps to every member’s machine, where they are enforced locally — so a cap keeps working even when the laptop is offline. Full detail in budgets and policies.

In the product

Where the money went.

Sessions are the unit: each carries its requests, tokens, cache behaviour and estimated cost. The hidden-cost view attributes the spend a plain token counter leaves unexplained — the cache write on a first turn, the reasoning tokens you never see.

guardrail · sessions
The sessions view listing recent agent sessions with request counts, token totals and estimated cost for each.
guardrail · hidden_cost
The hidden-cost view attributing spend to cache writes, cache reads and reasoning tokens.

Privacy

It reads the receipt, not the letter.

Guardrail has to see a request to forward it, and keeps almost none of it. What lands in the database is the accounting: which model, how many tokens, what it cost, how long it took, whether a policy stopped it.

Never written to disk

  • Prompt text and system prompts
  • Model responses and completions
  • Your source code and file contents
  • API keys, tokens and credentials
  • Tool call arguments and results
  • Raw request and response bodies

Enforced by tests that send a known secret through the proxy and scan every byte written to disk for it. The full field-by-field model is in the privacy documentation.

Getting started

Three commands, then a budget.

Install, activate, start — then point a tool at it with guardrail connect, which edits that tool’s own config and can be undone. The dashboard is at localhost:4000.

Runs on macOS, Linux, and Windows through WSL2.

Read the setup guideGet Guardrail

Roadmap

Being built next.

Listed so you can tell what ships today from what is coming.

Cursor support

Per-session activity metering and enforcement through Cursor Hooks.

Agent frameworks, generally available

LangChain and other OpenAI-compatible stacks work today in preview; per-agent attribution is in progress.

Fail-open relay

Traffic passes through untracked when the daemon is down, so stopping Guardrail can never interrupt your tools.

Put a runtime budget around your AI agents.

get guardrailview pricingjoin our discord