tokenrein Deploy

Budget every agent run

Tokenrein is a self-hosted guardrail for AI agents: a dollar limit on every run, a loop guard, and a person who decides when the money runs out.

What stops a run Rollout Agents
A run, live

ticket-4812 · support-bot · claude-sonnet-4-5

Paused, waiting for approval

$5.00 of $5.00 run budget

Deploy in five minutes

ticket-4812

support-bot / support-bot · asked 2:03 PM

budget spent $5.04 of its $5.00 budget

Add $5.00ApproveStop the run
The Approvals page: a run that used up its budget

cc-7f3a · claude-code

  1. 14:21:02 Bash npm test allowed
  2. 14:21:40 Bash npm test allowed
  3. 14:22:15 Bash npm test allowed
  4. 14:22:51 Bash npm test allowed
  5. 14:23:30 Bash npm test allowed
  6. 14:24:06 Bash npm test paused
A run's tool calls, paused at the sixth identical one

nightly-triage · batch

Last minute
$2.40
Limit
$1.00 a minute
State
paused
A batch run that started spending too fast

research-agent · r-2291

Calls
400 of 400
Spent
$3.12
State
paused
A run that reached its limit on calls
RunStateSpendAction
cc-91berunning$1.20Pause
codex-4c02paused$6.85Resume
gemini-77a0running$0.44Pause
The Runs page: pause, resume or kill any run

What stops a run

A run budget in Ask mode pauses the run and asks an approver for more.

First, watch every run

Connect a team's agents with every limit in Check mode. Nothing is blocked, and from the first day you see spend per person, per agent and per run.

Overview · acme · October

Spend this month
$1,284.10
Live agents
37
Active runs
12
Enforce would have blocked
9 requests · $46.20
The Overview in the first week

Tokenrein app · 2:03 PM

Run ticket-4812 is waiting for approval

support-bot spent $5.04 of its $5.00 run budget.

Open approvals

An alert in a Slack channel

Keys & limits · acme

Run (default)
$5.00 · Ask
Agent per day
$20.00 · Enforce
Loop guard
Pause and ask
Same request
6 times in 10 min
Limits moved from Check to Enforce and Ask

Spend by project · last 30 days

platform$1,412.6041 people
mobile$988.1523 people
data$640.0214 people
support-bot$212.40agent
Spend by project, for chargeback
  1. Watch
  2. Alert
  3. Enforce
  4. Expand

Your agents

Claude Code, Codex CLI, Gemini CLI, Cursor and the agents you build. One command on each developer's machine; usage comes from each agent's own telemetry, so prompts never pass through Tokenrein.

# ~/.codex/config.toml
[otel]
log_user_prompt = false
exporter = { otlp-http = {
  endpoint = "…/v1/otel/v1/logs",
  protocol = "json" } }
OpenAI Codex CLIUsage from its OpenTelemetry logs; stops with command hooks.
# from the dashboard's Connect page
curl -fsSL https://tokenrein.acme.internal/connect/claude-code.py \
  | python3 - --key tr_… --url https://tokenrein.acme.internal:8787

Connected. New Claude Code sessions report
to Tokenrein.
Claude CodeCost per call from its telemetry, subscriptions included; stops the next prompt, tool call or sub-agent with HTTP hooks.
// ~/.gemini/settings.json
"telemetry": {
  "enabled": true,
  "otlpProtocol": "http",
  "logPrompts": false
}
Gemini CLIUsage from OpenTelemetry; stops with command hooks.
// ~/.cursor/hooks.json
"preToolUse": [{
  "command": "python3
    ~/.tokenrein/hook.py cursor"
}]
CursorStops with hooks; usage imported from the team Admin API.
# your own agents
client = guard.openai(OpenAI())
with guard.run("ticket-4812",
               budget_usd=5):
    client.chat.completions…
Python and TypeScript SDKsOne line around an OpenAI, Anthropic or OpenAI-compatible client.

Every change
on the record

Read the enterprise guide

Single sign-on with Okta, Entra ID, Google or any OpenID Connect provider. Four roles per org. Provider keys encrypted and never shown again; prompts never stored. Everything people change is kept in an append-only log you can export to your SIEM.

  1. Single sign-on turned onOkta · people sign in with company accounts

    sam@example.com

  2. Groups mapped to rolesai-platform-admins → admin

    sam@example.com

  3. Coding agents pack appliedevery limit in Check mode

    sam@example.com

  4. Alert channel addedSlack · #ai-spend

    dana@example.com

Pricing

$0for the first year

For ten teams rolling out coding agents now: the enterprise licence free for a year, a shared Slack channel with the people who build Tokenrein, and the connectors you need built first. In return, fifteen minutes of feedback a week.

Apply as a design partner

Questions, answered

Does Tokenrein see our prompts?

No. Coding-agent connectors and the SDKs' default mode send only usage (model, tokens, cost, run, user); the agent keeps calling its provider directly. The loop guard keeps a SHA-256 hash of each request, not the request. Proxy mode is optional, and even then nothing is stored.

We already set spend limits with the provider.

A provider limit covers a whole account, after the money is spent, at one provider. Tokenrein acts before each call, per run, per agent, per person and per project, across providers, and a run that hits its limit can wait for a person instead of failing.

What happens if Tokenrein is down?

Agents keep working. Tokenrein fails open by default: the hooks answer "allow" after four seconds and the SDKs carry on. An org can switch to fail-closed if it would rather stop.

Does it slow our agents down?

About a millisecond. In our load test one instance added 1 ms at the median and 2.2 ms at the 99th percentile at 10,000 calls a second, with every budget enforced and no errors. A model call takes seconds; add instances for more traffic.

Can a paused run carry on?

Yes. An approver adds budget from the Approvals page or the alert, and the run continues from the call it stopped at. Every request and decision is in the audit log.

Which agents and models does it cover?

Claude Code, OpenAI Codex CLI, Gemini CLI and Cursor through connectors, and your own agents through the Python and TypeScript SDKs for OpenAI, Anthropic and any OpenAI-compatible provider: Gemini, Groq, Mistral, DeepSeek, OpenRouter, Ollama.

What does it need to run?

One stateless binary, Redis 7 and Postgres 15 or newer. Docker Compose for one host, a Helm chart for Kubernetes. It runs as non-root on a distroless image, with Prometheus metrics and readiness probes.

Is it open source?

The server is source-available under the Elastic License 2.0: run it and change it in your own infrastructure, but not resell it as a hosted service. The SDKs and connectors are Apache-2.0.

Up in five
minutes

Tokenrein, Redis and Postgres on one host with Docker Compose, or on Kubernetes with Helm. Then create the first owner and connect an agent from the dashboard.

Deploy Tokenrein

git clone https://github.com/tokenrein/tokenrein
cd tokenrein/deploy && cp .env.example .env
echo "TOKENREIN_PUBLIC_URL=https://tokenrein.acme.internal" >> .env
docker compose up -d
docker compose exec tokenrein tokenrein create-owner you@company.com