⚠ LLMjacking is a spend problem before it's a security problem

Your agent can burn $373/hour.
Ours gets told no in a millisecond.

The Agent Cage is a local runtime control appliance that sits between your AI agents and everything they touch. It tracks token and cost velocity turn-by-turn, hard-drops runaway burn before provider billing would notice, blocks unsafe destinations by default — and signs a receipt for every denial.

Validated in the shipped test suite: a $373.78/hr burn-rate fixture caught with a millisecond-class local HARD_DROP — no cloud round-trip, no billing-alert lag.

FinOps Velocity Guard ● FINANCIAL_VELOCITY_ABORT
$373.78/hr policy cap $40/hr
t−90sHARD_DROPnow
HARD_DROPburst acceleration exceeded policy · turn 47
ABORTFINANCIAL_VELOCITY_ABORT
DCR ✓denial receipt signed · Ed25519 · verifiable offline

The problem

Cloud billing tells you tomorrow. Your agents spend right now.

A compromised, looping, or prompt-injected agent burns model tokens at machine speed — LLMjacking-style financial exposure that provider-side billing alerts report hours later. And the same runaway agent that's burning your budget is usually doing something else you didn't approve: calling tools, writing files, reaching endpoints. Spend anomalies and capability violations are the same incident. They need one control point.

FinOps Velocity Guard

Tracks token and cost velocity turn-by-turn at the gateway. When burn-rate exceeds your policy, it emits a HARD_DROP verdict locally — in milliseconds, before the provider bills the next turn.

Evidence: FINANCIAL_VELOCITY_ABORT telemetry + burn-rate line in Control Tower

Destination Guard

Every command, file write, network egress, and tool call is normalized into one destination request and checked against a signed capability manifest. Deny-by-default: ALLOW, DENY, or APPROVAL_REQUIRED.

Evidence: 9/9 scenario suite — trading writes, PHI leaks, webhook exfil all denied

Signed Denial Receipts

Every block produces an Ed25519-signed Denied Capability Receipt — verifiable offline by an auditor who doesn't have to trust you. Tampered receipts fail verification.

Evidence: cfa receipt verify — offline, no vendor dependency

How it works

Let the model reason. Control what it can reach — and what it can spend.

The Agent Cage deploys next to your agent runtime as a local appliance — an OpenAI-compatible gateway in front of model calls, a policy check in front of sensitive tools. Prompts and data never leave your host for inspection.

01 · COMPACT

Shrink the blast radius

Noisy context is compacted; volatile fields and credential-like tokens are extracted and hashed before anything reaches a model.

02 · MASK

Scrub in-stream

Keys, PANs, PHI, and injected role-confusion blocks are masked by streaming detectors — no model, no false-positive drift.

03 · DECIDE

Check the manifest

Destination requests and burn-rate are evaluated against signed policy. Millisecond-class local decisions; fail-closed on tamper.

04 · PROVE

Sign the receipt

Denials emit signed DCRs; everything threads one transaction ID into your SIEM — Splunk, Sentinel, or JSONL.

What we don't claim: the FinOps guard is a local runtime guardrail, not a billing guarantee — it flags suspicious token velocity and records abort evidence on traffic routed through the appliance; it cannot cap what never passes through it. Kernel-level enforcement (seccomp/eBPF cages) is validated on Linux hosts and ships in preview as dry-run. We publish exactly what is enforced versus advisory — ask for the claims registry.

Where it sits

One appliance on your host. Two integration points. Nothing leaves for inspection.

The Agent Cage is not a background watcher — it's a checkpoint you route through. Any agent that can point at a custom OpenAI-compatible endpoint is governed from its next request; any tool or action you front with the destination check is governed from its next call.

Governed from the next request. No SDK, no code rewrite: if your agent framework accepts a custom endpoint — most coding agents, IDE assistants, and self-built stacks do — configuration is one line. Tools onboard one manifest entry at a time.
What this is not (yet): it won't silently govern a chat app in a browser tab or a desktop AI app that can't point at a custom endpoint. Traffic that never routes through the appliance isn't controlled by it — and we won't pretend otherwise. Transparent capture on Linux (eBPF, observe-first) is on the roadmap; ask about the pilot.

For your auditors

"Can you prove your AI was stopped?" Now you can.

EU AI Act Article 12 requires tamper-evident runtime logging for high-risk AI systems — enforceable since August 2026. A signed, offline-verifiable denial receipt answers the question auditors actually ask: not "do you have logs," but "can I verify them without trusting you." Retention-ready export maps to Articles 12, 18, and 19.

receipt        DeniedCapabilityReceipt/v1
transaction    01J9ZK4Q7RD8FA2M6C3T9EWX0B
verdict        DENY · FINANCIAL_VELOCITY_ABORT
destination    provider://gpt-enterprise
burn_rate      $373.78/hr · cap $40/hr
decided_in     <1 ms · local
signature      ed25519 ✓ verified offline

Pricing

Published pricing. No "contact sales" wall.

Every tier starts with a 14-day trial — subscribe on the Subscriptions page or request a watermarked evaluation bundle below.

Developer Workspace

$29 /user/mo · 5-seat min
  • Evidence compaction & PII scrubbing
  • Local key vault
  • Signed denial receipts
FinOps lives here

Enterprise Gateway

$2,500 /mo + $15/seat
  • FinOps velocity guard & hard-drop
  • OpenAI-compatible gateway, SSO identity
  • Streaming masking, sufficiency holds
  • Control Tower HUD

Host-Enforced Container Cage

$7,500 /mo + $10/seat
  • Linux host enforcement (preview)
  • eBPF enforcer & SIEM/SOC collectors
  • Vertical fabric lookbooks

Controlled evaluation

Watermarked, signed, 14-day local trial.

Every evaluation bundle is per-evaluator watermarked, checksummed, and Ed25519-signed — verify it before you run it. It runs entirely on your machine; nothing phones home.