The Agent Cage is a local runtime control appliance that sits between your AI agents and everything they touch. It tracks token and cost velocity turn-by-turn, hard-drops runaway burn before provider billing would notice, blocks unsafe destinations by default — and signs a receipt for every denial.
Validated in the shipped test suite: a $373.78/hr burn-rate fixture caught with a millisecond-class local HARD_DROP — no cloud round-trip, no billing-alert lag.
The problem
A compromised, looping, or prompt-injected agent burns model tokens at machine speed — LLMjacking-style financial exposure that provider-side billing alerts report hours later. And the same runaway agent that's burning your budget is usually doing something else you didn't approve: calling tools, writing files, reaching endpoints. Spend anomalies and capability violations are the same incident. They need one control point.
Tracks token and cost velocity turn-by-turn at the gateway. When burn-rate exceeds your policy, it emits a HARD_DROP verdict locally — in milliseconds, before the provider bills the next turn.
Evidence: FINANCIAL_VELOCITY_ABORT telemetry + burn-rate line in Control Tower
Every command, file write, network egress, and tool call is normalized into one destination request and checked against a signed capability manifest. Deny-by-default: ALLOW, DENY, or APPROVAL_REQUIRED.
Evidence: 11/11 scenario suite — trading writes, PHI leaks, webhook exfil, poisoned memory writes, and MCP tool misuse all denied
Every block produces an Ed25519-signed Denied Capability Receipt — verifiable offline by an auditor who doesn't have to trust you. Tampered receipts fail verification.
Evidence: cfa receipt verify — offline, no vendor dependency · schema reference · standalone verifier
How it works
The Agent Cage deploys next to your agent runtime as a local appliance — an OpenAI-compatible gateway in front of model calls, a policy check in front of sensitive tools. Prompts and data never leave your host for inspection.
Noisy context is compacted; volatile fields and credential-like tokens are extracted and hashed before anything reaches a model.
Keys, PANs, PHI, and injected role-confusion blocks are masked by streaming detectors — no model, no false-positive drift.
Destination requests and burn-rate are evaluated against signed policy. Millisecond-class local decisions; fail-closed on tamper.
Denials emit signed DCRs; everything threads one transaction ID into your SIEM — Splunk, Sentinel, or JSONL.
MCP gateway
CFA can sit in front of an HTTP JSON-RPC MCP server, inspect every tools/call, and decide before the upstream tool sees the request. Allowed calls pass through. Denied calls return a structured MCP error with a signed DCR that verifies offline.
The 10-scenario suite includes a real upstream MCP lab plus cfa mcp serve --upstream. The denied shell_exec_untrusted call is not forwarded.
Evidence: use-case-10-mcp-real-proxy · destination.policy
The same scenario proves an allowed tools/call reaches the upstream MCP server, so the proxy is a control point rather than a demo-only blocker.
Evidence: x-cfa-verdict: ALLOW on the upstream round-trip
Filesystem, GitHub, Slack, and Postgres templates ship under examples/mcp/, each with one allow and one deny path covered by CLI scenario smoke.
Where it sits
The Agent Cage is not a background watcher — it's a checkpoint you route through. Any agent that can point at a custom OpenAI-compatible endpoint is governed from its next request; any tool or action you front with the destination check is governed from its next call.
Point the base URL at the local gateway:
base_url = http://localhost:8787/v1
Front sensitive actions with the destination check before execution:
cfa evaluate-destination
Millisecond-class local decisions. Deny-by-default. Fail-closed on tamper.
Local HUD: burn-rate line, verdicts, receipts, scenario telemetry. Explore the live demo →
OpenAI · Anthropic · Gemini-style dispatch
ALLOW HARD_DROP over capRepos, databases, payment rails, endpoints, lifecycle hooks
ALLOW DENY + receiptSplunk · Sentinel · JSONL — every verdict threaded on one transaction ID
For your auditors
EU AI Act Article 12 requires tamper-evident runtime logging for high-risk AI systems — enforceable since August 2026. A signed, offline-verifiable denial receipt answers the question auditors actually ask: not "do you have logs," but "can I verify them without trusting you." Retention-ready export maps to Articles 12, 18, and 19.
receipt DeniedCapabilityReceipt/v1 transaction 01J9ZK4Q7RD8FA2M6C3T9EWX0B verdict DENY · FINANCIAL_VELOCITY_ABORT destination provider://gpt-enterprise burn_rate $373.78/hr · cap $40/hr decided_in <1 ms · local signature ed25519 ✓ verified offline
Pricing
Every tier starts with a 14-day trial — subscribe on the Subscriptions page or request a watermarked evaluation bundle below.
Controlled evaluation
Every evaluation bundle is per-evaluator watermarked, checksummed, and Ed25519-signed — verify it before you run it. It runs entirely on your machine; nothing phones home.