Stop runaway agent spend and risky actions before they execute.
Self-hosted, no prompt storage. Apache 2.0.
Cycles checks budgets before execution. Your application controls tool permissions and enforces the result.
Blast radius
Mocked tools. A configured toolset budget.
Without Cycles: All four actions execute — including the customer email.
With Cycles: Internal actions proceed; the host skips the email when its reservation is rejected.
reserve → 409 BUDGET_EXCEEDED → no email send
Run the action-authority demo →Cost runaway
Same agent. Same bug. Simulated costs.
Without Cycles: ~$10 in 12s in this accelerated recording; the local demo runs to ~$5.95 in ~30s.
With Cycles: The $1 budget rejects the next reservation; the host skips the call.
reserve → 409 BUDGET_EXCEEDED → no downstream call
Run the runaway demo →
240 iterations. $52.80 in modeled spend.
In an illustrative coding-agent loop, an ambiguous error triggers 240 iterations over three hours. At the stated average token usage and prices, a mandatory $15 run budget rejects a protected call around iteration 68.
See the $15 run-budget example. →
200 mistaken emails. $1.40 in modeled token cost.
In an illustrative support-agent scenario, a template regression sends payment reminders instead of welcome messages. Business impact is unquantified. A token-spend budget can leave this activity within its limit.
Budget caller-assigned tool exposure. →
One customer's loop can exhaust a shared budget.
In an illustrative SaaS scenario, one research loop consumes a shared provider allocation and interrupts other tenants. Separate application ledgers can bound each tenant's submitted usage on protected paths.
Configure tenant budget isolation. →
Can you explain the budget decision before a call?
Reservation lifecycle records show submitted scopes, budget decisions, and settlement. Correlate them with application logs for tool authorization and outcomes.
Inspect budget enforcement evidence. →Tool exposure limits today use risk budgets configured by your application. Server-enforced action-kind quotas and action-kind allow/deny policies remain preview features.
Shared spend and caller-assigned exposure budgets for operations you instrument.
@cycles reserves budget before the action runs. No remaining cycles — no action.
from runcycles import cycles
@cycles(estimate=5000, action_kind="llm.completion", action_name="openai:gpt-5")
def ask(prompt: str) -> str:
return openai.chat.completions.create(
model="gpt-5",
messages=[{"role": "user", "content": prompt}]
).choices[0].message.content
Run the local demo
~5 min
One script, no API keys. Watch a runaway agent stopped at the $1 cap in ~30 seconds.
Start →
Wrap one LLM call
~10 min
One @cycles decorator (Python) or withCycles wrapper (TS) on a single function.
Start →Wrap one tool call
~30 min
Assign a tool-exposure estimate and require a reservation before dispatch. Your application authorizes the tool.
Start →Shadow mode
1+ day
Enforce in dry-run against real traffic. Calibrate budgets without blocking.
Start →Hard enforcement
Production
Flip one workflow to live enforcement. Expand from there.
Start →Most teams reach out for one of four reasons — they all land in the same inbox, and a founder reads every one.
Running a real agent workload and evaluating Cycles? Apply to become a design partner →
Found a bug or have a concrete technical issue? Open a GitHub issue instead — it’s faster for everyone.
