Belay
v0.7.0A seatbelt for OpenClaw agents.
Spend caps, model-call and tool-call rate limits, and a graceful pause ladder, running inside your gateway. Your agent doesn't get killed — it gets caught.
warn → block a tool call → end the runfathomforge
Agents fail quietly.
That's the expensive part.
I'm Carlos M., a security engineer. I run five autonomous agents in production and write about what goes wrong with them — then build the open-source guardrails I wanted to exist beforehand.
- Unguarded — $169, off the top of this chart
- With Belay — caught at $23.80
- 00:41 warn spend 60% of run cap — operator notified
- 01:07 block tool call blocked — rate 48/min over limit
- 01:52 end run ended — next call would exceed cap
Recent writing
-
Three shapes of a runaway
Five months of production agent logs, and almost every expensive incident is one of three patterns. None of them look like failures while they're happening.
-
Prompt injection is a blast radius problem
You cannot reliably detect the attack. So stop making detection the control, and start bounding what a successful one costs you — including being honest about which bounds you actually have.
-
Reading usage without reading prompts
A guardrail sees everything an agent says. Here's how to build one that enforces a spend cap without ever being able to reconstruct a conversation.
Open source
Built because the alternative was a kill switch.
Everything I build here is MIT-licensed, free, and designed to be auditable in an afternoon. No telemetry, no account, no network calls you didn't configure yourself.