Open source · Self-hosted · Apache 2.0
RiskKernel puts deterministic cost, loop, and time budgets around your agents, with a real kill switch, crash-resumable runs, and human-approval gates. Self-hosted, your keys, no telemetry. Point it at the agents you already run with one environment variable.
One Go binary. Works with OpenAI, Anthropic, and your existing stack.
agent-run.sh
# point your existing agent at RiskKernel - one variable export OPENAI_BASE_URL=http://localhost:7070/v1 # every call is metered, logged, checkpointed, then forwarded with your key run a91f2c budget $5.00 · 50 loops · 30m enforcing ✗ killed at $5.00 ceiling - stopped mid-loop, before the bill ran ↻ resume a91f2c restored from checkpoint, no double-spend ✓ run a91f2c completed $5.00 spent · 0 wasted
The problem
Frameworks orchestrate agents. They do not put hard limits around them. So the same failures keep shipping to production, and they cost real money the moment an agent runs unattended.
01Runaway loops. An agent gets stuck reasoning in a circle and burns tokens until someone notices.
02Surprise token bills. No ceiling on spend per run. The invoice is the first alert you get.
03No kill switch. Nothing stops a run at a dollar, loop, or time limit. It stops when it is done, or when it breaks.
04Crashed long runs re-spend. A process dies hours in, and the restart pays for all the work again.
05No human in the loop. Side-effecting tool calls fire with no gate in front of the irreversible ones.
06No audit trail. When something goes wrong, there is no per-run record of what was spent or done.
What it does
Budgets, kill switches, and approvals belong in statically-typed code that runs the same way every time, not in a prompt. RiskKernel is that layer.
Set a dollar and token budget per run. The kill switch fires the moment the ceiling is hit, mid-loop, before the spend lands.
Cap iterations and wall-clock per run. Runaway loops die deterministically instead of grinding until someone notices.
Send kill -9 mid-run and resume from the last checkpoint. No re-spending the work already paid for.
The moat
Block any side-effecting tool call and route it for approval over CLI, web, or webhook. Framework-agnostic, the LLM cannot bypass it.
Emit GenAI spans for cost, loops, and checkpoints to Datadog, Grafana, Honeycomb, or whatever backend you already run.
One self-hosted binary on your infra. BYO provider keys, never stored in plaintext. Nothing phones home. It is verifiable in the source.
How it works
Start with zero code changes through the proxy, then reach deeper when you want loop-level and tool-level control. The enforcement logic is the same Go core underneath.
01 / proxy
An OpenAI-compatible endpoint. Set OPENAI_BASE_URL and every call is metered, capped, logged, and forwarded with your key. No rewrite.
02 / sdk
Wrap a run for loop counts, time budgets, checkpoints, and approval gates. Adapters for LangChain, the Claude Agent SDK, and the OpenAI Agents SDK.
03 / otel
Ingest GenAI spans from apps you have already instrumented, and export to the observability backend you already pay for.
The LLM proposes. Deterministic code disposes.
Reasoning stays with the model. Every budget, gate, and kill switch is plain compiled logic that runs the same way every time.
Open source
The runtime is Apache 2.0 and stays feature-complete. No license gates, no phone-home, no lock-in. It is a single Go binary you run on your own infrastructure, with your own provider keys.
Apache 2.0
permissive license
Single binary
Go, ~30-60 MB
Zero telemetry
verifiable in source
$ docker run ghcr.io/prashar32/riskkernelrun
$ pip install riskkernelpython sdk
$ go install github.com/prashar32/riskkernel@latestfrom source
Early access
The runtime is open source today. The hosted dashboard, runs, spend, and approvals in one place, is in private beta. Join to get early access and launch updates. No spam.
We will only email you about RiskKernel. Unsubscribe anytime.
Contact
Building agents in production, evaluating RiskKernel for your team, or want to be a design partner? Reach out.