GM-Data-Labs/agent-tripwire

**Hard caps, a loop killer, a spend ledger, approval gates, gates for daemons and silent installs, a tool-output and token-burn watchdog, and a done/failed watchdog for the Claude Code CLI and the OpenAI Codex CLI.** Free, MIT, one Python file, stdlib only, no telemetry.
Agent Tripwire plugs into each CLI's own documented hook system (Claude Code hooks, Codex hooks). It does not wrap, proxy or patch either CLI.
Why this exists (the evidence)
- **826 agents, ~$78,000, no report.** *"My OpenAI CODEX account went rogue and from a simple request took the autonomous decision to launch 826 parallel agents / threads without any authorization… consuming a total of roughly USD 78,000 and deleting all records of what was done."* (HN 49861047)
- **An agent signed a contract on its own.** *"It downloaded the PDF contract. Found a saved signature PNG on my computer, placed it at the right spot within the contract and prepared to send it when I intervened."* (HN 49798257)
- **Usage burn nobody can explain, and silent failures.** Replies to this X thread (Oct 12, 2026, 600+ replies), for example:
- *"We need better ways to understand how we're burning our usage! Some of us burn it all in 4 days… None of us understand why."* (@ArbitraryFlux)
- *"…it eagerly jumps in, keeps excitement high only to go completely silent in couple of hours leaving it to you to discover that it ran out of steam/tokens."* (@rosiwan07)
- *"A real-time usage meter the bot itself can read (and throttle against) would help."* (@STate84182)
- *"Can we get an option to limit tok/s to whatever would max out the weekly allotment? I'm tired of running out in 1 day."* (@ubermetroid)
- The thread itself starts from a coordinator bot that, by default, *"reads everything they do constantly"* when spinning up lots of agents, and the suggestion that it *"should warn when spiking usage."* (@EMostaque)
New in v0.2:
- **A coding agent that installs a persistent, self-updating daemon by default.** Since Codex CLI 0.157.0, opening an interactive session *"starts a persistent background daemon"* that keeps running after every window is closed, copies a ~374 MB package into ~/.codex/packages/… and *"starts a detached updater … that checks for updates 5 minutes after start and then hourly."* (openai/codex#48195). The HN thread (HN 50060694, 590 points) is full of people finding background processes, gigabytes of old versions and hourly restarts they never agreed to. Tripwire can't stop a CLI from doing this itself, but it can make sure **your agent** never sets up a service, launch agent, cron job, auto-updater, global package or shell-profile change without asking you first.
- **Tool output that burns tokens.** *"codex desktop (windows) burned 10M+ tokens in 46 min … code-mode exec results bypass truncation; context estimator ignores toolResult blocks. UI can look fine while usage melts."* (@thechadcoder)
- **Subagents eating the budget.** *"someone parsed a month of Claude Code logs: subagents ate 48% of all tokens. each one opens with a ~47k token request before doing anything."* (@arnabkarmkr)
Those threads are about several products. Tripwire covers the two CLIs that expose hooks.
What it does
| # | Feature | How |
|---|---|---|
| 1 | **Hard caps per session**: subagents, tokens, dollars, tool calls | PreToolUse denies the next call once a cap is hit. Subagent spawns (Agent/Task on Claude Code, spawn_agent on Codex) are counted and denied past the cap |
| 2 | **Loop killer** | The same tool and the same input more than N times in the last W calls gets denied, with a message telling the agent to change approach |
| 3 | **Spend ledger + daily budget** | JSONL ledger per day, tripwire summary with per-tool / per-agent / per-session breakdowns, and a "you'll run out early" warning when today's pace projects past your budget |
| 4 | **Human approval before irreversible actions** | Regex rules for send, sign, delete, submit, purchase/order, git push --force, rm -rf. Claude Code shows its native approval prompt. Codex blocks the call until you run tripwire approve |