Bound

Programmable spend vaults and financial rails for autonomous AI agents.

Quick Start • The Problem • Architecture • CLI Reference • SDK Integration

Autonomous AI agents (Claude Code, AutoGPT, CrewAI, LangChain, custom loops) are powerful, but they operate with unrestricted, blank-check authority:

1. Runaway Loop Bankruptcy: An infinite planning or debugging loop can burn $1,000+ in OpenAI or Anthropic tokens before you wake up.
2. The Credit Card Dilemma: You cannot safely hand raw API keys or credit card numbers to an LLM context. One prompt injection can hijack the credentials or spend them.
3. No Vendor-Neutral Leash: Cloud providers and payment processors have zero incentive to cap your spend.

Bound is a blazing-fast, single-binary proxy daemon written in pure Go. It sits between your AI agent and the outside world, acting as an intelligent financial governor and circuit breaker:

• Spend Vaults: Strict lifetime, daily, and hourly velocity limits per agent.
• Circuit Breakers: Detects runaway loops (>5 identical tool calls in 30s) and cuts connection instantly.
• Human-in-the-Loop Escrow: Automatically pauses the agent and sends an approval request (Telegram, Slack, Discord) for transactions exceeding a threshold (e.g. > $15).
• Cryptographic Ledger: Tamper-proof JSONL audit trail recording every prompt, tool call, dollar spent, and latency telemetry.
• Sub-2ms Latency: Zero garbage collection lag. Written in pure Go with zero runtime dependencies.

                                      BOUND GOVERNANCE PROXY
                                 ┌────────────────────────────────┐
┌──────────────┐                 │  1. Circuit Breaker Inspection │                 ┌─────────────────┐
│              │   HTTP Proxy    │     (Runaway Loop Detection)   │   HTTPS Upstream│  OpenAI / AWS   │
│  Your Agent  │ ──────────────> │                                │ ──────────────> │  Stripe / Cloud │
│ (Python/Go)  │ <────────────── │  2. Budget Vault Authorization │ <────────────── │  GitHub / APIs  │
└──────────────┘   X-Bound-Status│     (Daily/Hourly Spend Caps)  │                 └─────────────────┘
                                 │                                │
                                 │  3. Human Escrow / Webhooks    │
                                 │     (Telegram / Slack Alert)   │
                                 └────────────────────────────────┘
                                                 │
                                                 ▼
                                        ~/.bound/audit.jsonl

When autonomous agents malfunction or get stuck in recursive planning loops, they burn tokens and API quotas at compounding velocity. Bound actively monitors request rates and token burn in real time.

1. Normal Telemetry: Agent requests pass through with sub-2ms overhead and ledger tracking (ALLOWED @ $0.0023 avg).
2. Trip Wire Triggered: When a runaway agent exceeds the configured velocity ceiling (e.g. > 60 calls/minute), Bound's in-memory circuit breaker trips instantly.
3. Hard Quarantine: The dashboard alerts Circuit Breaker Engaged: Exceeded 60 calls per minute limit, switches proxy status to red lockdown, and severs upstream network connection.
4. Zero-Spend Interception: Every subsequent loop iteration is halted with BLOCKED status and $0.0000 charged. The remaining vault balance ($24.81) stays completely protected.

Instead of allowing silent runaway charges or hanging the process, Bound serves standard RFC 7231 402 Payment Required responses directly to the agent's HTTP client:

Agents cleanly receive:

{
  "error": "bound_governor_rejected",
  "reason": "spend cap or velocity limit exceeded",
  "circuit_breaker": "tripped",
  "action": "terminate_or_request_escrow"
}

macOS & Linux:

curl -fsSL https://raw.githubusercontent.com/404kernel/bound/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/404kernel/bound/main/install.ps1 | iex

Homebrew (macOS):

brew tap 404kernel/bound
brew install bound

Python SDK:

pip install bound-ai

Run the interactive setup wizard to link Telegram, Discord, or Slack:

bound setup

Run any Python, Node, or Go agent wrapped in strict budget caps:

bound run --budget 5.00 --hourly 2.00 -- python my_agent.py

bound proxy --port :8443 --budget 50.00 --hourly 10.00

Test velocity limits, runaway loop circuit breakers, and Telegram escrows in real-time:

go run ./scripts/simulate_traffic.go

Whenever the proxy is running, navigate to:

http://localhost:8443/dashboard

Features:

• Live Stream: Auto-refreshing table of intercepted agent calls and costs
• Spend Gauges: Real-time visualization of daily caps and velocity limits
• Emergency Kill Switch: One-click freeze to instantly disarm all outbound agent traffic
• Agent Pools: Per-agent spend breakdown and active audit records

import os

# Point any standard LLM SDK to Bound's local governor
os.environ["OPENAI_BASE_URL"] = "http://localhost:8443/v1"
os.environ["HTTP_PROXY"] = "http://localhost:8443"

from openai import OpenAI
client = OpenAI() # Now 100% governed by Bound

package main

import (
    "github.com/404kernel/bound/pkg/vault"
    "github.com/404kernel/bound/pkg/governor"
)

func main() {
    v := vault.NewVault(vault.DefaultPolicy(), "")
    gov := governor.NewGovernor(governor.DefaultConfig(), v)

    // Evaluate proposed tool call or spend before execution
    decision := gov.Evaluate("agent-01", "api.stripe.com", "charge_customer", 12.50)
    if !decision.Allowed {
        panic(decision.Reason) // Blocked by Bound
    }
}

MIT License © 2026 404kernel