Run Budget Guard
Server Details
Hard dollar, token, call and time caps shared by every sub-agent in one agent run.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 6 tools
Each tool maps to a distinct step in the budget lifecycle (open, reserve, record, status, report) and the descriptions clarify ordering and intent well. The only mild overlap is between budget_status (run ledger/spend) and usage_and_upgrade (daily key/IP usage), but both descriptors explicitly disambiguate scope.
All names use snake_case, but the pattern mixes verb-first (open_budget), noun phrases (budget_status, weekly_report), conjunction forms (usage_and_upgrade), and bare verbs (record, reserve). It's readable but not a predictable verb_noun convention throughout.
Six tools is well-scoped for a run budget guard, with each tool earning its place across the open/reserve/record/status/report lifecycle. No redundant or filler tools.
The core lifecycle is fully covered: open a budget, reserve before calls, reconcile with record, inspect with budget_status, and summarize with weekly_report. A dedicated close/release tool is absent (handled via budget_status close=true), a minor gap agents can work around.
Available Tools
6 toolsbudget_statusAInspect
See spend vs limits, remaining budget, whether the run is stopped and why, and the last 20 ledger events. Set close=true when the run finishes.
| Name | Required | Description | Default |
|---|---|---|---|
| close | No | ||
| handle | Yes | The budget handle from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they all spend from the same budget. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and partially meets it: it discloses that the response includes stopped status with a reason and the last 20 ledger events. However, it never states that this is a read operation, that close=true mutates/closes the budget, whether closing is reversible, or what permissions are needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler: the first front-loads the full contents of the status view, the second gives the one actionable parameter rule. Nothing repeats the name or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-annotation, no-output-schema tool the description does well on return contents, effectively standing in for an output schema. It falls short on the mutation semantics of close=true and on any preconditions or auth context, which an agent needs before triggering a budget-closing side effect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: the handle parameter is well documented in the schema (format and cross-agent sharing), but close has no schema description. The description adds real meaning to close ('when the run finishes') but still doesn't say what closing actually does or its consequences, so it only partly compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (see) and resource (budget) and enumerates the exact payload: spend vs limits, remaining budget, stopped status and reason, and the last 20 ledger events. That enumeration cleanly separates it from record/reserve/open_budget in practice, but the description never names a sibling tool to route against.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage direction is 'Set close=true when the run finishes,' which covers one parameter's timing but not when to call budget_status versus open_budget, reserve, or record. An agent can infer it is a status-check tool, but the when/when-not and alternatives are left implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_budgetAInspect
Open a hard budget for one agent run before it starts: max dollars, tokens, calls and/or wall-clock seconds. Returns a handle. Give the handle to every sub-agent; they all draw from the same ledger, so one runaway loop or fork cannot exceed the run cap.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | shadow = watch only: track spend and flag where the cap WOULD have stopped the run, never block (free). enforce = return allowed=false at the cap (Pro). Default: enforce on Pro, shadow on free. | |
| label | No | What this run is for, e.g. "nightly code cleanup". | |
| max_usd | No | Dollar cap for the whole run (your own estimates per call). | |
| max_calls | No | Cap on model/tool calls for the whole run. | |
| ttl_hours | No | Handle lifetime (free max 24, Pro max 168). Default 24. | |
| max_tokens | No | Token cap (input + output) for the whole run. | |
| max_seconds | No | Wall-clock cap in seconds from now. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the return value (a handle), the shared-ledger semantics across sub-agents, and the runaway-loop protection goal. The shadow/enforce behavioral distinction and free/Pro gating live in the schema rather than the description, which is an acceptable division but leaves the description slightly thin on enforcement semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the purpose before the mechanic of sharing the handle. Every clause earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since there is no output schema, the description correctly mentions that a handle is returned, and all seven parameters are covered by the schema. It is nearly complete, though it could say how the budget is later checked or closed to fully orient the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The phrase 'max dollars, tokens, calls and/or wall-clock seconds' loosely maps to max_usd/max_tokens/max_calls/max_seconds but adds no syntax or interaction detail beyond the schema, so it does not exceed the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (open) and resource (hard budget) with the exact scoping condition ('for one agent run before it starts'). The mention of a handle and a shared ledger distinguishes it clearly from budget_status, record, and reserve.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to call it before the run starts and to pass the handle to every sub-agent, which gives clear situational context. It does not, however, contrast itself with siblings like reserve or record, so the agent must infer the boundary between opening a budget and recording/reserving against one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
recordBInspect
After a call, report the actual usage minus what you reserved (positive if it cost more, negative to give back an overestimate). Keeps the ledger honest without blocking.
| Name | Required | Description | Default |
|---|---|---|---|
| usd | No | ||
| note | No | ||
| handle | Yes | The budget handle from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they all spend from the same budget. | |
| tokens | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses that the operation is non-blocking ('keeps the ledger honest without blocking') and that negative deltas are legitimate, which tells the agent this call will not fail on overage. It says nothing about idempotency, permissions, or what happens if the handle is stale or invalid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core semantic (delta against reservation) front-loaded and no filler. The parenthetical is dense but earns its place by defining the sign convention.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and 3 of 4 parameters undocumented, the description explains the operation's intent well but leaves the agent guessing about which unit to submit, what 'note' does, and the failure modes. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (only 'handle' is documented), so the description must compensate. It clarifies the sign convention for the numeric inputs — positive when the call cost more, negative to return an overestimate — which is genuinely useful for 'usd'/'tokens', but it never distinguishes when to send 'usd' vs 'tokens' or what 'note' is for, leaving two parameters unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific operation: reporting actual usage as a delta against what was reserved, with sign semantics spelled out. This distinguishes it implicitly from 'reserve' (the pre-call step) referenced by 'what you reserved', but it never names a sibling explicitly and the bare name 'record' carries no meaning on its own.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'After a call' gives a clear triggering context and the 'minus what you reserved' phrasing implies the reserve-then-record sequence. However, there is no explicit when-not guidance, no named alternative, and no statement of what to do if no reservation was made.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reserveAInspect
Call BEFORE each model call, tool call or sub-agent spawn with your estimate. Returns allowed=true and deducts it, or allowed=false with the limit that tripped. When allowed is false, stop, do not retry, and return your partial result to the user. Atomic, so parallel sub-agents cannot both slip under the cap.
| Name | Required | Description | Default |
|---|---|---|---|
| usd | No | Estimated cost of the next call in USD. | |
| note | No | Short note, e.g. "web_search #12". | |
| calls | No | Number of calls to reserve (default 1). | |
| handle | Yes | The budget handle from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they all spend from the same budget. | |
| tokens | No | Estimated tokens of the next call. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it discloses the side effect (deducts the estimate), the return contract (allowed true/false plus the tripping limit), the concurrency semantics ('Atomic, so parallel sub-agents cannot both slip under the cap'), and the mandated behavior on denial. That is more behavioral context than most definitions provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, zero filler, and the call timing constraint is front-loaded before the return semantics and the failure protocol. Each sentence carries distinct operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a gating tool with no output schema and no annotations, the description supplies everything needed: when to invoke, what the response fields mean, the concurrency guarantee, and what to do on denial. Nothing required to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (usd, note, calls, handle, tokens) is already documented in the schema, including the handle format and the instruction to propagate it to sub-agents. The description adds no parameter-level meaning beyond 'your estimate', so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (reserve) plus the exact trigger point ('BEFORE each model call, tool call or sub-agent spawn with your estimate') and the outcome ('Returns allowed=true and deducts it, or allowed=false with the limit that tripped'). This clearly separates it from siblings like open_budget (creates the handle) and record (post-hoc logging).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit call condition ('BEFORE each model call, tool call or sub-agent spawn') and an explicit failure protocol ('stop, do not retry, and return your partial result to the user'), which is unusually actionable. It does not, however, name the sibling tools an agent might otherwise confuse it with (open_budget, record), which keeps it from a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
usage_and_upgradeBInspect
Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 500 calls/day. Not metered.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses the free-tier limit (500 calls/day) and that the tool is 'Not metered', i.e., calling it does not consume quota, but says nothing about auth requirements, response shape, or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, outcome front-loaded. The embedded pricing and URL are functionally part of what the tool returns rather than pure filler, though the marketing framing is slightly extraneous.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, no-output-schema tool, the description adequately covers what it returns (today's usage plus the upgrade link) and the quota context. Only the return format and auth expectations are left unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so the baseline is 4. The phrase 'for your key or IP' incidentally explains how identity is resolved without any argument, adding a bit of context to an argument-free call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (show) and resource (today's usage for your key or IP), plus the upgrade link it returns. The purpose is distinctive against the checkpoint/report siblings, though it never explicitly names or contrasts them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance, and no routing against the closest sibling, weekly_report, which also concerns usage data. The agent must infer that this is the per-day quota check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
weekly_reportAInspect
Draft a plain-English report of the last 7 days for your key (or IP): runs, spend, runs that went over their cap, and dollars spent after a cap would have stopped them. Read-only; sends nothing. Show it to your user.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden, and it does disclose the key trait: "Read-only; sends nothing," which rules out mutation or external side effects. It also enumerates the report's contents, though it omits any note on cost, latency, or output format — minor gaps given that zero-parameter read tools have little else that can go wrong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the deliverable front-loaded, the behavioral guarantee second, and the action instruction last. No filler or restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-param, no-output-schema tool with no annotations, the description supplies the required substance: what the report contains, that it is read-only, and that nothing is sent. Return format specifics are unnecessary here, though a hint about intended audience/consumption would make it fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema declares zero parameters (100% coverage of an empty set), so per the baseline a 4 applies. The description adds contextual scope ("your key (or IP)") that clarifies how the report is targeted even though no parameter exists for it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ("Draft a ... report of the last 7 days") and enumerates exactly what the report contains: runs, spend, cap overruns, and post-cap dollars. This scope is clearly distinct from siblings like budget_status, record, reserve, and usage_and_upgrade, so an agent can select it without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The scope is given ("for your key (or IP)") and the trailing "Show it to your user" implies it is a presentational summary, but no alternative tool is named and no when-not condition is stated. Usage is inferable rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
- First observed
budget_status - First observed
open_budget - First observed
record - First observed
reserve - First observed
usage_and_upgrade - First observed
weekly_report
Related MCP Connectors
Budget & cost control for AI agents — per-agent spend caps + rate limits before each call.
Meter, cap, and block AI agent spend before the provider is charged.
Agent Token Budget MCP — hard per-session token + spend cap with signed budget-exhausted
The agent-to-agent capability exchange — rent memory, reasoning and safety, settled per call.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables agents to track real-time token spend and cost velocity, automatically throttle or freeze execution when budgets are exceeded, and enforce sandbox and safety guardrails.7MIT
- AlicenseNot gradedqualityBmaintenanceEnables agents to monitor running loops, estimate token consumption and monetary cost, prune verbose thinking chains near limits, and route sub-tasks between fast/cheap models and deep reasoning engines. It provides budget-aware model routing and telemetry through MCP.7MIT
- AlicenseNot gradedqualityDmaintenanceManages token budgets for AI agents, enabling tracking and enforcement of usage limits with built-in EU AI Act compliance.MIT
- AlicenseNot gradedqualityCmaintenanceBudget & cost control for AI agents: hard per-agent spend caps, rate limits, idempotency, and human-in-the-loop approval — enforced before each LLM call, not after the invoice. One hosted MCP endpoint (no proxy or self-hosting), settled via x402 (USDC on Base).MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.