FREE · OPEN-SOURCE · IN THE SAME DOWNLOAD

🛡 Meerada Guard
Stop AI models from burning your money.

A watchdog on every model call in your workspace. It tells stuck from working hard, alerts you within seconds when a task stalls or burns, and warns when a model reaches for anything outside the workspace — a key, a dotfile, an unknown host.
⬇ Get the app (Guard included) Read the spec
Works beside Claude Code with zero setup, inside LLManager on every call, and company-wide from one policy file.
13:40:02●task fix flaky test · claude · $0.41 · 3 edits, tests running
13:44:18⚠working hard — watch the budget · $1.90 vs ~$0.60 expected for this kind of task · but still making verifiable progress
13:51:07⏸task looks stuck · same tool call 4x in a row (pytest -q) · no progress for 6 min · $3.72 so far
13:51:08→desktop notification sent · cockpit: Stop · Give it 2 more minutes · 🤝 Hand off to gpt-5.6 with the history
13:52:30🔒cage · outbound command: curl · host pastebin.com · reads ~/.aws/credentials · blocked before it left the machine
13:55:41●handed off → gpt-5.6-luna · 2 edits · 5 passed · $0.22 · done

Stuck, or working hard? A program decides.

Guard scores stuck and burn separately. The tie-breaker is verifiable progress: a file written, a test that passed, a build that succeeded. Costly with progress is "working hard"; costly without it is a stall.
SignalReads asDefault
No output for a whilestuck120 s
The same tool call with the same arguments, again and again, since the last progressstuck3×
The answer repeats the previous onesstuck60 % overlap
Thinking tokens far above output tokensburnratio 8
Spent more than the exchange says this kind of task should cost (measured CPAT)burn2×
Session or daily budget reachedburn — always, it's your money$5 / $25

Three ways it sits on the traffic

🎛️

Inside LLManager

Every call the cockpit makes goes through the guard: the cage checks what is about to leave, the meter records what came back, and the budget gate decides whether the next call goes. A 🛡 badge in the cockpit, a toast with the reasons, and the Handshake one click away.

👀

Beside Claude Code

Zero setup. Guard tails the session logs Claude Code already writes on your machine, rebuilds every turn — tokens, thinking, tool calls, results — and alerts from the tray when a task stalls, burns, or reaches for ~/.aws. Runs with the desktop app, or meerada guard in a terminal.

🏢

Company-wide

One policy file per machine, locked fields users can't override, and a Slack / Teams webhook so every stall, burn and cage finding from every desk lands in one channel. No server, no account, no telemetry — the webhook is yours.

Setup: your boundaries in five questions

First run asks — and the 🛡 badge reopens it any time: which folders models may touch · max $ per task · max $ per day · which hosts they may reach · alert or stop on a budget hit, warn or block on an exfil attempt.

Read before you rely on it. Guard watches and warns; it is not a wall. Models can and do try to get around a guard — by encoding a secret, splitting it into pieces, or arguing their way past a rule. Guard flags every attempt it recognises and tells you at once as a "possible attempt to bypass Guard" alert, but it cannot promise to catch every one. Stay alert, keep your policy current, tell your models plainly to obey Guard, and treat any bypass alert as real. Meerada accepts no liability if a model defeats Guard and information leaves your workspace.

The cage

Runs on everything outbound — prompts, attachments, tool arguments, shell commands — before it leaves or executes. Findings never contain the secret itself.

It catches

  • API keys, tokens, private keys (OpenAI, Anthropic, AWS, GitHub, Slack, Google, generic) — blocked
  • Paths outside your workspace roots
  • Outbound commands: curl, wget, scp, rsync, ssh, Invoke-WebRequest, aws s3 cp, git push…
  • Hosts not on your allow-list (a link in prose is fine; a link inside a curl is not)
  • Reads of the environment and dotfiles: printenv, $env:, ~/.ssh, ~/.aws, .env, id_rsa…

One file, three layers

# ~/.meerada/guard.toml (user) · ProgramData\Meerada\guard.toml (company)
silence_s = 120
max_repeat = 3
session_budget_usd = 5.0
daily_budget_usd = 25.0
action = "alert"        # alert | stop

cage = true
allowed_roots = ["C:/work"]
allowed_hosts = ["github.com", "api.openai.com"]
block_secrets = true
cage_action = "warn"    # warn | block

webhook_url = "https://hooks.slack.com/…"
locked = ["daily_budget_usd", "cage", "webhook_url"]
Company file beats user file on locked fields. meerada guard policy shows the effective result and where it came from.

Commands

meerada guard                 # watch live Claude Code sessions (Ctrl+C to stop)
meerada guard policy          # effective policy + its source
meerada guard check file.txt  # run the cage on a file — exit 2 = block (pre-commit / CI)
meerada guard init            # starter ~/.meerada/guard.toml
meerada guard init --company  # the machine-wide policy
Next: a public Stall & Burn index per model on the exchange · proxy mode for any tool · auto-handshake on stall.