Meerada Guard

40:02●task fix flaky test · claude · $0.41 · 3 edits, tests running
44:18⚠working hard — watch the budget · $1.90 vs ~$0.60 expected for this kind of task · but still making verifiable progress
51:07⏸task looks stuck · same tool call 4x in a row (pytest -q) · no progress for 6 min · $3.72 so far
51:08→desktop notification sent · cockpit: Stop · Give it 2 more minutes · 🤝 Hand off to gpt-5.6 with the history
52:30🔒cage · outbound command: curl · host pastebin.com · reads ~/.aws/credentials · blocked before it left the machine
55:41●handed off → gpt-5.6-luna · 2 edits · 5 passed · $0.22 · done

Stuck, or working hard? A program decides.

Guard scores stuck and burn separately. The tie-breaker is verifiable progress: a file written, a test that passed, a build that succeeded. Costly with progress is "working hard"; costly without it is a stall.

Signal	Reads as	Default
No output for a while	stuck	120 s
The same tool call with the same arguments, again and again, since the last progress	stuck	3×
The answer repeats the previous ones	stuck	60 % overlap
Thinking tokens far above output tokens	burn	ratio 8
Spent more than the exchange says this kind of task should cost (measured CPAT)	burn	2×
Session or daily budget reached	burn — always, it's your money	$5 / $25

Three ways it sits on the traffic

🎛️

Inside LLManager

Every call the cockpit makes goes through the guard: the cage checks what is about to leave, the meter records what came back, and the budget gate decides whether the next call goes. A 🛡 badge in the cockpit, a toast with the reasons, and the Handshake one click away.

👀

Beside Claude Code

Zero setup. Guard tails the session logs Claude Code already writes on your machine, rebuilds every turn — tokens, thinking, tool calls, results — and alerts from the tray when a task stalls, burns, or reaches for ~/.aws. Runs with the desktop app, or meerada guard in a terminal.

🏢

Company-wide

One policy file per machine, locked fields users can't override, and a Slack / Teams webhook so every stall, burn and cage finding from every desk lands in one channel. No server, no account, no telemetry — the webhook is yours.

The cage

Runs on everything outbound — prompts, attachments, tool arguments, shell commands — before it leaves or executes. Findings never contain the secret itself.

It catches

API keys, tokens, private keys (OpenAI, Anthropic, AWS, GitHub, Slack, Google, generic) — blocked
Paths outside your workspace roots
Outbound commands: curl, wget, scp, rsync, ssh, Invoke-WebRequest, aws s3 cp, git push…
Hosts not on your allow-list (a link in prose is fine; a link inside a curl is not)
Reads of the environment and dotfiles: printenv, $env:, ~/.ssh, ~/.aws, .env, id_rsa…

One file, three layers

# ~/.meerada/guard.toml (user) · ProgramData\Meerada\guard.toml (company)
silence_s = 120
max_repeat = 3
session_budget_usd = 5.0
daily_budget_usd = 25.0
action = "alert"        # alert | stop

cage = true
allowed_roots = ["C:/work"]
allowed_hosts = ["github.com", "api.openai.com"]
block_secrets = true
cage_action = "warn"    # warn | block

webhook_url = "https://hooks.slack.com/…"
locked = ["daily_budget_usd", "cage", "webhook_url"]

Company file beats user file on locked fields. meerada guard policy shows the effective result and where it came from.

Commands

meerada guard                 # watch live Claude Code sessions (Ctrl+C to stop)
meerada guard policy          # effective policy + its source
meerada guard check file.txt  # run the cage on a file — exit 2 = block (pre-commit / CI)
meerada guard init            # starter ~/.meerada/guard.toml
meerada guard init --company  # the machine-wide policy

Next: a public Stall & Burn index per model on the exchange · proxy mode for any tool · auto-handshake on stall.