Three ways to stop the bleed

The kill switch is the detector plus the action. Auto-cap is the ceiling. Throttle slows a runaway. Revoke is the hard cut via admin APIs — minutes, not “we blocked every request.” Free sees the incident; Team/Agency can act.

Auto-cap — the daily USD ceiling that starts the clock.
Throttle — shrink the developer’s provider limit so spend slows hard.
Revoke — limit to $0 / cut the seat — fastest stop we can do without a gateway.

TokenLoop·Kill switchPreview

Detect a runaway → act in minutes

Compares today's spend to your trailing average and daily caps. Then runs the action you configured. Not a gateway — we cut via provider admin APIs (spend limits / seat disable).

Auto-cap

Hard ceiling

Set a daily USD limit per org, user, or client. When spend hits the cap, TokenLoop fires your chosen action before the day runs away.

Cap $250/day · org-wide · breached at $260.12

Throttle

Slow the burn

Lowers that developer’s provider spend limit (e.g. Cursor hard limit → $25) so the agent keeps working at a crawl instead of a blank check.

Spike 5.2× avg → Cursor limit set to $25 for runaway@demo.dev

Revoke

Hardest cut

Fastest detect-and-cut: spend limit → $0 (or seat disable where the API allows). Minutes, not per-request blocking — we say that out loud.

Cursor + Anthropic limits → $0 · agent effectively stopped

Live incident · spike + revoke

$260.00 is 5.2× the 3-day average ($50). Action: revoke. Slack + email already fired.

Revoked