Observability tells you about the fire in next month's bill. TokenFuse is the extinguisher: a drop-in gateway that gives every run a budget, watches its burn in real time, and cuts the circuit with an HTTP 402 the second the money stops making sense. Adoption is one base-URL change; no agent framework rewrite, no SDK lock-in.
This is a simulation, but not a fantasy: it replays the exact shape of the live validation runs. An agent enters a retry loop against a $0.006 budget. Four calls land. The reserve for the fifth would cross the cap, so the raft ledger refuses it, and every node agrees.
Your agent's SDK points at TokenFuse instead of the provider. In the hot path: budgets, loop detection, a model router that downgrades routine calls, a semantic cache, DLP and the Wardryx policy hook. Behind it: a raft-replicated spend ledger, so five gateways on five machines still admit exactly what one budget allows.
Company, team, agent, run: budgets nest, and the run is the unit that pays. Cross the cap and the answer is a clean 402 your framework already understands, not a Slack message at 9am.
A retrying agent looks exactly like a compromised one from the budget's side. Sustained loops and fan-out explosions trip the breaker before they become a four-digit night.
Reserve-then-settle accounting prices each call before it happens, with the 2026 model price book built in. The estimate is fast and honest about being an estimate.
Routine calls ride a cheaper model that still clears your quality bar; hard ones keep the big brain. In live runs the router and cache together stripped about 22% of routine spend.
Four physical machines held one shared budget through a leader kill and a real network partition: majority kept serving, the isolated node could not overspend, nothing split-brained.
Agent spend lands in the same FinOps Foundation format as the rest of your cloud bill, so showback and chargeback reuse the pipes and dashboards finance already trusts.
The closest comparable tool, Pipelock, does real work in the same category. The architectural difference is where the stop button sits: inside the request path it protects, or outside it.
| TokenFuse | Pipelock | Observability dashboards | |
|---|---|---|---|
| Enforcement | In-line 402, seconds | In-line, in-process | Alert after the fact |
| Kill switch location | Out of band: iPhone / Watch, Secure Enclave-signed | Inside the same process it protects | None |
| Shared budget across machines | Raft consensus, byte-identical state | Single node | n/a |
| Cost optimization | Router + semantic cache, measured 22% | Not a goal | Recommendations only |
| FinOps handoff | FOCUS-format export | Custom logs | Vendor lock |
| Fleet, incidents, evidence | Cloud plane + audit hash chain | No fleet layer | Strong, read-only |
TokenFuse asks Wardryx before letting a declared tool through, and stamps the verdict on the response. Its Parquet traces are the raw material Verdryx prices outcomes from. Mockryx attacks it on purpose in pre-prod. Idryx correlates its events into the identity graph, and Pocket carries its kill switch on a wrist. Everything travels as one envelope: the agent-event.
Then point ANTHROPIC_BASE_URL at localhost:4100 and give your next run a budget header. That's the whole migration.