Not just chat.
Every kind of call is metered, and each kind is its own tag. A rule can cap a runaway re-embed without touching chat.
- Chat
- Embeddings
- Images
- Text to speech
- Speech to text
- Video
- OCR
Observability and spend control for AI products
Monitor every AI dollar. Control it in real time.
TokenPolice runs inside your app and shows where every token and dollar goes: by user, plan, feature, session and workflow. Then you write rules in plain terms. Block this user after $5 a month. Tell me when AI Search passes $100 a week. Send free users to a cheaper model. Each one is checked before the LLM call is made, not after the fact. Your prompt text never leaves your servers.
Reach
One install covers all of this.
13 providers and 7 frameworks are metered directly, and 14 more over their OpenAI-compatible endpoints — in Node and Python.
Providers and gateways
Through their own clients, or any OpenAI-compatible endpoint.
- OpenAI
- Anthropic
- Amazon Bedrock
- Google Gemini
- Cohere
- Mistral
- Groq
- OpenRouter
- Cerebras
- Together
- Hugging Face
- xAI (Grok)
- Voyage
- DeepSeek
- Fireworks
- DeepInfra
- Perplexity
- Moonshot
- MiniMax
- Zhipu
- Novita
- Nebius
- Azure OpenAI
- Azure AI
- Vertex AI
- Vercel AI Gateway
- Self-hosted
Frameworks
Every model call inside a run, tied to that run.
- LangChain / LangGraph
- Vercel AI SDK
- LlamaIndex
- OpenAI Agents SDK
- Pydantic AI
- CrewAI
- Agno
- model prices, kept current
- 5,000+model prices, kept current
Running a fine-tuned model, a private deployment or a negotiated rate? Describe the price in your own words, and new calls to that model are costed with it.
Demo
Click through it yourself.
The real dashboard on a seeded account: a support desk with an agent stuck in a loop, a free user stopped at $5 for the month, and a $100 cap still in Dry-run so you can see what it would have blocked. No account, no install.
This is the real dashboard on seeded data, not a screenshot. Every page is clickable.
Open full screenThe bill
This is not a five-dollar problem.
$1,500
per engineer, per month
The cap Uber set after burning its 2026 AI budget in four months.
$38,000
one Bedrock bill
AWS Cost Anomaly Detection was switched on. Bedrock bills through AWS Marketplace, which it does not cover, so nothing fired.
$437
one night, 14,000 tool calls
A LangChain agent left running overnight called list_files until a quota stopped it.
“most of our cost came at maintaining that free tier”
None of these were caught before the invoice. That is the part we fix.
A research catalogue of 63 confirmed production budget overruns, across 21 agent frameworks, each one traced to a public GitHub issue. arXiv 2606.04056
The gap
To stop a call, most tools have to be holding it.
A provider console can cap your account. It cannot cap the one free user who found your chat box at 3am. An observability tool can see that user, after the call has been paid for. A gateway can stop the call — by sitting in your request path holding your prompts and your provider keys. TokenPolice answers from inside your own process, before the call goes out, and never sees the prompt.
Cost per user, plan, session, workflow
- TokenPolice
- Yes
- Provider console
- No
- Observability tool
- Yes
- Gateway / proxy
- Yes
Decides before the call
- TokenPolice
- Yes
- Provider console
- Account-wide only
- Observability tool
- No
- Gateway / proxy
- Yes
Needs your prompt text
- TokenPolice
- Never
- Provider console
- n/a
- Observability tool
- Usually
- Gateway / proxy
- Yes
Holds your provider keys
- TokenPolice
- No
- Provider console
- n/a
- Observability tool
- Sometimes
- Gateway / proxy
- Yes
Your app still works if it goes down
- TokenPolice
- Yes
- Provider console
- n/a
- Observability tool
- Usually
- Gateway / proxy
- No
Stops an agent loop mid-run
- TokenPolice
- Yes
- Provider console
- No
- Observability tool
- No
- Gateway / proxy
- No
| Capability | Provider console | Observability tool | Gateway / proxy | TokenPolice |
|---|---|---|---|---|
| Cost per user, plan, session, workflow | No | Yes | Yes | Yes |
| Decides before the call | Account-wide only | No | Yes | Yes |
| Needs your prompt text | n/a | Usually | Yes | Never |
| Holds your provider keys | n/a | Sometimes | Yes | No |
| Your app still works if it goes down | n/a | Usually | No | Yes |
| Stops an agent loop mid-run | No | No | No | Yes |
Privacy
Not a proxy. Your prompts stay home.
Every tool that can stop an LLM call by holding it can also read it. This one decides from beside the call instead of in front of it.
- The SDK runs inside your process.
- Your provider keys never leave.
- TokenPolice gets token metadata: model, token counts, cost, your own user and plan tags, and a content fingerprint for loop detection. Never the prompt or completion text itself.
- There is nothing to redact, because there is no prompt store to redact it from.
- If TokenPolice is unreachable, your app carries on. The check fails open.
See
Every call priced. Every run traced.
Most LLM observability tools work by reading your prompts: either they sit in the request path, or their tracing SDK ships the text out with every span. This one never receives it. Every view below is built from what does arrive: the model, the token counts, the cost, and your own user, plan, feature and session tags. Cost lands against the things your business is made of, not against an API key.
Where it went
Per user, per plan
Cost per user, per plan. The free tier is usually the surprise.
Per workflow
Which workflow's cost moved this week, and which step or model did it.
One run, in full
That is one screen, about one run. It answers all of this:
- Who
- The user id your app set, and the plan they were on.
- Which run
- Workflow name, session id, and which run of that session this was.
- What it cost
- The total for the run, and every individual span's share of it.
- Tokens
- In and out, split by modality, and again per call.
- Whether that is normal
- This run against the workflow's own baseline — here, pricier than ~85% of the last 56 runs.
- What the firewall did
- The rule that fired and the mode it fired in. This one was rerouted to a cheaper model, enforced.
- Every step
- Each model call with its provider, model, tokens, cost and duration.
- Tool calls
- On the same timeline as the model calls, with their own timings.
The one thing this view cannot show you is the prompt or the completion. Neither is collected, so nothing here is redacted — there is nothing to redact. How that works.
Act
Then do something about it. Before the call.
Block
Free plan · $5 a month per user · Block
The call is never sent. $0.00 charged.
Reroute
Pro plan · $10 a month per user · switch to gpt-4o-mini
Same provider, cheaper model. GPT-4o is roughly 16× the price of 4o-mini per output token.
Notify
Any user · $50 a month · Slack me
Email, Slack, Discord, Telegram, webhook, or the in-app inbox.
Every block and reroute rule starts in dry-run. Flip to enforce when the numbers look right. Notify has no dial: it fires whenever the rule matches.
Reroute works by rewriting the model in the request body, so it needs a call that hands the SDK one. LangChain, LangGraph, LlamaIndex, Pydantic AI and the Vercel AI SDK do not: there the swap is refused, the call runs on the model you asked for, and the audit log records a rejected reroute.
Runaway agents
A stuck run will not stop itself.
A budget rule limits spend over a window. A loop is a different failure: one run, going in circles. It does not crash and it does not time out. It just keeps asking the same model the same question until somebody notices the bill.
What trips it
Two detectors, four rules. Exact prompt repeat: the same request three times running, or a two- or three-step back-and-forth that keeps coming round. Or a hard ceiling on a single run, counted in calls, in dollars, or in tokens.
One run, and only that run
Every loop rule is keyed to the trace, and the count resets when the next run starts, so one user's runaway loop never touches anybody else's traffic. It is not a session or conversation cap — that is an ordinary firewall rule.
Alert, or stop the next call
Alert only lets the run carry on and tells you, on Slack, Discord, Telegram, email, a webhook, or the in-app inbox. Block fails the run's next model call with a 429, so it cannot keep going.
Watch it before it bites
A blocking loop rule is created in dry-run: it records every call it would have stopped, against your real traffic, without stopping any of them. Flip it to enforce when the numbers look right.
The trigger is approximate: the call that crosses is allowed, and a later call in the same run is stopped.
Three of these are already on in every new project, in alert-only mode: exact prompt repeat, 25 calls per run, and $5 per run. Blocking is something you turn on.
Detection reads a fingerprint of each request — role, type, length, and a hash per message segment — never the prompt text.
Install
Your coding agent installs it.
Install the token-police-sdk skill and say “Integrate TokenPolice into this app.” The agent adds two lines, tags your users and plans, runs a check and reports back. Install the skill.
claude · token-police-sdk
skill activeYou
Integrate TokenPolice into this app.
Agent
Roadmap: read your code → ask a few questions → plan for yes/no → wire the SDK → self-check → you run, I verify.
Agent
Done reading — Node + OpenAI + Express; two LLM call sites.done
Agent
Need an API key from app.tokenpolice.ai/keys (show-once tp_sk_…). Env only — prompts stay on your servers.
You
Here's the key. Plan looks good — go.
Agent
Wired: tp.init at startup, dry_run, user_id / paid_plan / session_id from your auth.done
Agent
Verify pass — traces arriving. Flip to enforce when your rules are ready.done
Pricing
Simple pricing
Free while we launch. Pro is $49 a month after that, and free until then.
Free
The whole product, at a smaller volume. Good for finding out what your users cost.
$010,000 guarded requests / month
What's included:
- 10,000 guarded requests a month
- Rules, reroutes, loop detection, dry-run
- Cost per user, plan, session, workflow
- Alerts to Slack, Discord, Telegram, email, webhook
- Node and Python SDKs
Free until the launch period ends
Pro
For products with paying users and a free tier to protect.
$49USD per month · 50,000 guarded requests
What's included:
- Everything in Free
- 50,000 guarded requests a month
- Email support
- Priority bug fixes
Start on Pro
Signup puts every account on Free. Email hello@tokenpolice.ai and we move you to Pro.
Scale
Volume, custom limits, and someone to call.
Contact us
What's included:
- Everything in Pro
- Higher volume and custom limits
- Implementation help
- Priority support
Prices in USD, excluding tax.
Costs less than one surprise bill.
FAQ
Common questions
Observability tells you what a call cost, once it has finished. TokenPolice checks the limit you set before the call is made, then blocks it, sends it to a cheaper model on the same provider, or allows it. It is also the trace, the per-call model log and the audit log for that traffic, priced per user, plan, session and workflow — all of it built from token metadata rather than from your prompt text. What it deliberately does not do is prompt replay or evals: if you need to read back what was in a prompt, that needs a tool that stores them, and this one never receives them.
No. The SDK runs inside your process and sends token metadata: the model id, token counts, the cost in USD, the identifiers you choose such as user, plan and session, and a content fingerprint used for loop detection. Raw prompt and completion text never leave your servers.
Your app carries on. If the service is unreachable the check fails open, the call proceeds, and you lose enforcement for that moment rather than uptime. TokenPolice is never a hard dependency of your request path.
The SDK meters 13 providers and 7 frameworks across Node and Python, most of them on the plain install. Providers: OpenAI, Anthropic, Amazon Bedrock, Google Gemini, Cohere, Mistral, Groq, OpenRouter, Cerebras, Together, Hugging Face, xAI (Grok) and Voyage. Frameworks: LangChain / LangGraph, Vercel AI SDK, LlamaIndex, OpenAI Agents SDK, Pydantic AI, CrewAI and Agno. Embeddings, images, speech, video and OCR are metered as well as chat, each under its own tag so a rule can target one without touching the others. The full matrix with every caveat is at tokenpolice.ai/docs/integrations/matrix, and the tested versions are at tokenpolice.ai/docs/sdk/supported-versions.
Yes. That is the common first rule: one dollar limit per free user, a larger one per paid user. You can also put a single shared limit on the whole free tier, so a flood of new free accounts is bounded in total rather than one account at a time.