Cost Caps and Kill-Switch

A hard daily cap and a kill switch, enforced at the proxy on your machine. When the cap hits, RelayPlane returns a 429 and records the kill. No SaaS in the middle.

Quick Start

Set a daily cap in one command:

1relayplane cap set --day 50

This writes budget.enabled / dailyUsd / onBreach into ~/.relayplane/config.json. A running proxy reloads it within seconds. No restart required.

How It Works

Before every request is forwarded, the proxy adds the request's projected cost (prompt size at the target model's price) to today's running total. If that would pass the cap, the request is not sent and the client gets 429 with {"type":"budget_exceeded"}. The check runs locally on every call. There is no external dependency.

Configuration

Everything lives under budget in ~/.relayplane/config.json:

1{
2 "budget": {
3 "enabled": true,
4 "dailyUsd": 50, // hard daily cap
5 "hourlyUsd": 10, // optional hourly cap (default 10)
6 "onBreach": "block", // "block" | "warn" | "downgrade"
7 "alertThresholds": [50, 80, 95],
8 "sessionCapUsd": 1.0 // per Claude Code session (X-Claude-Code-Session-Id)
9 },
10 "downgrade": {
11 "enabled": true // step Opus -> Sonnet -> Haiku as spend approaches the cap
12 }
13}

Or for a single run: RELAYPLANE_DAILY_CAP_USD=50 relayplane start. Full field reference on the budget caps page.

Kill Switch

A cap limits spend; the kill switch stops it. While active, every /v1/messages and /v1/chat/completions request gets 503 kill_switch_active and nothing is forwarded. It survives a proxy restart until you lift it.

1relayplane kill # halt all routed traffic
2relayplane resume # lift it
3
4# HTTP (what the dashboard KILL button calls)
5curl -X POST localhost:4100/control/kill -d '{"all":true}'
6curl -X POST localhost:4100/control/resume
relayplane disable is not a kill switch. It turns routing off and puts the proxy in passthrough: traffic still flows to your providers and still costs money.

Viewing Kill History

1relayplane kills --last 7d

Every blocked request (reason cap_exceeded, with the agent and session that sent it and the projected cost it saved) and every manual kill. Also at GET /control/kills.

Caps, the kill switch, and the auto-downgrade ladder are all in the free, MIT-licensed proxy. Runaway-loop detection (N retries in W seconds) is configured under budget.runawayRetries / budget.runawayWindowSec but is not enforced at the proxy yet; treat it as roadmap.