The emergency brake for your AI agents.

Your agent can ignore "STOP" typed into a chat. It can't ignore Halt. One button on your phone freezes or kills every agent you run; circuit breakers pause a runaway agent before the damage compounds; tripwires catch a hijacked agent the moment it touches bait.

How it works

Works with Claude Code (one hook, nothing to install), OpenClaw (small plugin) and any agent process.

An AI safety director watched her OpenClaw agent delete more than 200 emails after telling it to wait for confirmation. Her stop commands were ignored; she had to run to her Mac Mini and kill the processes by hand. source

With Halt, that night looks like this:

Deletion #21 in five minutes trips the Mass deletion breaker.
The agent is paused before #22: every further tool call is denied.
Your phone buzzes with a STOP ALL button on the lock screen. Resuming takes the dashboard.

Watch it catch a runaway agent

inbox-agentnot started

An agent with Gmail access misreads a cleanup request. Press Run.

Mass deletion breaker: 0 of 20 in 5 minemails deleted: 0

02:14

Lock screen

A simulation in your browser using Halt's default breaker. The same scenario runs against the real API in the security tests.

Three ways to stop an agent that won't listen

🛑 The big red button

STOP ALL from the dashboard, a home-screen app, or straight from a phone notification. Per-agent pause, resume and stop. Enforced outside the model: in the agent's tool hook, and by a supervisor that can freeze or kill the process tree.

⚡ Circuit breakers

Armed by default, editable:

Mass deletion: 20 in 5 min → pause
Outbound message burst: 15 in 10 min → pause
Money moves: 5 in 1h → pause
Runaway loop: 400 in 10 min → pause
Tamper protection: always blocked
Catastrophic shell commands: always blocked

🪤 Tripwires

Plant a fake API key or a secret link in your agent's memory. Nothing legitimate ever uses it. If a prompt-injected agent tries to send it anywhere, or anything fetches the link, Halt stops the agent and alerts you.

Set up in two minutes

Connect an agent

One command on the agent's machine: node halt.mjs connect <code>. It installs the Claude Code hook or the OpenClaw plugin (backup kept) and checks that it works. Or set it up by hand.

Get the phone alerts

Install the free ntfy app and subscribe to your private topic. No account, no email.

Let your agents run

Every tool call is checked before it runs (tens of milliseconds), and logged so you can see what they did overnight.

Built for agents too: no human required

An orchestrator or overseer agent can run Halt end to end: sign up with one API call, register its workers, give each worker only its own token, set breakers with auto-resume cooldowns, and react to alarms by long-polling or a signed webhook. Humans can join the same account later from the dashboard.

curl -X POST /api/v1/accounts            # → owner_key (keep it away from the workers)
POST /api/v1/owner/create_agent          # → worker token + exact setup
GET  /api/v1/owner/wait_for_alarms?wait=20
POST /api/v1/owner/set_agent_state       # pause / resume / stop

Or plug in the MCP server (/api/mcp). Agents: read /skill.md; every operation is listed with its schema at /api/v1/ops.

Pricing

Free

3 agents
STOP ALL, pause/stop per agent, phone alerts with action buttons
All circuit breakers and 10 tripwires
7 days of activity history

Pro

$5 / month

Up to 100 agents
200 tripwires
90 days of activity history
Pay in USDC on Base or Solana from the dashboard

Questions

What does Halt see?

Tool names and the meaningful part of each call (the shell command, URL, file path, recipient). For file writes it keeps the path, not the contents. Activity is deleted after your plan's history window.

What if Halt is down?

By default agents keep working (fail-open) and the outage is visible. For high-stakes agents, flip to fail-closed: the Claude Code hook and the OpenClaw plugin block tool calls, and the supervisor stops the process after a grace period. Paused agents stay frozen either way. Every case.

Why not just tell the agent to stop?

Because the agent decides whether to listen. Halt answers in the harness (the hook runs before the tool, whatever the model wants) and at the OS level (the supervisor sends SIGSTOP/SIGKILL). Neither depends on the model cooperating.

Can I read what I'm running, and test it?

Yes. The supervisor (halt.mjs) and the OpenClaw plugin are short, dependency-free files you can read before running them. The security page has the threat model, what Halt can't do, and a test runner that tries to get around Halt with real processes against this deployment.

What does "resume" do for a stopped agent?

It changes the state, nothing more. A live Claude Code session or OpenClaw gateway can call tools again; a process the supervisor killed stays dead until you relaunch it. RESUME ALL lifts STOP ALL only: agents you paused or stopped one by one stay that way. Exact semantics.

Can an agent switch Halt off?

Its token can't change any state, and a default rule blocks edits to its hook settings and attempts to kill the supervisor. For a hard guarantee, use root-owned managed settings, run the supervisor with --as, or use containers. Threat model.