Guardrails for agents that can reach your keys and spend your money.
Order Samurai sits between your coding agent and the tools it calls. It blocks tool calls carrying known prompt-injection phrasing (instructions planted in files, web pages or tool output), estimates what your agents cost, and keeps a human approving every repair. It runs on your machine and sends no telemetry to us.
Dashboard demo recorded on sample data. Figures in it are not measured results.
Illustrative events: synthetic examples, not live telemetry or customer outcomes.
For business owners
Your developers' agents hold your keys. Know what's stopped.
AI coding agents run commands with your credentials and bill by the token. Here is what can go wrong, what Order Samurai does about each risk, and what it leaves to you.
Hidden instructions
A file, web page or tool result tells your agent to do something you never asked for.
Leaked customer keys
A password or API key shows up in what the agent reads, and it can repeat it anywhere.
A surprise bill
One runaway session costs more than a week of normal work, and nobody notices until the invoice.
No record
A client asks what the agent did with their code, and you have nothing to show them.
- Tool calls carrying known prompt-injection phrasing (risk 01), before they run. Claude Code and Gemini CLI out of the box; Codex (ChatGPT's coding agent, bundled in the ChatGPT desktop app) once you approve the hook; Cursor too, but check it in your own setup.
- Secrets that appear in command and file output, on Claude Code (risk 02). It logs them. It does not hide them from the agent.
- Agent sessions estimated at $5 or more, from Claude Code logs (risk 03).
- Hook health checks and estimated spend, in a dated report you can keep; guard blocks and secret hits go to a local log (risk 04).
- Stop destructive commands. It is not a sandbox.
- Cap what your agents spend.
- Fix code on its own. Every repair waits for a person to approve it.
What you'll see
A report in one command. Your developer runs samurai audit (the installer offers it). It checks the hooks are working, estimates agent spend from your logs, and saves a report to the dashboard's Reports tab. Spend is an estimate from session logs, not your provider's bill.
An update notice. When a new release ships, the dashboard shows a banner and the health check prints one line with the update command. Free and Pro both get it.
A fresh install opens on your own data. The installer refreshes the dashboard, so the Overview shows this machine's data, not samples. The sample-data demo lives separately at /demo. Your audit report is in Reports.
Who installs it: whoever runs your agents. Send them to the install command.
Price
Free includes every guard above, the audit and your newest report. Pro adds your full report history and every dashboard metric, plus Ronin, a background agent that keeps checking your setup between sessions, and the Nightly Dojo, an overnight test run. Ronin and Dojo run through Claude Code, so ask your developers which agent they use before you buy. No subscription and no per-token fees.
Keep doing: backups, and the billing limits at your AI provider. Order Samurai reduces risk; it does not remove it. Pro's daily budget only limits Order Samurai's own background runs, not your agents.
For engineers
Hook-level checks. Limits stated precisely.
The installer detects each harness on the machine and writes Order Samurai into its hook config. Everything runs locally. Read the source before you trust it.
Prompt-injection guard
Scans every string in the tool input, file contents included, against 21 deterministic block patterns. A match exits 2 and the call never runs. Softer matches are logged. An optional local-model second look is pinned to localhost and fails open. Emits kill-chain 13.
Secret detector
Scans Bash and Read output for credentials and logs each hit (kill-chain 14). It does not rewrite what the agent receives: a tripwire, not a vault. Not installed for Codex, Cursor or Gemini CLI.
Staged repair
Fixes proposed by the reflex engine (which runs through the claude CLI) land in a pending queue as .patch files. A CLI lists, shows, applies or rejects each one. Applying is manual, nothing schedules it, and it never commits. Autonomous apply is retired.
Harness coverage
What each harness actually gets
| Capability | Claude Code | Codex (ChatGPT's coding agent) | Cursor | Gemini CLI |
|---|---|---|---|---|
| Prompt-injection guard (pre-tool, blocks) | ✓PreToolUse: Bash, Write, Edit, MultiEdit, WebFetch |
✓PreToolUse: Bash and apply_patch |
✓beforeShellExecution, beforeMCPExecution, preToolUse (Write) |
✓BeforeTool: shell, write_file, replace, MCP and discovered tools |
| Activation | ✓Automatic | ◐Approve the hook in Codex's /hooks screen; it won't run until you do |
✓Automatic | ✓Automatic |
| Secret detector (post-tool) | ◐PostToolUse: Bash and Read output; logs, does not redact |
✕Not installed | ✕Not installed | ✕Not installed |
| If the guard itself errors | ◐Fails open: a crash or malformed payload lets the call through | ◐Fails open, same as Claude Code | ✓Fails closed: the call is blocked | ✓Fails closed: the call is blocked |
samurai doctor |
✓Checks registration and runs live probes | ◐Registration and probe; can't prove Codex enforces it | ◐Probe; enforcement not verified | ◐Probe; enforcement not verified |
Spend estimate in samurai audit |
✓From Claude Code session logs | ◐Sessions, tool calls and token totals from ~/.codex/sessions. Cost shown as unavailable: Codex logs record tokens, not prices, so no dollar estimate and nothing in the spend totals |
✕Not read | ✕Not read |
| Pro: Ronin daemon, Nightly Dojo, agents | ✓Runs through the claude CLI |
✕Needs Claude Code | ✕Needs Claude Code | ✕Needs Claude Code |
claude CLI. If your team codes in Codex, Cursor or Gemini CLI, the Free guard covers those harnesses; Pro's background features need Claude Code installed alongside.Known limits
- Fails open on Claude Code and Codex: if the guard itself crashes or receives a malformed payload, the call goes through. Treat that as a gap, not a feature.
- It guards local coding agents. A setup that uses only ChatGPT chat, or only local models, has nothing to guard, and the installer stops with “No supported harness found”.
- Not a sandbox. It does not block destructive shell commands; a recursive delete passes.
- Pattern matching covers known phrasing only. Novel or obfuscated injections can get through.
- It matches text anywhere in tool input, so writing docs that quote injection phrases can trigger a block.
- The kill-chain taxonomy lists 14 chains. The shipped hooks emit two: chain 13 (injection, blocks) and chain 14 (secrets, logs).
- No spend cap on your agents. Pro's
DAILY_BUDGET_USD($5 default) stops only Order Samurai's own background runs: the Ronin daemon, and the Nightly Dojo when you set it there. - Spend figures are estimates from session transcripts, not your provider bill.
- Network: no telemetry to us. The update notice fetches a public build record at most once a day (3 s timeout, silent offline; opt out with
SAMURAI_NO_UPDATE_CHECK=1). Pro activation checks your key with Gumroad, then works offline after the refund window. Third-party model review runs only with a provider and key you configure.
Install
- Checks for Python 3.11+. Downloads the zip and its
.sha256, verifies the checksum, and aborts before extracting anything on a mismatch. - Installs to
~/.samurai/coreand installs dependencies. - Detects Claude Code, Codex, Cursor and Gemini CLI and edits only their hook configs (
~/.claude/settings.json,~/.codex/hooks.json,~/.cursor/hooks.json,~/.gemini/settings.json), backing each up to~/.samurai/backupsfirst. With no harness found, it registers no hooks and stops (the files stay in~/.samurai/core). - Asks for a Pro key (hidden input), or press Enter to stay on Free.
- Runs
samurai doctorand exits non-zero if any check fails. Then offerssamurai audit; findings never fail the install. - Restart Claude Code. In Codex, run
/hooksand approve the Order Samurai hook.
~/.samurai, saving your license; add --keep-data to keep data)Re-run the install command to upgrade in place; your license, settings and reports carry over. Or download the core zip and its checksum.
Pricing
A flat price, kept flat.
No subscription, no per-token markup. Everything runs on your hardware.
Guard hooks for all four harnesses (coverage as in the matrix above), the Claude Code secret detector, samurai audit, your newest report, the update notice and the patch review CLI. Open source.
Everything in Free, plus full report history, the full set of dashboard metrics (Free shows a core subset), the Ronin background daemon and the Nightly Dojo. Ronin and Dojo need Claude Code. Some Pro dashboard panels preview views still being built.
| Capability | Free ($0) | Pro ($199) |
|---|---|---|
| Prompt-injection guard | Claude Code, Codex, Cursor, Gemini CLI | Same |
| Secret detector (logs) | Claude Code | Same |
samurai audit + Reports tab | Newest report | Full report history |
| Update notice | Included | Included |
Review CLI for proposed .patch fixes | Included (fixes are proposed through Claude Code) | Included |
| Tamper-evident (hash-chained) log of review decisions | Included | Included |
| Dashboard metrics | Core subset | All pillar metrics |
| Ronin background daemon | — | Included (needs Claude Code) |
| Nightly Dojo | — | Included (needs Claude Code) |
| Daily budget | — | Limits Order Samurai's own background runs (Ronin; Dojo when set), $5 default; not your agents' |
| License | Apache 2.0 | Perpetual key; offline after the refund window |
Proof
Don't take our word. Read the code.
We publish no customer numbers yet; the figures on this page are labelled samples. What you can check today:
Open source
The core, the hooks and the installer are on GitHub. You can check each claim above against the source.
Public CI
Release checks run in GitHub Actions on Python 3.11–3.13.
Try the dashboard
The interactive demo runs on sample data, so you can see the Reports tab before you install.