OpenRouter · Guardrail / tool-call policy · Last verified 2026-10-16

OpenRouter Armor

NewBetaPartly verified

New (beta, launched 2026-10-15): an OpenRouter plugin that checks every tool call an agent’s model makes against your plain-English rules and blocks out-of-policy calls before they reach your app. OpenRouter says it uses TypeSafe’s Jev decision model. Free during the beta.

What it does

  • Turn it on per request on OpenRouter’s Chat Completions, Responses, or Messages API by adding plugins: [{ id: "armor", classifier_context: { v: 1, auto_mode: { environment, hard_deny, soft_deny, allow } } }].
  • Three rule tiers: hard_deny (never allowed, nothing clears it), soft_deny (blocked unless an allow rule matches or the user asked for that exact operation), allow (only clears a soft_deny). Default match thresholds: 0.6 for deny rules, 0.7 for allow rules.
  • For each call, the decision model returns a probability per rule, and Armor combines them into flagged or not_flagged. Verdicts appear in a safeguard_results field keyed by tool-call id.
  • Blocked-call formats (output_mode): text (default on Chat Completions and Responses, an XML marker), custom_item (Responses, an openrouter:armor_blocked item), claude_code_compatibility (Messages; the tool_use is kept and flagged, so your client must refuse to run it).
  • Options: mode enforce|audit (audit reports verdicts without blocking), on_error block|log (default block), use_cc_style_default_rules (default true on Messages, false elsewhere), evaluate_native_tools (default false), enabled.
  • Claude Code auto mode works on any OpenRouter model through the Ori harness (ori claude --model <model> -- --permission-mode auto), with no plugins entry needed.

Pricing

  • Armor evaluation is not billed during the beta. OpenRouter says pricing will be announced before general availability. Normal model inference is still billed. [Verified 2026-10-16 on openrouter.ai/docs/guides/features/plugins/armor]

Limits

  • Added latency per tool call: 279 ms median and 334 ms p90 (OpenRouter’s own measurement with its Claude Code compatible rule set). [Verified 2026-10-16 on openrouter.ai/docs/guides/features/plugins/armor]
  • Rule fields: id up to 64 chars (unique), name up to 120 chars, instructions up to 8,000 chars, optional threshold 0–1. [Verified 2026-10-16 on openrouter.ai/docs/guides/features/plugins/armor]
  • Not yet supported for HIPAA, Zero Data Retention, or data-region-restricted requests. A plugin request in those contexts gets a 403. Claude Code requests are released with an unavailable verdict. [Verified 2026-10-16 on openrouter.ai/docs/guides/features/plugins/armor]
  • Coverage: any model OpenRouter serves (docs, for Claude Code auto mode); the launch post says any agent doing inference through OpenRouter can opt in. On Anthropic endpoints that support the beta, Anthropic’s own classifier verdict is passed through instead. [Verified 2026-10-16 on openrouter.ai/docs/guides/features/plugins/armor]

Status

  • Beta since October 2026. The config fields, safeguard_results, and the openrouter:armor_blocked item type may still change. [Verified 2026-10-16 on openrouter.ai/docs/guides/features/plugins/armor]
  • Launched 2026-10-15. OpenRouter’s post says Armor “uses @typesafeai’s Jev model”. The Armor docs only say “the decision model” and do not name a model or version. [Verified 2026-10-16 on OpenRouter’s official X posts (2026-10-15)]
  • OpenRouter claims that on an internal test set it built, Jev 1.13 had the highest accuracy and lowest cost compared with other Decisions models and Claude Code’s use of Sonnet 5. No test set or metrics are published. [Unverified: vendor claim with no published benchmark (checked 2026-10-16)]

Safety & fit notes

  • Good for a drop-in “auto mode” for agents that already call models through OpenRouter, with no classifier to host. Run mode: "audit" on real traffic first, then switch to enforce.
  • Expect some false positives and misses (OpenRouter says so). Keep the environment facts current, since rules that refer to them depend on them.
  • With claude_code_compatibility on Messages, a client that ignores safeguard_results will still run flagged calls. If you don’t control the client, use output_mode "text".
  • If you need your own thresholds, a human-review path, or traffic outside OpenRouter, call Jev directly. OpenRouter’s cookbook shows an approve, block, or review gate.

Sources

Related