A stop button for the AI you already shipped
Kill Switch screens every message going into and out of your chatbots and agents. It stops a bad one, ends a conversation, or halts everything you run at once, then proves what happened from a log nobody could edit afterwards.
Two lines around your model call. Python and TypeScript.
Three levels of stopping power
Each one is logged as its own immutable event, whether it was tripped by a threshold, by a rule you wrote, or by a person.
Block a message
One reply, one inbound message, or one proposed tool call is stopped. Your code catches it and answers with a fallback. The conversation carries on.
Kill a conversation
The whole thread is closed for good. Every later call with that conversation id fails in milliseconds, before any model is contacted.
Halt everything
One switch stops every deployment in your org, or one chain of them. It is a flag rather than a verdict, so it works even when the scoring model is down.
Wrap your model call and you are done
No proxy to route traffic through, no gateway to operate. You call one function before the message reaches your model and one before the reply reaches your user. When something is stopped, the call raises where the message would have been used.
- Works with OpenAI, Anthropic, LangChain and the Vercel AI SDK
- Under 500 ms at p95 on a self-hosted scorer
- Fail open or fail closed, set per deployment
- Monitor-only mode to tune thresholds against live traffic
from killswitch import (
KillSwitch, MessageBlocked, ConversationKilled
)
ks = KillSwitch(api_key="ks_live_...", deployment="support-bot")
def chat(text, convo_id):
try:
ks.screen_user_message(text, conversation_id=convo_id)
reply = llm.generate(text)
ks.screen_ai_reply(reply, conversation_id=convo_id)
return reply
except MessageBlocked as e:
return e.fallback_reply
except ConversationKilled:
return "This conversation has been ended."Write the policy in English, not in regex
A safety lead writes the rule and picks what happens when it matches. It goes straight into the scoring prompt, so there is no rules engine to learn and no pattern list to maintain. Every edit is versioned, and every event records the wording that judged it.
A record nobody could have edited
Anyone can keep a log. The question an auditor asks is how you know it was not changed after the incident. Every event is hash-chained to the one before it, and update and delete are revoked at the database level for every role, including ours.
Verification runs every night on its own, records the result whether it passed or failed, raises an alert if the chain breaks, and withholds that day's anchor so a broken chain never gets a published hash.
blocked -> DELETE events :: table events is insert-only
Every message, on one canvas
Your organization, its deployments, their conversations and every screened message, as a map you can zoom and pan. Branches carry their worst score, so trouble shows through even when a branch is folded.
Ship the agent. Keep the stop button.
Start on the Basic plan for $99.99 a month with 50,000 screened messages included, then a fraction of a cent per message after that.