Alerts aren’t controls: soft warn / hard stop for Cursor and Claude Code loops

Lucian Lature — Tue, 28 Jul 2026 14:21:21 +0000

If you run Cursor or Claude Code hard, you already know the shape of the bill:

The session feels cheap while you're in the loop.
The meter (or the invoice) shows up later.
By then the damage is done — or you're rate-limited mid-task with no useful receipt for finance.

Cloud FinOps solved a version of this years ago: budgets that only notify aren't a control plane. Agentic coding has the same gap. Autoscale had traffic as a natural ceiling. An agent spends on intent. There's no gentle slope — just a wall.

I built LoopBudget for that surface: soft warn, hard stop, and a session receipt for Cursor and Claude Code.

This post is the honest version of what "hard stop" means in early access, how the sidecars/hooks fit, and what we're deliberately not claiming yet.

Why vendor meters fail mid-loop

Vendor UIs optimize for account-level or period-level usage. That's fine for finance at month-end. It's the wrong resolution for a coding agent.

While the loop is running you care about:

This session — not the whole seat
This task — not "AI line item"
Now — not the invoice three weeks later

What teams actually do today:

Upgrade to Max and hope
Spreadsheet leftovers after the fact (ccusage-style)
Slack when someone notices the bill

None of those are a live policy. An alert that fires after the spend already happened is still just an alert.

Soft warn vs hard stop (what we ship today)

LoopBudget attaches to the session trail and evaluates spend against a policy:

Mode	What happens
Soft warn	Cross the soft cap → warn on the receipt + alert members. Session keeps going.
Hard stop	Cross the hard cap → `stop` decision, alerts, session marked stopped in LoopBudget.

Path A honesty: in early access, hard stop is a policy decision + receipt + alert. It is not a guaranteed vendor SIGKILL. Cursor and Claude Code don't expose a perfect "kill this agent now" primitive to third parties the way people wish they did.

So when we say soft warn / hard stop, we mean:

You see the trip live on the session receipt
Your team gets notified
You have something finance (or your future self) can point at

Blocking the next tool call after a turn completes — a real ceiling — is the next step. Soft warn exists so you can wind down before you need that.

Cursor sidecar vs Claude Code Stop hook (high level)

Two connectors, same policy engine.

Cursor — a sidecar watches session transcripts, estimates tokens from the trail, and ingests into LoopBudget. Decisions show in the dashboard. Cursor itself is not force-stopped by us today.

Claude Code — a Stop-hook path sends deltas after a turn. Same ingest → same soft/hard evaluation → same receipt. Claude Code is not killed mid-loop unless you later add a blocking hook that checks LoopBudget first.

Public CLI (static binaries, no Node on the GA path):

github.com/LoopBudget/cli

Estimates can lag vendor invoices. We don't pretend to replace the cloud bill. We aim to make mid-loop visible and policy-shaped.

Half-written files: why we don’t kill mid-edit today

Someone on Product Hunt asked the right question:

Does the hard stop kill the run mid-edit, or wait for the current tool call so you don’t get a half-written file?

Today we don't yank the vendor mid-tool-call. That means LoopBudget isn't the thing leaving a half-written file via a hard kill — because we aren't cutting the edit mid-flight.

The safer control plane looks like:

Soft warn while there's still runway
Let the current tool call finish
Refuse or gate the next tool call once the hard cap trips

That's the design target. Shipping "we killed your agent" before we can do (2)–(3) cleanly would create worse outages than surprise spend.

Try early access

LoopBudget is invite-only early access:

Site: https://loopbudget.com
Product Hunt: https://www.producthunt.com/products/loopbudget
CLI: https://github.com/LoopBudget/cli

If you're an eng lead (or power IC) watching AI tooling become a real cost line, I'd love feedback on where soft vs hard should trip for your team — and whether "wait for current tool call, block the next" matches how you already think about agent risk.