The control point

The hard stop belongs before the provider call.

Solwyn wraps the model client your application already uses. Before a supported request is sent, the SDK evaluates the project budget. When the configured enforcement condition is met, it raises a local exception and the request is not sent.

Solwyn checks the project budget in-process before every supported model call. Under budget, the call is sent directly to the provider. When the limit is reached, the SDK raises BudgetExceededError and the call is not sent. Prompt traffic always goes directly to the model provider; only usage metadata is sent asynchronously to the Solwyn dashboard.

Prompt content is never sent to Solwyn, only usage metadata.

The whole integration.

Wrap the client, catch the one exception, and name a fallback. Failover runs in your process.

# pip install "solwyn[openai,anthropic]"
# export SOLWYN_API_KEY="sk_proj_..."
from openai import OpenAI
from anthropic import Anthropic
from solwyn import Solwyn, BudgetExceededError

client = Solwyn(
    OpenAI(),
    fallback=[(Anthropic(), "claude-opus-5-5")],  # failover: Team plan and up
)

try:
    reply = client.chat.completions.create(
        model="gpt-6-sol", max_completion_tokens=1024, messages=msgs
    )
except BudgetExceededError:
    stop_the_run()  # hard cap reached: nothing was sent

One call, step by step.

  1. 01

    Check.

    Before the call leaves your process, the SDK checks every cap that applies: project, model, provider, tag or run.

  2. 02

    Reserve.

    The call's worst-case cost is reserved, so parallel calls can't jointly overrun the cap.

  3. 03

    Send.

    If there's room, the call goes straight to your provider. If not, in hard-deny mode the SDK raises BudgetExceededError and nothing is sent. In alerts-only mode the call still goes through, and you still see the tokens and spend above the threshold.

  4. 04

    Report.

    Token counts, model and latency go to Solwyn in the background. Solwyn prices them; the prompt and response never leave for us.

What we guarantee, and what we don'tThe exact edges of a hard cap: concurrency, outages, streaming./docs/budget-enforcement-semantics

Failure modes

What happens when things break.

Solwyn cloud unreachable

The SDK fails open by default: your agents keep running against cached limits. The one thing an outage never does is lift a hard cap that's already denying.

Provider degraded

A local circuit breaker tracks provider health in your process and routes supported failures to your configured fallback. No network hop, and it works even if Solwyn's cloud is unreachable.

Metadata delivery

Usage metadata is batched and sent asynchronously. It never blocks or delays your model calls.

Read exactly how budget enforcement behaves →

Prompt content is never sent to Solwyn. Only usage metadata.

The full data inventoryEvery field the SDK sends, and every one it doesn't./security

Give your next production agent a budget boundary.

Add a hard cap free