Cycles
Cycles is a self-hosted, Apache 2.0 runtime authority layer that gates what AI agents spend and do. It reserves budget before each protected call, commits actual usage afterwards, and blocks risky actions before they ever execute.
What is Cycles?
Cycles is a runtime authority layer for autonomous AI agents. It sits on a mandatory execution boundary inside your own application and answers one narrow, enforceable question before each protected action: does the configured budget still have enough capacity for the amount and scope the caller submitted? Where the integration requires a successful reservation before execution, a rejected reservation stops the action instead of merely logging it after the fact.
The mechanism is a reserve-commit lifecycle borrowed from transaction infrastructure. Budget is atomically locked before the agent acts, actual usage is committed once the call returns, and unused capacity is released. Reservations are idempotent, so retries cannot settle twice, and concurrent agents sharing one budget cannot oversubscribe it. Budgets are hierarchical across six scope levels — tenant, workspace, app, workflow, agent and toolset — and a single reservation is checked against every level that has a budget defined.
Cost is only the first dimension. Callers can classify tool calls in RISK_POINTS and fund them from a separate budget, so an agent keeps authority over safe internal actions while a customer-facing email or a destructive mutation is denied before it runs. Every reservation, commit, release and event produces a structured record, queryable through the REST API and exportable to cold storage — which is what turns "the agent was under control" into something an auditor can actually read.
The vendor positions Cycles as the authority layer beside routing and observability tools rather than a replacement for them, and states plainly that it is neither an observability platform, an eval framework nor an LLM proxy. It ships as Apache 2.0 open source with clients for Python, TypeScript, Java on Spring Boot and Rust, an MCP server for Claude Desktop, Claude Code, Cursor and Windsurf, and documented patterns for 28 frameworks and providers including OpenAI, Anthropic, LangChain, LangGraph, CrewAI and the Vercel AI SDK.
Deployment is self-hosted only. Redis, the runtime server, the admin server and the events service all run in your infrastructure, and no prompt, response or tool argument ever reaches the vendor. A managed cloud is on the roadmap but is not yet available.
What it does
- Reserve budget before a protected LLM call, tool call or side effect, then commit the actual usage and release the rest
- Reject a live reservation and stop the action when the configured budget is exhausted, before anything executes
- Cap high-consequence actions such as emails, deployments or mutations through RISK_POINTS budgets per toolset
- Isolate every customer with hierarchical budgets across tenant, workspace, app, workflow, agent and toolset
- Produce queryable lifecycle records — reservations, commits, releases and events — for audit and evidence
- Run in shadow mode against real traffic to calibrate budgets without blocking production
- Deliver signed webhook events to your own systems with HMAC verification and SSRF protection
When to use Cycles / When not to
A quick filter to help you decide if Cycles is the right fit.
When to use Cycles
- Platform and infrastructure teams running autonomous agents in production, who need a hard ceiling rather than an after-the-fact alert
- Multi-tenant AI SaaS builders who cannot let one customer's runaway loop drain the budget shared with the other five hundred
- Engineering teams on Python, TypeScript, Spring Boot or Rust stacks, or on MCP hosts such as Claude Code, Cursor and Windsurf
- Security and compliance teams in regulated environments who must produce enforcement evidence for EU AI Act, NIST AI RMF or ISO/IEC 42001 work
- Organisations comfortable operating self-hosted Apache 2.0 software, since there is no managed cloud today and everything runs in their own infrastructure
When not to use Cycles
- Teams running a single-tenant prototype with no concurrency, for whom the vendor itself says a local counter is enough
- Anyone who needs a fully managed SaaS, because Cycles is self-hosted only and the managed cloud is roadmap, not product
- Teams looking for observability, tracing or evaluation tooling, which the vendor explicitly states Cycles is not
- Teams wanting content-level safety such as PII or toxicity filtering, a job Cycles leaves to complementary tools
- Small teams without the operational capacity to run Redis, a runtime server, an admin server and an events service
How to use Cycles
A typical end-to-end flow, from setup to results.
- Run the local demo first: clone the demo repository, create a Python virtual environment and run ./demo.sh — Docker Compose v2+, Python 3.10+ and curl are the only prerequisites, and no LLM API key is needed
- Watch the unguarded agent overspend, then the guarded one stop cleanly at the one-dollar cap, so you see enforcement before you commit to anything
- Bring up the stack for evaluation: Redis, the runtime server on port 7878, the admin server on port 7979 and the operator dashboard
- Create a tenant, then create a budget explicitly through the admin API with a scope, a unit and an allocated amount — creating a tenant does not create a budget
- Issue a scoped API key with least-privilege permissions and pass it in the X-Cycles-API-Key header
- Wrap a single LLM call with the @cycles decorator in Python, the withCycles wrapper in TypeScript, the @Cycles annotation in Spring, or a Tokio guard in Rust
- Extend coverage to tool calls, assigning RISK_POINTS so that consequential actions are budgeted separately from spend
- Alternatively add the Cycles MCP server to Claude Desktop, Claude Code, Cursor or Windsurf for budget-aware workflows, remembering that MCP integration is cooperative rather than a hard boundary
- Run in shadow mode against real traffic for a day or more to calibrate budgets without blocking anyone
- Flip one workflow to live enforcement, then harden the deployment: internal-only networking, secrets in a manager, webhook signing keys and an export path to cold storage
Pros & Cons
Pros
- The software is genuinely free and Apache 2.0 licensed, with no licence key, no feature gating and no seat fees
- No cut of your agent spend: support pricing is flat and independent of tokens, requests, tenants or provider bills
- Nothing leaves your infrastructure — no prompts, no responses, no tool arguments, and no telemetry in the software
- Enforcement happens before execution, where routing and observability tools can only report afterwards
- Unusually thorough documentation for a young project: 320 sitemap URLs, 78 how-to guides and 27 protocol pages
- Two runnable demos take about a minute and need no API key, so evaluation costs almost nothing
- A detailed security page covering ports, network zones, retention, SSRF and encryption, plus a 48-hour vulnerability acknowledgement target
Cons
- Self-hosted only: you operate Redis, a runtime server, an admin server and an events service yourself
- No managed cloud — runcycles.ai is announced but not available
- No certification at all; SOC 2 Type I is tied to the future managed cloud and is described as not yet in progress
- A young product at version 0.1.x, first released in April 2026 and still in design-partner mode
- No terms of service, no legal notice and no legal entity published anywhere — only the domain appears in the copyright line
- No GDPR mention, no data processing agreement and no subprocessor list, which will slow enterprise procurement
- Enforcement covers only the paths you instrument, and paid support starts at 18,000 USD a year
Pricing & Plans
The software itself is permanently free: Cycles is Apache 2.0 open source, self-hosted, with no licence key and no feature gating, and the Community tier carries no charge. Paid plans buy support and assurance rather than capabilities. The lowest paid entry point is the Production Support plan at 1,500 USD per month, billed annually at 18,000 USD per year, and presented on the site as introductory pricing. Enterprise starts at 6,000 USD per month, billed annually from 72,000 USD per year. Fixed-scope services are quoted separately, from 3,500 USD for a half-day workshop. No free trial is offered, because the free tier is permanent rather than time-limited, and the vendor states it never takes a percentage of your agent spend.
- GitHub issues
- documentation and community help
- best-effort response
- public security advisories and a public roadmap
- one production deployment or workload path
- a private Slack channel plus email
- next-business-day response with a four-business-hour SEV-1 target
- early security advisories and upgrade guidance
- one annual scope review and roadmap input
- a named engineer
- quarterly architecture reviews
- custom incident-response terms with optional 24x7 SEV-1 cover
- evidence and retention configuration with auditor Q&A support
- version pinning
- pre-release access to protocol changes and prioritised protocol requests
- architecture
- security and scope-model review with a Redis high-availability and capacity plan
- written findings
- a deployment risk register and a 30-day implementation plan
- wiring Cycles into one agreed workload path with reserve
- commit and release
- shadow mode where applicable
- and a working patch set in Python
- TypeScript
- Spring or MCP
- mapping Cycles evidence and runtime controls to selected control narratives for EU AI Act readiness
- NIST AI RMF and ISO/IEC 42001
- with signing and retention configured
- Team Enablement Workshop — 3
- 500 USD for a half day or 6
- 000 USD for a full day
- remote
- for up to twelve engineers
- founder access and priority support during a 60-day integration window in exchange for running a real workload
Data, GDPR & hosting
A consolidated view of how Cycles handles your data.
GDPR overview
There is no mention of the GDPR anywhere on this site — the word does not appear on any of the pages collected, and the sitemap of 320 URLs contains no terms of service, no legal notice, no data processing agreement and no subprocessor list. No Article 27 representative and no data protection officer are named. The privacy policy, dated 21 July 2026, does grant data-subject rights without naming the regulation: you may ask to see, correct or delete what is held, by writing to hello@runcycles.io. In practice that scope is narrow, since email correspondence is the only personal data the vendor holds. Because Cycles is self-hosted, the security page states that compliance posture inherits whatever your own infrastructure and audit perimeter already provide.
Who owns the data?
You own your data, because the vendor never receives it. Cycles is self-hosted software: budget state lives in your own Redis, inside your infrastructure, under your region choice and your retention policy. The privacy policy states plainly that the publisher has no access to it and receives none of it. Clients, the MCP server and the desktop extension connect only to the Cycles server URL you configure, and the software ships with no telemetry or phone-home. The only personal data the vendor routinely holds is email correspondence you send it. For data inside a deployment run by your employer or vendor, that operator is the controller, not Cycles.
Reuse rights
Because the vendor holds nothing, there is no permission to ask for: your budget records, event history and exported evidence are yours to query, join, retain and reuse as your own policies allow. Cycles stores budget state rather than content, so no prompts, no model responses and no tool arguments or outputs are captured at all. Reservations, commits, releases and events are readable through the REST API and exportable to any object store for your own long-term use. The one caution the site raises is that free-form metadata fields hold whatever your integration puts in them, so personal data should only go there if your own rules permit it. Emails you send the vendor are used to reply, not for marketing lists.
Data retention & training
Hosting summary
There is no vendor-side hosting to describe, because Cycles is self-hosted only. All state lives in Redis running inside your own infrastructure, and the security page is explicit that you control the region, the instance type and the retention policy. Cycles state does not leave your network unless you configure an outbound path yourself, such as webhook delivery or an export pipeline to S3, Google Cloud Storage or another object store. Compliance scope, network exposure, data location and admin access therefore all sit inside your existing audit perimeter. The vendor declares no hosting country and no hosting region, and holds no customer data to host. The only vendor-side infrastructure is the marketing and documentation site itself, a static site served by GitHub Pages, where GitHub processes standard server logs that the vendor says it neither receives nor stores. A managed cloud offering is planned; when it ships, the security page is expected to document its residency and certification posture.
Things to keep in mind
Risks and trade-offs to weigh before adopting Cycles.
- Enforcement covers only the code paths you instrument; uninstrumented traffic passes untouched, so a partial rollout can create false confidence
- MCP integration is cooperative rather than binding — hard limits require a mandatory handler, gateway or service boundary, not a well-behaved agent
- No legal entity, postal address or terms of service is published anywhere on the site, which leaves you with no contractual counterparty on paper
- No GDPR mention, no data processing agreement and no subprocessor list, a gap worth raising with your own legal team before deployment
- The cost and margin figures quoted across the site are presented by the vendor as illustrative or drawn from its own blog, not as measured customer outcomes
- Development-only escape hatches for plaintext webhook secrets and private-network delivery must never be enabled in production
- A budget ceiling is not a substitute for reviewing what your agents are allowed to do: it bounds the damage, it does not make the design safe
Setup & Integrations
Technical difficulty
Two very different levels. Evaluating is easy: a Docker Compose demo runs in about five minutes with no API key, and wrapping a first LLM call takes one decorator. Production is genuine platform work — Redis with a high-availability and capacity plan, a runtime server, an admin server, an events service, TLS termination and three-zone network separation, plus runtime and admin API keys and a shared webhook encryption key. The vendor sells a 7,500 USD readiness review that includes the Redis plan, a fair measure of the effort involved. Expect a platform engineer, not a weekend.
Deployment
Integrations
Behind Cycles
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Cycles.
Frequently asked questions
Is the software really free?
Does Cycles take a percentage of what my agents spend?
Where does my data live, and what can the vendor see?
Does Cycles store my prompts or model responses?
Which languages and frameworks are supported?
Is there a managed cloud version?
How long is data kept?
Does Cycles hold any certifications?
Does Cycles replace a rate limiter or an LLM gateway?
How do I report a security vulnerability?
Should you pick Cycles?
Cycles occupies a real gap. Routing layers pick the model and observability layers report what happened, but neither can stop the two hundred and first email or the two hundred and forty-first retry. Cycles does exactly that, with a reserve-commit design borrowed from transaction infrastructure and applied to agent execution, and it does it as free Apache 2.0 software with no seat fees and no cut of your spend. For a team already running multi-tenant or concurrent agents with real money and real consequences at stake, that combination is hard to find elsewhere.
The trade-offs are equally clear. This is infrastructure you operate yourself — Redis, a runtime server, an admin server and an events service — and the vendor's own 7,500 USD readiness review is a fair signal that production deployment is not trivial. The product is at version 0.1.x with a first release in April 2026, holds no certifications, and the SOC 2 work is explicitly tied to a managed cloud that does not exist yet. Most notably for a procurement team, the site publishes no terms of service, no legal notice, no company name beyond the domain itself, and no mention of the GDPR at all.
None of that undermines the engineering, which is documented in unusual depth for a project this young. It does mean Cycles today is best read as excellent open-source infrastructure from a credible founder rather than as a finished commercial vendor relationship. Try the one-minute demo, wrap one call, run shadow mode — the cost of finding out is close to zero, and the paperwork questions can wait until you know whether the enforcement model fits.
- Choosing a selection results in a full page refresh.
- Opens in a new window.