OpenRouter launches Armor in beta, a classifier that blocks AI agents' tool calls when they break rules written in plain English
Today, we are launching OpenRouter Armor in beta. Tool calls allow agents to interact with the world, and regex-based filtering often isn't enough to detect unwanted tool calls. Armor uses @typesafeai's Jev model to guard against out of policy tool calls before your agent executes them, with better performance than Claude Code's auto classifier at a fraction of the cost.
Context
As coding agents run shell commands and touch real systems, a cheap check before each action could prevent destructive or data leaking mistakes.
This is a first hand launch post from OpenRouter, and the claim that Armor beats Claude Code's auto classifier comes from an internal test set OpenRouter has not published. Armor runs on Jev, a decision model from TypeSafe.
Deep dive
On October 15, OpenRouter posted that it was launching OpenRouter Armor in beta. It said tool calls let agents interact with the world, that regex based filtering often is not enough to catch unwanted ones, and that Armor uses TypeSafe's Jev model to guard against out of policy tool calls before an agent executes them, with better performance than Claude Code's auto classifier at a fraction of the cost.
OpenRouter's documentation describes Armor as a classifier that sits between the model and the user's application and evaluates every tool call. Users write rules in plain English for what the model must never do, should usually not do and may do. If a call breaks a rule, Armor blocks it, tells the model why, and the model continues with its other work. An audit mode reports verdicts without blocking, to help tune rules.
The docs say Armor reads Claude Code's safeguards settings and answers in the format Claude Code expects, so its auto mode can work with any model OpenRouter serves. Follow up posts said Jev 1.13 had the highest accuracy and lowest cost on an internal test set, but no test data or metrics were published.
OpenRouter notes that configuration fields may still change during the beta.
What to expect next
Watch for published accuracy numbers or independent tests comparing Armor with Claude Code's own classifier and other guardrails.
Also watch whether agent builders adopt Armor in production, how often it blocks harmless actions, and whether attackers find ways to phrase harmful tool calls that slip past the rules. Anthropic's response to the comparison may also be telling, as may pricing once the beta ends and Armor becomes a standard feature.