PHPackages laravelsecurityaudit/laravel-ai-circuit-breaker - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. laravelsecurityaudit/laravel-ai-circuit-breaker ActiveLibrary[Security](/categories/security) laravelsecurityaudit/laravel-ai-circuit-breaker =============================================== An abuse firewall for AI endpoints: detect runaway agent loops within a request, and open a circuit on a per-tenant spend anomaly, before a self-recursing agent drains the API budget. Security-framed, not just rate limiting. v0.1.0(1mo ago)03↓50%MITPHPPHP ^8.2CI passing Since Jun 28Pushed 1mo agoCompare [ Source](https://github.com/laravelsecurityaudit/laravel-ai-circuit-breaker)[ Packagist](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-circuit-breaker)[ Docs](https://github.com/laravelsecurityaudit/laravel-ai-circuit-breaker)[ RSS](/packages/laravelsecurityaudit-laravel-ai-circuit-breaker/feed)WikiDiscussions main Synced 2w ago READMEChangelogDependencies (10)Versions (2)Used By (0) Laravel AI Circuit Breaker ========================== [](#laravel-ai-circuit-breaker) An abuse firewall for AI endpoints. It stops the failure mode rate limiting does not model: a runaway agent that calls itself in a loop, or a single tenant whose spend suddenly spikes, draining the API budget before anyone notices. This is not a rate limiter. It does two things rate limiters and cost dashboards do not: 1. **Loop breaker.** Detects a runaway agent within one request lifecycle: too many AI calls, or the same call repeated too many times. A self-recursing agent trips this first. 2. **Spend-anomaly circuit breaker.** Tracks estimated input tokens and calls per principal over a rolling window, and opens a circuit (with a cooldown) when a tenant spikes. > This is an independent open-source package. It is not affiliated with, endorsed by, or sponsored by Laravel, Laravel LLC, or any AI provider. Requirements ------------ [](#requirements) - PHP 8.2+, Laravel 12 or 13 Installation ------------ [](#installation) ``` composer require laravelsecurityaudit/laravel-ai-circuit-breaker ``` It registers a global HTTP-client middleware, so it governs every outbound request to a known AI provider regardless of the SDK. Prism and the `Http` facade are covered automatically; for a client with its own Guzzle stack (openai-php), attach `CircuitBreaker::stack()`. Observe first, enforce when ready --------------------------------- [](#observe-first-enforce-when-ready) By default the breaker observes: it counts, fires events, and logs, but never blocks, so it can never break a legitimate workload on a false anomaly. Turn on enforcement when you trust the thresholds: ``` CIRCUIT_BREAKER_ENFORCE=true ``` When enforcing, a tripped limit opens the circuit for that principal and throws `CircuitOpenException`, which fails the AI call (fail-closed). `fail_open` is true, so an internal error never breaks a real call. Principals and multi-tenancy ---------------------------- [](#principals-and-multi-tenancy) Calls are accounted to the authenticated user, tenant-aware when your user model exposes a tenant key, falling back to the client IP. Bind your own `PrincipalResolver` to customise the fingerprint. A note on spend estimates ------------------------- [](#a-note-on-spend-estimates) The outbound request carries no token usage, so spend is estimated from the request body (about four characters per token). This is an anomaly brake, not billing. Exact post-hoc accounting from the response is a planned addition. Events ------ [](#events) `LoopDetected` and `CircuitOpened` fire in both observe and enforce mode, so you can wire SIEM, Slack, or PagerDuty with a single listener. Configuration ------------- [](#configuration) ``` php artisan vendor:publish --tag=circuit-breaker-config ``` ``` CIRCUIT_BREAKER_ENABLED=true CIRCUIT_BREAKER_ENFORCE=false CIRCUIT_BREAKER_MAX_CALLS=25 CIRCUIT_BREAKER_MAX_REPEATS=5 CIRCUIT_BREAKER_WINDOW=60 CIRCUIT_BREAKER_MAX_TOKENS=200000 CIRCUIT_BREAKER_COOLDOWN=300 ``` Testing ------- [](#testing) ``` composer test composer analyse ``` The Laravel Security Audit family --------------------------------- [](#the-laravel-security-audit-family) One detection engine, guarding every place data leaves your app. PackageWhat it guards[laravel-secret-scanner](https://packagist.org/packages/laravelsecurityaudit/laravel-secret-scanner)Shared secret and PII detection engine (the core)[laravel-mail-guard](https://packagist.org/packages/laravelsecurityaudit/laravel-mail-guard)Outgoing Laravel mail[laravel-ai-egress-guard](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-egress-guard)Outbound AI provider traffic (OpenAI, Anthropic, Gemini)[laravel-ai-lint](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-lint)Static analysis: leaked AI keys and unsafe AI wiring**laravel-ai-circuit-breaker** (this package)Runaway AI loops and spend[laravel-ai-ledger](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-ledger)GDPR Article 30 processing ledger for AI trafficLicense ------- [](#license) The MIT License (MIT). See [LICENSE](LICENSE). ### Health Score 35 — LowBetter than 77% of packages Maintenance90 Actively maintained with recent releases Popularity3 Limited adoption so far Community6 Small or concentrated contributor base Maturity36 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 45d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/afa88251494388c616878c63f05e227db8524f18bb98f6b2e51b5788ec4cec25?d=identicon)[laravelsecurityaudit](/maintainers/laravelsecurityaudit) --- Top Contributors [![workaandrey](https://avatars.githubusercontent.com/u/1831403?v=4)](https://github.com/workaandrey "workaandrey (3 commits)") --- Tags laravelsecurityaiAbusellmcostcircuit breaker ### Code Quality TestsPHPUnit Static AnalysisPHPStan Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/laravelsecurityaudit-laravel-ai-circuit-breaker/health.svg) ``` [![Health](https://phpackages.com/badges/laravelsecurityaudit-laravel-ai-circuit-breaker/health.svg)](https://phpackages.com/packages/laravelsecurityaudit-laravel-ai-circuit-breaker) ``` ### Alternatives [psalm/plugin-laravel Psalm plugin for Laravel 3345.4M354](/packages/psalm-plugin-laravel)[laravel/socialite Laravel wrapper around OAuth 1 & OAuth 2 libraries. 5.7k113.1M988](/packages/laravel-socialite)[spatie/laravel-export Create a static site bundle from a Laravel app 679153.2k7](/packages/spatie-laravel-export)[moonshine/moonshine Laravel administration panel 1.3k268.2k88](/packages/moonshine-moonshine)[laravel/mcp Rapidly build MCP servers for your Laravel applications. 79227.1M218](/packages/laravel-mcp)[simplestats-io/laravel-client Server-side analytics for Laravel that follows the full funnel from visit to registration to payment, attributed to the channel that drove it. Revenue, MRR, churn and ad-spend profit (ROAS/CAC) per channel. GDPR compliant, ad-blocker proof. 5226.7k](/packages/simplestats-io-laravel-client) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)