OpenRouter's Armor Vets Agent Tool Calls. In Claude Code Mode It Only Flags Them

OpenRouter launched Armor in beta to act as a safety classifier between AI models and applications. The tool checks every tool call against user-defined rules written in plain English before execution. When a call is flagged, the model is informed of the rule it violated and the call is not executed. In Claude Code mode, Armor flags the tool_use but keeps it in the response, marking it instead of stopping it.

This allows the application to decide whether to halt the call based on the flagged verdict. The safety classifier uses a decision model called TypeSafe's Jev, which evaluates the call against the provided rules and returns a probability indicating whether it matches each rule. Jev is designed to provide more precise results than traditional regex-based filtering methods.

There are three types of rules: hard_deny, soft_deny, and allow. Hard_deny rules block the call without exceptions, soft_deny rules block the call unless an allow rule matches or the user explicitly requests the operation, and allow rules define exceptions to soft_deny rules. Each rule has an id, optional name, instructions, and optional threshold values, with default values of 0.6 for deny rules and 0.7 for allow rules.

OpenRouter offers an audit mode, allowing developers to test and tune their rules using real traffic before enforcing them. In audit mode, Armor scores every call but does not block them, enabling developers to monitor and adjust their rules as needed.