Runtime Resource Guard
Protect Agent tasks and runtime hosts with token, memory, process, and idle monitoring.
Runtime Resource Guard
The resource guard monitors running Agent tasks to contain excessive token use, memory leaks, infinite loops, and fork bombs. It does not allocate concurrency slots; concurrency scheduling belongs to the Daemon.
Signals
| Guard | Default limit | Behavior |
|---|---|---|
| Token budget | 2.5M net tokens, 30M total tokens, 300 turns per task | Warns at 80%; stops the task at hard limits. |
| Token burn rate | 300k tokens over 5 minutes | Detects short-term abnormal consumption. |
| Memory | 4 GiB RSS per task, 10 GiB runtime total | Warns at 80%; terminates after the grace period. |
| Process count | 200 per task | Recursively limits child processes. |
| Idle | MOPHEUS_AGENT_IDLE_WATCHDOG | Stops a task with no output and no in-flight tool call. |
Collection and Diagnostics
On Linux the guard prefers cgroup v2 for memory collection and can terminate the entire task cgroup. Without cgroup support it falls back to /proc sampling and records a warning. Alerts and force stops are persisted locally and reported to the control plane.
Inspect a task's diagnostic record with:
mopheus runtime guard explain <task-id>Configuration
The runtime_guard feature flag controls system-level availability (disabled, selected, or enabled). Guard settings resolve from built-in defaults, workspace or runtime policy, agent-specific overrides, and finally MOPHEUS_GUARD_* host environment variables. Host variables take precedence. A task's effective memory ceiling is bounded by both its per-task and runtime-total limits.
Workspace administrators can inspect or change policy with mopheus runtime guard config {get|set|reset}. Use show, stats, events, and explain to inspect active usage and post-mortem diagnostics.