Part of the roster · standalone license available
All-Stop
The button, and the broadcast. Not a scanner, not a dashboard you have to learn to read — a kill switch and a webhook. A human says stop, and it actually stops, across every guard it's wired into. Self-hosted: state lives on your own disk, nothing routes through us.
$799/yr, per org — free as an add-on if you already hold another Northstar license.
Why this exists
60% of organizations can't quickly terminate a misbehaving AI agent.
Kiteworks' 2026 Data Security and Compliance Risk Forecast: 60% of organizations cannot quickly terminate a misbehaving AI agent, and 63% cannot enforce purpose limitations on what an agent is authorized to do. Real, documented case behind why: an agent cleaning an inbox lost its context mid-task and reverted to the last objective it remembered — delete emails. It kept deleting despite being told to stop; nothing software-level worked, and someone had to kill the process at the OS level manually. You discover a bad MCP server, a compromised dependency, a prompt-injection campaign hitting your org — telling everyone who needs to stop using a tool right now means chasing it through email and Slack threads while it's still happening. All-Stop is the button that actually reaches every guard at once, before you're the one manually killing a process at 2am.
- 01
Pure standard library
Zero dependencies. One JSON file is the whole state — any number of processes reading the same file see each other's changes immediately.
- 02
Point your webhook at it
Give it your Slack or Teams incoming-webhook URL. A trip and a reset both fire a real message there automatically — the "tell everyone at once" half, solved without building anything.
- 03
One line per guard
MCP Gateway, Agent Guardrails, and Probe Kit each take a
kill_switch=argument. Decoy Kit's version mutes alert noise during an authorized scan instead, since a honeypot going quiet is itself a tell.
Where this actually fits
AIUC-1 names four kill-switch requirements. Here's the honest map.
AIUC-1 ("the world's first AI agent standard") defines four specific, auditable technical requirements for a real kill switch — not a policy statement. All-Stop alone does not satisfy all four, and we're not going to pretend it does. It's the piece that covers C009 — paired with the rest of the platform, three of the four are covered by real, tested code.
- B006
- Restrict each agent to its authorized scope. Not All-Stop's job. Covered by MCP Gateway's admission scanning and Agent Guardrails' Iron-Thread egress firewall — the layer that constrains what an agent can reach in the first place.
- D003
- Restrict unsafe tool calls. Not All-Stop's job either. Covered by MCP Gateway's argument scanning and call-rate limiting, and Agent Guardrails' prompt-injection detector on tool descriptions and results.
- C009
- Human-in-the-loop stop mechanism. This is All-Stop. AIUC-1 asks for pause/redirect "without requiring full technical shutdown" — as of 0.2, All-Stop has a real, separately-audited
pause()state distinct from a full trip, wired into MCP Gateway and Iron-Thread. One honest gap left, stated plainly: every current integration still enforces a pause the same way it enforces a trip — there's no review-queue to route a paused call to yet, so the state is real but the softer handling isn't. It's the real, working stop mechanism, not the whole spec.
E001–E003 (documented failure plans): organizational, not technical — named owners and activation steps for security breaches, harmful outputs, and hallucinations. No software satisfies this alone, ours included. All-Stop's actor+reason+timestamp audit trail on every trip and reset is real evidence you can point to when you write that plan, not a substitute for writing it.
Trust & release state
59 tests passing, real infrastructure behind the price.
Private repo, invited on purchase. Not a network service: no daemon, no port, nothing listening. A corrupt or unreadable state file is treated as tripped, not clear — a silent false "not tripped" is the dangerous failure direction for a kill switch specifically. Webhook delivery is best-effort with a 5-second timeout; a dead webhook never blocks or fails a trip or reset.
Pricing
Real infrastructure, real price — with a real discount for existing customers.
Flat. Unlimited environments and seats within your org. Included free for 12 months with a Leviathan Platform pilot.
Multi-process kill-switch coordination · Slack/Teams webhook broadcast · included free as an add-on with any other Northstar product license
Card checkout: clicking "Get it" opens Stripe's own hosted checkout page, and you're invited as a GitHub collaborator on the private repo automatically on payment.
Already run a paid Northstar product? All-Stop is included at no extra charge — tell us which license and we'll confirm, no need to pay here.