Part of Leviathan Platform · standalone license available
The button, and the broadcast. Not a scanner, not a dashboard you have to learn to read — a kill switch and a webhook. A human says stop, and it actually stops, across every guard it's wired into. Self-hosted: state lives on your own disk, nothing routes through us.
Why this exists
Kiteworks' 2026 Data Security and Compliance Risk Forecast: 60% of organizations cannot quickly terminate a misbehaving AI agent, and 63% cannot enforce purpose limitations on what an agent is authorized to do. Real, documented case behind why: an agent cleaning an inbox lost its context mid-task and reverted to the last objective it remembered — delete emails. It kept deleting despite being told to stop; nothing software-level worked, and someone had to kill the process at the OS level manually. You discover a bad MCP server, a compromised dependency, a prompt-injection campaign hitting your org — telling everyone who needs to stop using a tool right now means chasing it through email and Slack threads while it's still happening. All-Stop is the button that actually reaches every guard at once, before you're the one manually killing a process at 2am.
Zero dependencies. One JSON file is the whole state — any number of processes reading the same file see each other's changes immediately.
Give it your Slack or Teams incoming-webhook URL. A trip and a reset both fire a real message there automatically — the "tell everyone at once" half, solved without building anything.
MCP Gateway, Agent Guardrails, and Probe Kit each take a kill_switch= argument. Decoy Kit's version mutes alert noise during an authorized scan instead, since a honeypot going quiet is itself a tell.
Where this actually fits
AIUC-1 ("the world's first AI agent standard") defines four specific, auditable technical requirements for a real kill switch — not a policy statement. All-Stop alone does not satisfy all four, and we're not going to pretend it does. It's the piece that covers C009 — paired with the rest of Leviathan Platform, three of the four are covered by real, tested code.
Not All-Stop's job. Covered by MCP Gateway's admission scanning and Agent Guardrails' Iron-Thread egress firewall — the layer that constrains what an agent can reach in the first place.
Not All-Stop's job either. Covered by MCP Gateway's argument scanning and call-rate limiting, and Agent Guardrails' prompt-injection detector on tool descriptions and results.
This is All-Stop. AIUC-1 asks for pause/redirect "without requiring full technical shutdown" — as of 0.2, All-Stop has a real, separately-audited pause() state distinct from a full trip, wired into MCP Gateway and Iron-Thread. One honest gap left, stated plainly: every current integration still enforces a pause the same way it enforces a trip — there's no review-queue to route a paused call to yet, so the state is real but the softer handling isn't. It's the real, working stop mechanism, not the whole spec.
Pricing
Flat. Unlimited environments and seats within your org. Included free for 12 months with a Leviathan Platform pilot.