LongGuard: A Circuit Breaker for LangGraph to End Agent Runaway Loops

If you're running AI Agents in production, you've likely witnessed them "burn cash in real-time": a single ambiguous tool response (like "Access Denied" or "Item not found") can trap an Agent in a cognitive death loop, repeatedly calling the same tool twenty-plus times until LangGraph crashes with a GraphRecursionError. By the time it actually fails, you've burned through 50,000 tokens, lost conversation state, and returned an unhandled exception to the user.

To address this pain point, the EnDevSols team has open-sourced their internal middleware—LongGuard, a circuit breaker designed specifically for LangGraph. Its goal is clear: dynamically detect and recover from these runaway loops instead of simply crashing.

Why the Built-in recursion_limit Isn't Enough

LangGraph provides a recursion_limit to prevent infinite loops, but it's merely a "blunt crash barrier." While it stops the program from running forever, it fails to:

• Distinguish whether the Agent is performing meaningful multi-step reasoning or spinning in circles;
• Intervene and attempt correction before crashing;
• Preserve state after crashing—it just throws the exception at the user;
• Control costs—by the time the limit triggers, the money is already spent.

In other words, recursion_limit is just a final death line, whereas production environments truly need a system that can detect early and intervene proactively. This is precisely the gap LongGuard aims to fill.

Real-Time Detection of Four Runaway Patterns

At its core, LongGuard embeds into your StateGraph and evaluates four failure modes at sub-millisecond speed with every Agent step:

1. Identical Tool Calls

Captures exact duplicate calls within a sliding window through fast SHA-256 hashing of tool parameters. This deterministic hashing approach is foolproof with virtually no latency overhead.

2. Semantic Oscillation

A more subtle case where the LLM changes wording but remains stuck in the same thought loop. LongGuard identifies this "same wine in a new bottle" death spiral by analyzing embedding variance.

3. Dead-End Drift

If the Agent takes five or more consecutive steps without discovering any new observations (measured by Jaccard similarity), it's likely stuck in fruitless exploration, triggering the circuit breaker.

4. Token Velocity

Tracks rolling token consumption per step to catch exponentially expanding "monologues"—those ever-lengthening, ever-deepening self-conversations.

These four patterns cover everything from the most obvious repeated calls to the most subtle semantic stutters, forming a relatively complete Agent runaway detection net.

Reflect & Pivot: Not Just Killing the Process

LongGuard's most interesting design lies in its recovery mechanism. Rather than immediately terminating upon loop detection, it employs a standard circuit breaker state machine: CLOSED → REFLECTING → HALF_OPEN → OPEN.

When a loop is detected, it injects a targeted system prompt into the Agent, such as:

"Stop calling search. You've attempted this 3 times with zero new information. Change your strategy."

This "Reflect & Pivot" approach is key:

• If the Agent adjusts its strategy accordingly, the circuit breaker resets and execution continues;
• If the Agent stubbornly repeats itself, the breaker cleanly terminates execution, saves state, and outputs a structured audit report.

This two-stage "warn then break" design is far more elegant than a hard crash and better suited to real production fault tolerance requirements.

Hard Budget Ceiling: Goodbye Billing Shocks

Beyond loop detection, LongGuard includes a built-in pricing engine covering 40+ models, allowing you to set a hard dollar budget ceiling per run:

GuardConfig(model="gpt-4o", max_cost_usd=0.50)

Once a run reaches the cost ceiling, the circuit breaker trips. For cost-sensitive production deployments, this is an extremely practical safety valve that completely eliminates surprise bills from stuck Agents.

Integration is also remarkably simple—just one line of wrapper code:

from langgraph.graph import StateGraph
from longguard.integrations.langgraph import add_guard_to_graph
from longguard import GuardConfig

workflow = StateGraph(AgentState)
# ... your standard nodes and edges ...

# One line to wrap the reasoning node:
workflow = add_guard_to_graph(
    workflow,
    GuardConfig(model="gpt-4o", max_cost_usd=0.50)
)
app = workflow.compile()

Tradeoffs & Limitations: Semantic Detection May Be Oversensitive

Worth noting, the authors candidly acknowledge the tool's tradeoffs:

• Deterministic hashing (identical tool call detection): Foolproof, zero latency, safe to use;
• Semantic oscillation detector: This is where caution is needed. If your Agent is executing a genuinely complex multi-step reasoning path that looks "repetitive" to the evaluator, the semantic detector may be overly aggressive and misfire. In such cases, you'll need to adjust default thresholds for your specific scenario.

This means LongGuard isn't a universal out-of-the-box solution—for Agents with inherently long and complex reasoning chains, users will need to invest some tuning effort.

Engineering Practice Highlights

From an engineering perspective, LongGuard demonstrates restraint in dependency management and code quality:

• MIT License: Commercial-friendly with no legal concerns for integration;
• Fully typed: IDE and large codebase friendly;
• No forced heavy ML dependencies: Won't bloat your tech stack with a pile of machine learning packages just for a circuit breaker.

These details reflect the team's understanding of real production constraints—production-grade tools derive value not only from functionality but from being "lightweight, controllable, and non-intrusive."

Summary

LongGuard addresses a very specific yet widespread Agent engineering pain point: token waste and billing runaway caused by uncontrolled loops. Its protection strategy can be summarized in three layers:

1. Multi-dimensional detection—from hash-level exact matching to embedding-level semantic analysis, covering four common runaway patterns;
2. Proactive recovery—guiding the Agent to "reflect and pivot" through injected prompts rather than crashing directly;
3. Hard cost backstop—using budget ceilings to completely plug billing leaks.

For any team running LangGraph Agents in production, this is an open-source solution worth attention. Of course, semantic detection threshold tuning and edge cases not yet covered will need gradual validation in actual use. The project welcomes community PRs and issues to collectively refine this circuit breaker mechanism.