Armor
A tool-calling safety classifier introduced by OpenRouter that sits between models and applications, checking each tool call against natural language rules to decide whether to block it. It supports three rule tiers—hard_deny, soft_deny, and allow—along with multiple output_mode settings.
Timeline (last 90 days)
OpenRouter launched the beta of Armor on October 15, a safety classifier positioned between the model and the application that checks every tool call using natural-language rules.
Armor's decision mechanism is: for each tool call, the call content, rules and conversation context are sent together to a decision model, which returns a match probability for each rule and aggregates them into flagged or not_flagged.
The decision model behind Armor is TypeSafe's Jev, currently at version typesafe/jev-1.14, a structured decision model that returns typed answers with probabilities.
OpenRouter claims that Armor outperforms Claude Code's built-in auto-mode classifier in both performance and cost, but it has not disclosed the test set or the numbers.
Armor's rule system has three tiers: hard_deny (never allowed), soft_deny (usually should not be done but sometimes reasonable), and allow (only as an exception to soft-deny, and never blocks by itself).
Armor's deny rules have a default threshold of 0.6 and allow rules a default threshold of 0.7; each rule contains an id, an optional name, instructions and an optional threshold.
Armor's audit mode scores each call but blocks nothing, and cannot be combined with claude_code_compatibility.
Armor has three output_mode values: text (the default for Chat Completions and Responses, marked with <openrouter_armor_blocked>), custom_item (Responses, producing an openrouter:armor_blocked output item), and claude_code_compatibility (Messages, preserving tool_use and marking flagged in safeguard_results).
In claude_code_compatibility mode, it is the client application that blocks the call; Messages clients that ignore safeguard_results will run the flagged tool_use.
When the decision model times out, errors or receives an oversized request, the result is unavailable, and on_error determines the behavior (block is the default, log is optional), but this setting does not apply to Claude Code mode, where unavailable calls are always let through with a visible verdict attached.
5 more timeline events
All Facts (15)
on_error's block and log correspond to the fail-closed and fail-open failure strategies in distributed systems, and both merely shift risk rather than eliminate it.
50%UnverifiedArmor's decision mechanism is: for each tool call, the call content, rules and conversation context are sent together to a decision model, which returns a match probability for each rule and aggregates them into flagged or not_flagged.
50%UnverifiedThe decision model behind Armor is TypeSafe's Jev, currently at version typesafe/jev-1.14, a structured decision model that returns typed answers with probabilities.
50%UnverifiedOpenRouter claims that Armor outperforms Claude Code's built-in auto-mode classifier in both performance and cost, but it has not disclosed the test set or the numbers.
50%UnverifiedArmor's rule system has three tiers: hard_deny (never allowed), soft_deny (usually should not be done but sometimes reasonable), and allow (only as an exception to soft-deny, and never blocks by itself).
50%UnverifiedArmor's deny rules have a default threshold of 0.6 and allow rules a default threshold of 0.7; each rule contains an id, an optional name, instructions and an optional threshold.
50%UnverifiedArmor's audit mode scores each call but blocks nothing, and cannot be combined with claude_code_compatibility.
50%UnverifiedArmor has three output_mode values: text (the default for Chat Completions and Responses, marked with <openrouter_armor_blocked>), custom_item (Responses, producing an openrouter:armor_blocked output item), and claude_code_compatibility (Messages, preserving tool_use and marking flagged in safeguard_results).
50%UnverifiedIn claude_code_compatibility mode, it is the client application that blocks the call; Messages clients that ignore safeguard_results will run the flagged tool_use.
50%UnverifiedWhen the decision model times out, errors or receives an oversized request, the result is unavailable, and on_error determines the behavior (block is the default, log is optional), but this setting does not apply to Claude Code mode, where unavailable calls are always let through with a visible verdict attached.
50%UnverifiedArmor does not yet support requests under HIPAA, zero data retention or data region restrictions: plugin requests return 403, while Claude Code requests are let through and marked unavailable, falling back to Claude Code's local auto-mode check.
50%UnverifiedWhen loading the Claude Code compatibility rule set, Armor's median latency increases by 279 ms and P90 by 334 ms.
50%UnverifiedFor a self-built Messages client, the prudent approach is to execute only when Armor has evaluated the call and the verdict is not_flagged, rejecting any missing verdict or unavailable; rejecting missing verdicts is the author's choice rather than a documentation requirement.
50%UnverifiedOpenRouter launched the beta of Armor on October 15, a safety classifier positioned between the model and the application that checks every tool call using natural-language rules.
50%UnverifiedEvaluations are not billed during the Armor beta, but OpenRouter says pricing will be introduced before general availability, and the configuration fields, the safeguard_results object and the openrouter:armor_blocked item type may all change.
50%