OpenRouter ships Armor, a tool call guard running on Jev 1.13

OpenRouter launched Armor in beta, a guard that scores each tool call before an agent executes it. It runs on TypeSafe AI's Jev model, and the scoring input is a set of rules plus a slice of the conversation transcript, which OpenRouter says lets it prioritize user intent. Its example: if the user asked to push the work, a git push through the bash tool is allowed, while a dangerous command the user never asked for is flagged.

OpenRouter

@OpenRouter

X

regex-based filtering often isn't enough to detect unwanted tool calls

OpenRouter

@OpenRouter

X

On an internal test set we generated for this task, Jev 1.13 had the highest accuracy and lowest cost

The pitch is aimed squarely at people who have been writing regular expressions to decide which shell commands an agent may run.

What it replaces

OpenRouter frames Armor as a way to make Claude Code's auto permissions mode work with any model, not just Anthropic's. The setup line in the post runs Claude Code through Ori with Kimi K3 and the permission mode set to auto. Any agent already doing inference through OpenRouter can turn Armor on by adding it as a plugin with custom rules.

The numbers that are not there

OpenRouter says that on an internal test set it generated for this task, Jev 1.13 had the highest accuracy and lowest cost against other Decisions models and against Claude Code's use of Sonnet 5. That is the whole evidence base, and it comes with no accuracy figure, no price, no latency and no list of which Decisions models were in the comparison. The test set is OpenRouter's own and unpublished. The post also claims better performance than Claude Code's auto classifier at a fraction of the cost without putting a number on either half of that sentence.

So this is a vendor claim about a vendor's own benchmark, published by the company that benefits when traffic routes through it. It is not a result anyone outside OpenRouter has reproduced.

Diogo Almeida, who has argued that Jev's imitators copy the interface and miss the reliability, replied to the launch with "SO FKIN COOL". That is enthusiasm, not a measurement.

For people building on it

Note the version. Armor's stated result is on Jev 1.13, while Jev 1.14 is already out, so the accuracy and cost comparison OpenRouter ran is not a comparison against the current model. And the guard is a classifier sitting in front of execution, which means it carries a false negative rate that nobody has published. If you are using it to decide whether an agent may run shell commands on a machine you care about, you are trusting an unpublished number on an unpublished test set. Measure it on your own tool calls before you take the regular expressions out.