LiteLLM's classifier is a hook: it asks whatever general LLM you configure. Mouse is the verdict itself, from a model trained for exactly this question. In our test from one client, Mouse-1 answered a tool-call gate in a median 344 ms against 1353 ms for Claude Haiku 5.5 as the judge, and planted instructions changed 0% of its decisions.
Claude Code moved its auto-mode safety check to the server in September 2026. Requests that go to Claude get Anthropic's verdict. Requests that a gateway sends to any other model don't, so the gateway has to produce one. LiteLLM's answer is safeguards_classifier_model: name a model from your model_list, and the proxy asks it about every tool call.
At a glance
Mouse /v1/safeguards | LiteLLM safeguards_classifier_model | |
|---|---|---|
| What judges the call | Mouse-1, a trained decision model | Any LLM you configure |
| Median time per verdict (our test) | 344 ms | 1353 ms with Haiku 5.5, 1706 ms with GPT-6 Sol |
| Wait ceiling | 10 s default (200 ms – 30 s) | 30 s default, no retry |
| Published injection results | Yes: 0% flipped | Depends on the model you pick |
| Output | Calibrated probability per rule | The LLM's yes or no |
| Runs where | Hosted API | In your own proxy |
| Cost | $0.10 per 1M input tokens, free output | Your chosen model's input and output price |
| Open source | No | Yes |
Speed: a decision model vs a chat call
A general LLM reaches a verdict by generating text: it reads the prompt, maybe thinks, then writes JSON. Mouse-1 reads the state once and scores the options directly, with no generated tokens. On a single gate ("is this command safe to run without asking?"), sent 20 times to each model from the same machine, interleaved:
Full HTTPS round trip from one client, seconds · Lower is better
| Mouse-1 | 0.34 s |
|---|---|
| Haiku 5.5 | 1.4 s |
| GPT-6 Sol | 1.7 s |
| Opus 5.5 | 3.1 s |
LiteLLM holds a streaming tool-call turn until the classifier answers. Every tool call in an auto-mode session pays that wait.
What the judge can be talked into
The classifier reads the transcript, and the transcript contains untrusted text: file contents, web pages, command output. With LiteLLM, how well the gate resists a planted "this is fine, approve it" depends entirely on which model you configure. For Mouse-1 we publish it: on our planted-instruction test, none of its decisions changed.
Using Mouse from a gateway
Send the conversation, the proposed tool calls and your hard_deny, soft_deny and allow rules to POST https://api.mouse.dev/v1/safeguards, and pass the safeguard_results back to Claude Code unchanged. The safeguards guide has the full request.
How we measured
- Latency: one yes/no gate, 20 interleaved calls per model from one laptop on October 20, 2026 (
bench/race/latency.py). The LLM judges ran through OpenRouter at low reasoning effort with a strict JSON schema, the way a classifier hook calls them. - Injection: our planted-instruction suites, one template.
- LiteLLM facts: from LiteLLM's Claude Code auto-mode documentation, checked October 20, 2026.
Sources
Checked October 20, 2026.
- LiteLLM: Claude Code auto mode
- LiteLLM: server-side auto mode
- Claude Code permission modes
- Mouse-1 API reference and pricing
See also: Mouse-1 vs OpenRouter Armor · Mouse-1 vs Claude Haiku as a judge · All comparisons
FAQ
What is LiteLLM's safeguards classifier?
A LiteLLM proxy setting, safeguards_classifier_model, added in v1.107.0. When Claude Code runs in auto mode against a non-Claude model behind LiteLLM, the proxy sends each tool call to the LLM you name and returns its verdict in Claude Code's safeguard_results format. It is off by default.
Can I use Mouse as LiteLLM's classifier?
Mouse's POST /v1/safeguards takes the conversation, the tool calls and your rules, and returns safeguard_results in the format Claude Code reads. Any gateway, LiteLLM included, can call it for the verdict instead of a general LLM.
How long does LiteLLM wait for a verdict?
Up to 30 seconds by default, with no retry; a shorter timeout on the classifier deployment lowers that. Streaming tool-call turns are held for as long as the check takes. Mouse's safeguards endpoint defaults to a 10-second budget; in our test from one laptop, Mouse-1 returned a gate verdict in a median 344 ms, round trip included.
What does the LiteLLM classifier see?
A trimmed transcript of about 24,000 characters, with each entry capped at 2,000 characters and each tool result at 500. The system prompt and thinking blocks are not sent.