Use Armor if all your agent traffic already goes through OpenRouter and you want a free switch to flip during its beta. Use Mouse when you want the gate to work with any provider and to know what you are trusting: Mouse names the model behind its verdicts and publishes its scores, including a 0% flip rate under planted instructions.
Since Claude Code moved its auto-mode classifier to the server, any gateway that serves Claude Code with a non-Claude model has to answer "may this tool call run?" itself. OpenRouter's answer is Armor. Ours is POST /v1/safeguards. They speak the same format; they differ in where they run and what you can check.
At a glance
Mouse /v1/safeguards | OpenRouter Armor | |
|---|---|---|
| Where it runs | Separate API, any gateway or agent loop | Inside OpenRouter's proxy |
| Model providers covered | Any | Traffic routed through OpenRouter |
| Model behind it | Mouse-1, named | "The decision model" (not named in docs) |
| Published accuracy and injection evals | Yes | No |
| Rule format | hard_deny, soft_deny, allow, plain English | hard_deny, soft_deny, allow, plain English |
Claude Code safeguard_results | Yes | Yes |
| Price | $0.10 per 1M input tokens | Free during beta |
| Setup if you already use OpenRouter | One call per tool turn | A plugin entry |
| Zero data retention | Default on every request | Supported (zero-retention tenancy) |
| HIPAA / data region | Not offered | Rejected with 403 |
| Added latency | ~70–90 ms server time per request | 279 ms median, 334 ms p90 (OpenRouter's numbers) |
Why "which model" matters for a safety gate
A tool-call gate reads untrusted text: the transcript, file contents, command output. If a line in a README can talk the gate into allowing rm -rf, the gate is a liability. So the useful question about any gate is how its model behaves under planted instructions.
For Mouse-1 we publish the answer. On our injection suite, a planted instruction changed none of its decisions. On the agent permission suite, it judged whether an action should be allowed correctly 97.1% of the time and caught dangerous actions 98.9% of the time.
Decisions changed by a planted instruction (%) · Lower is better
| Mouse-1 | 0% |
|---|
Armor's docs don't name its model or publish an evaluation, so we can't put a number next to ours. If reports that it runs on Jev are right, see Mouse-1 vs Jev for how Jev did on the same injection test.
How each one is judged
Armor holds each tool call, sends it with your rules and the transcript to its decision model, and gets a probability per rule. A deny rule fires above 0.6 and an allow rule above 0.7 by default. enforce blocks; audit only logs.
Mouse asks Mouse-1 up to three questions per call: which deny rule this breaks, whether the user explicitly asked for this exact operation, and, only when a soft deny matched, which allow rule covers it. A hard deny always flags. A soft deny flags unless the user asked for it or an allow rule covers it. You can fit a calibrated cutoff on your own labelled calls, and tune Mouse-1 on your outcomes.
Using Mouse as the gate
Send the conversation, the proposed tool calls and your rules to POST https://api.mouse.dev/v1/safeguards, and return the safeguard_results it gives you unchanged. The safeguards guide has the full request, and the gating guide shows the same pattern inside your own agent loop.
How we measured
- Armor facts are from OpenRouter's Armor documentation, checked October 20, 2026.
- Mouse-1's permission and injection numbers come from our agent permission suite (350 items) and planted-instruction runs. The injection test uses one planted-instruction template.
Sources
Checked October 20, 2026.
See also: Mouse-1 vs LiteLLM safeguards · Mouse-1 vs Jev · All comparisons
FAQ
What is OpenRouter Armor?
Armor is an OpenRouter plugin, in beta since October 2026, that checks each tool call a model makes against plain-English hard-deny, soft-deny and allow rules, and can block or flag it. It works on Chat Completions, Responses and Messages traffic routed through OpenRouter.
What is the difference between Mouse /v1/safeguards and Armor?
Both return per-tool-call verdicts in Claude Code's safeguard_results format. Armor runs inside OpenRouter, so your traffic has to go through OpenRouter. Mouse's POST /v1/safeguards is a separate API you call from any gateway or agent loop, whichever model provider you use.
Which model powers Armor?
OpenRouter's docs say only 'the decision model'. Third-party reports say it is TypeSafe's Jev, but OpenRouter has not documented that. Mouse's safeguards endpoint runs on Mouse-1, whose accuracy and prompt-injection results are published.
How much does Armor cost?
Armor evaluation is not billed during the beta; OpenRouter says pricing will come before general availability. Mouse-1 costs $0.10 per 1M input tokens with free output.
Does Armor work with zero data retention or HIPAA?
Armor's evaluator runs on a zero-retention tenancy, so zero-data-retention requests are evaluated. HIPAA and data-region requests are rejected with a 403. Mouse applies zero data retention to every request and does not offer a HIPAA agreement.