See what a
token-meter audit finds.

{
  "schemaVersion": "1.0",
  "generatedAt": "2026-07-15T09:14:22.000Z",
  "period": { "start": "2026-07-08T00:00:00.000Z", "end": "2026-07-15T00:00:00.000Z", "days": 7 },
  "sources": [
    {
      "name": "claude-code",
      "status": "available",
      "coverage": 1,
      "recordsAnalyzed": 1842,
      "recordsSkipped": 0,
      "warnings": []
    },
    {
      "name": "codex",
      "status": "partial",
      "coverage": 0.99,
      "recordsAnalyzed": 414,
      "recordsSkipped": 2,
      "warnings": ["2 session file(s) skipped: incomplete usage payload."]
    }
  ],
  "usage": {
    "inputTokens": 3140000,
    "outputTokens": 612400,
    "cacheReadTokens": 8930000,
    "cacheWriteTokens": 740000,
    "totalTokens": 13422400,
    "estimatedCostUsd": 46.8231
  },
  "summary": {
    "findingCount": 5,
    "costAssociatedUsd": 20.47,
    "overallConfidence": "medium",
    "findingsMayOverlap": false
  },
  "findings": [
    {
      "id": "a3f9c1e7b2d84067",
      "rank": 1,
      "type": "expensive_session",
      "title": "Session accounted for 34% of analyzed cost",
      "description": "This session accounted for 34% of analyzed estimated cost — $15.92 of $46.82 across 58 sessions in the 7-day window. Flagged for visibility, not as a problem.",
      "source": "claude-code",
      "project": "acme-invoice-api",
      "sessionId": "cc-8f14e3a1",
      "toolName": null,
      "metrics": {
        "totalUsd": 15.92,
        "costSharePct": 34.0,
        "events": 214,
        "durationMs": 2820000,
        "topModel": "claude-opus-4-8",
        "project": "acme-invoice-api"
      },
      "estimatedCostUsd": 15.92,
      "costLabel": "estimated_cost",
      "confidence": "high",
      "evidence": [
        "$15.92 across 214 events over 47 min (top model: claude-opus-4-8).",
        "That's 34.0% of $46.82 across 58 sessions in the 7-day window."
      ],
      "recommendations": [
        "Review this session's transcript to see what drove the cost (model choice, tool calls, context size).",
        "Compare it against similar sessions to see whether this cost is typical for this kind of task."
      ],
      "costEventIds": ["session:claude-code:cc-8f14e3a1"]
    },
    {
      "id": "5e2b917c4a6f0d38",
      "rank": 2,
      "type": "oversized_tool_response",
      "title": "[github] search_code responses averaging 21.4k tokens",
      "description": "[github] search_code returns ~21,400 tokens/call on average (16 calls in 7d window; max 48,220).",
      "source": "claude-code",
      "project": "acme-invoice-api",
      "sessionId": null,
      "toolName": "search_code",
      "metrics": {
        "toolName": "search_code",
        "mcpServer": "github",
        "callCount": 16,
        "meanTokens": 21400,
        "maxTokens": 48220
      },
      "estimatedCostUsd": 2.87,
      "costLabel": "cost_associated",
      "confidence": "medium",
      "evidence": [
        "[github] search_code returns ~21,400 tokens/call on average (16 calls in 7d window; max 48,220).",
        "Configure `fields` or `limit` on [github] search_code to reduce response size (est. 136,960 tokens/week saved)."
      ],
      "recommendations": [
        "Narrow [github] search_code's query/filter scope instead of searching or listing broadly.",
        "Lower the result limit if [github] search_code accepts one (e.g. `limit`/`max_results`/`top_k`).",
        "Paginate through [github] search_code results across multiple calls instead of requesting them all at once.",
        "Summarize or post-process [github] search_code's response before it enters the model context, if the full payload isn't needed downstream.",
        "Check whether repeated [github] search_code calls return duplicate or already-seen context that could be deduplicated or cached."
      ],
      "costEventIds": ["tool:search_code:github"]
    },
    {
      "id": "c78ad1f6e3b92047",
      "rank": 3,
      "type": "slow_tool",
      "title": "[postgres] run_query calls averaging 4.2s",
      "description": "[postgres] run_query averaged 4.2s per call over 23 call(s) in the last 7d (p50 3.8s, p95 7.1s, max 9.4s).",
      "source": "claude-code",
      "project": "acme-invoice-api",
      "sessionId": null,
      "toolName": "run_query",
      "metrics": {
        "toolName": "run_query",
        "mcpServer": "postgres",
        "meanMs": 4187.3,
        "p50Ms": 3820,
        "p95Ms": 7140,
        "maxMs": 9400,
        "callCount": 23,
        "failureRate": null
      },
      "estimatedCostUsd": null,
      "costLabel": "not_available",
      "confidence": "high",
      "evidence": [
        "Mean latency 4.2s (4187.3ms) across 23 call(s) with a recorded latency_ms, in the 7d window.",
        "p50 (median) 3.8s, p95 7.1s, max 9.4s.",
        "failure_rate is not available: tool_events has no error/failure/status column in this schema, so it is reported as null rather than fabricated.",
        "2 additional call(s) to [postgres] run_query in this window had no recorded latency_ms and were excluded from the stats above (not counted, not treated as 0ms)."
      ],
      "recommendations": [
        "Investigate whether [postgres] run_query's output is actually used downstream; if not, drop the call or cache the result to avoid the 4.2s penalty per call.",
        "If the latency looks environmental (network, cold start), check the \"postgres\" MCP server's health rather than the calling code first."
      ],
      "costEventIds": []
    },
    {
      "id": "0f4b7d2a9c1e5836",
      "rank": 4,
      "type": "repeated_similar_tool_calls",
      "title": "6 similar shell calls within 2 minutes in one session",
      "description": "shell was called 6 times in session codex-2c19f0b7 with similarly-sized responses (avg ~1,840 chars) within a 5-minute window.",
      "source": "codex",
      "project": "weekend-recipe-app",
      "sessionId": "codex-2c19f0b7",
      "toolName": "shell",
      "metrics": {
        "toolName": "shell",
        "mcpServer": null,
        "sessionId": "codex-2c19f0b7",
        "callCount": 6,
        "windowMs": 300000,
        "avgResponseChars": 1840
      },
      "estimatedCostUsd": null,
      "costLabel": "not_available",
      "confidence": "medium",
      "evidence": [
        "Matched by same tool (shell) + same session + response size within 10% of each other + occurred within a 5-minute window. Call arguments are not stored (privacy-by-design) so this is a proxy signal, not confirmed duplicate calls.",
        "6 calls in session codex-2c19f0b7 spanned 2 minutes (window threshold: 5-minute), averaging ~1,840 response chars per call."
      ],
      "recommendations": [
        "Review whether these 6 shell calls in session codex-2c19f0b7 are intentional (e.g. polling/pagination/retry) or avoidable repeats — deduplicating avoidable repeats saves both latency and tokens."
      ],
      "costEventIds": []
    },
    {
      "id": "9d3c6a1f7e0b4825",
      "rank": 5,
      "type": "cache_inefficiency",
      "title": "2 days with cache writes exceeding cache reads",
      "description": "Over the last 7-day window, 2 days wrote more prompt-cache tokens than were ever read back — about 662,100 cache-write tokens that were never reused (days below the 5,000-token noise floor are excluded).",
      "source": "claude-code",
      "project": null,
      "sessionId": null,
      "toolName": null,
      "metrics": {
        "days": [
          { "day": "2026-07-09", "cacheReadTokens": 88000, "cacheWriteTokens": 612000, "wastedWriteTokens": 524000 },
          { "day": "2026-07-12", "cacheReadTokens": 71900, "cacheWriteTokens": 210000, "wastedWriteTokens": 138100 }
        ],
        "totalWastedWriteTokens": 662100,
        "modelDistribution": [
          { "model": "claude-opus-4-8", "cacheWriteTokens": 560000, "cacheReadTokens": 120000 },
          { "model": "claude-sonnet-5", "cacheWriteTokens": 262000, "cacheReadTokens": 39900 }
        ]
      },
      "estimatedCostUsd": 1.68,
      "costLabel": "estimated_cost",
      "confidence": "medium",
      "evidence": [
        "2026-07-09: wrote 612,000 cache tokens, read back only 88,000 (524,000 wasted)",
        "2026-07-12: wrote 210,000 cache tokens, read back only 71,900 (138,100 wasted)"
      ],
      "recommendations": [
        "Check whether the system prompt / tool schema changed between turns on these days — cache breakpoints only pay off when the prefix ahead of them stays stable.",
        "Look for short-lived sessions that re-establish the same context repeatedly instead of continuing one long session that could reuse the cache."
      ],
      "costEventIds": []
    }
  ]
}