Local audit for Claude Code
CostClaw reads the Claude Code logs already on your disk, finds the token spend you can get back, and scores your setup across six pillars. It runs on your machine and never reads your prompts.
npx costclaw audit
No account, no upload. It parses the logs on your disk and prints a report.
~/.claude/projects 1840 sessions · 41 projects · CLAUDE.md found
Recoverable spend $1,284.50 cache-miss exposure
Model spend opus 58% / sonnet 33% / haiku 9%
Overall setup score 88 / 100 Tight
Top fix by recoverable spend
$1,284.50 Recover spend lost to cache misses Your longest sessions started at 71% cache reuse and finished at 9%. Compact before the context outgrows the cache.
The leak
Anthropic bills you a monthly total. It cannot tell you which dollars you could have kept. CostClaw reads the session logs on your disk, including the subagent and workflow sub-logs, and prices the waste the invoice hides. Four of those leaks:
input $3.00 / MTok cache read $0.30 / MTok
Claude Code caches the front of your prompt so repeat tokens cost a tenth of the price. When a session rebuilds that cache instead of reusing it, you pay full input rate on tokens that should have been nearly free. CostClaw measures the gap and prices it.
Read ×142 in one session
A session that fires the same tool a hundred times is usually thrashing: re-reading, re-grepping, circling a problem. It does not show up as a line item, but it burns tokens and time. CostClaw counts the loops and flags the sessions that run hot.
Opus $15 / MTok Sonnet $3 / MTok
A short, simple session does not need the top model. When a quick task runs on Opus that a cheaper model would have served, you pay the Opus rate for Sonnet work. CostClaw flags those sessions and prices the difference against the cheaper model.
cache 91% 34% by the last turns
A session that runs for hours keeps adding context until the cache stops paying off. The early turns hit it; the closing turns re-pay full price for a prompt that only grew. CostClaw tracks the per-turn cache and flags the sessions that should have been compacted.
How it works
It reads the JSONL session logs under your Claude directory, including the subagent and workflow sub-logs, in memory, on your machine. Nothing is sent anywhere.
From the raw logs it computes totals: spend by model, cache hit rate per turn, tool use, session timing. Prompts, paths, and code are dropped here.
It scores six setup pillars from the evidence and your settings, then ranks fixes by the dollars they recover. The report prints to your terminal.
Your machine
Stays here. Always.
AuditRecord only derived numbers and sanitized prose
Hosted dashboard
Optional, on the Pro plan. It only ever receives the derived record above. The free CLI sends nothing at all.
What you get
Real spend over the window you audit, your cache hit rate, and the slice you could get back. The recoverable figure is the headline, so you know what fixing the leak is worth before you start.
CLAUDE.md quality, context hygiene, prompting, session management, tooling, and cost discipline. Each pillar is scored only from what your logs, settings, and CLAUDE.md actually show; the audit finds your global CLAUDE.md on its own. A pillar with no evidence reads n/a; nothing is invented to fill a bar.
Not a wall of warnings. The list leads with the fix that returns the most spend, carries the exact figure and the evidence behind it, and tells you the one change to make. Smaller issues sit below it, in order.
Privacy as the moat
The only thing CostClaw produces is an AuditRecord: totals and generated sentences. No prompt text, no file paths, no secrets. That boundary is held by a test that runs on every build.
The test plants tripwire strings, a fake prompt and a fake client path, into sample logs, runs the full pipeline, and asserts that none of them appear in the record. If a leak ever slipped in, the build would fail before it shipped.
// the privacy invariant, enforced on every run
const raw = sessionWith({
prompt: "TRIPWIRE_secret_prompt",
path: "/Users/me/clients/acme",
});
const record = buildAudit(analyze(raw));
const json = JSON.stringify(record);
expect(json).not.toContain("TRIPWIRE_secret_prompt");
expect(json).not.toContain("/Users/me/clients/acme");
expect(hasEmDash(json)).toBe(false);Pricing
The CLI is real and usable right now, at no cost. The hosted plan is in progress, and it will only ever see the derived record, never your logs.
$0runs on your machine
npx costclaw audit
One-time license that unlocks costclaw optimize:
a filled-in CLAUDE.md, a ranked fix playbook, suggested
settings, and a work order your own Claude Code can apply,
all generated from your own project. Verified offline. Your
key is emailed to you in about a minute.
Want it when it ships? Leave your email.
Not ready yet. The CLI does the core job today.