This release is a pre-release and may not be stable for production use.
cachelint
cachelint is a Python package for investigating LLM prompt-cache misses. It compares request bodies offline and shows where the modeled prompt prefix changes.
Status: early alpha. Version 0.1.0a1 can ingest and compare raw request
bodies through the Python API and CLI. SDK recording is planned for a later
alpha release. See the release notes.
Requirements and current usage
Python 3.11 or newer is required. The initial CI matrix covers Python 3.11 through 3.14.
For development from this checkout:
python -m pip install --upgrade pip
python -m pip install --group dev -e .
cachelint --help
cachelint --version
The cachelint distribution, cachelint import package, and cachelint CLI share the same name. The core package has no runtime dependencies.
Analyze files from the CLI
Save one complete raw request body per nonblank line in a UTF-8 JSONL file, then run:
cachelint analyze requests.jsonl
cachelint analyze requests.jsonl --provider openai
To compare two separate JSON files, each containing one complete request body (pretty printing is allowed):
cachelint diff first.json second.json
cachelint diff first.json second.json --provider anthropic
The default provider choice is auto. Bodies without a provider-specific marker need --provider anthropic or --provider openai; conflicting markers are rejected. A comparison requires the same provider and exact model in every request. Output includes the provider, request count, prompt status, common prefix segment count, first safe divergence path and character offset when available, context categories, coverage warnings, and fixed findings. It never prints request values or excerpts. cachelint analyze compares every valid JSONL request as one group; one request reports insufficient_data.
Exit status 0 means a valid analysis, including a divergence or insufficient data. Status 2 means invalid arguments or input, including unreadable files; status 1 means an unexpected internal failure. Invalid input produces no partial report. A matching modeled prefix does not guarantee a provider cache hit. See the ingestion guide and comparison guide for input rules and finding meanings.
Request ingestion in Python
canonicalize_request validates one raw Anthropic Messages or OpenAI Chat Completions request body and returns ordered prompt segments, separate request context, and coverage warnings:
from cachelint import canonicalize_request
request = {
"model": "demo",
"system": "Follow the instructions.",
"messages": [{"role": "user", "content": "Hello"}],
}
canonical = canonicalize_request(request)
print(canonical.provider) # anthropic
print([segment.path for segment in canonical.segments])
# ['system', 'system', 'messages[0]']
Use provider="anthropic" or provider="openai" when a body has no provider-specific marker. InvalidRequestError reports invalid shapes without echoing request values. The segment value and context inventory do retain request content; protect them as you would the original body. See the ingestion guide for accepted JSONL input, validation rules, and limits.
Comparing request prefixes in Python
compare_requests accepts one or more canonical requests of the same provider and exact model. It returns the first difference in the modeled prompt prefix and reports context changes separately:
from cachelint import canonicalize_request, compare_requests
first = canonicalize_request(
{
"model": "demo",
"system": "You are helpful.",
"messages": [{"role": "user", "content": "Hello"}],
}
)
second = canonicalize_request(
{
"model": "demo",
"system": "You are careful.",
"messages": [{"role": "user", "content": "Hello"}],
}
)
result = compare_requests([first, second])
print(result.prompt_status) # diverged
assert result.first_divergence is not None
print(result.first_divergence.path, result.first_divergence.offset) # system 8
The result contains safe paths, difference kinds, character offsets where available, context categories, coverage warnings, and evidence-based findings. It contains no prompt excerpts or raw values. See the comparison guide for result semantics and privacy limits.
First analysis release scope
The 0.1.0a1 milestone targets offline analysis for Anthropic Messages and OpenAI Chat Completions request bodies. The accepted canonicalization contract and privacy handling guide the commands. A matching text prefix is evidence for diagnosis, not a guarantee of a provider cache hit.
The request comparison and privacy contract defines the first release's input and diagnostic behavior.
Request logs can contain prompts, credentials, personal data, and customer content. Do not commit raw logs or paste them into public issues.
Compatibility
Within the 0.x series, patch releases preserve documented CLI and Python API behavior. Minor releases may make incompatible changes with migration notes. Alpha APIs may evolve between prereleases; changes will be recorded in release notes. Only Python versions exercised in CI are claimed as supported.
See CONTRIBUTING.md for development and SECURITY.md for private vulnerability reporting.
Licensed under Apache-2.0. This project is independent of the Apache Software Foundation.
Metadata
Release files for cachelint 0.1.0a1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| cachelint-0.1.0a1.tar.gz | 26.2 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| cachelint-0.1.0a1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 43.0 kB
Release files / cachelint-0.1.0a1.tar.gz
| Download URL | cachelint-0.1.0a1.tar.gz |
|---|---|
| Size | 26.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d43613e6928a0b9c14335c0dbffcbe1d15fd39c24f120cd64ca6c7bb4c2d137a
|
|
BLAKE2b-256 checksum How to use checksums |
f3e93031da09c315a91044cbb70e7cbf9282a52871aeae11211f56af264c8678
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logRelease files / cachelint-0.1.0a1-py3-none-any.whl
| Download URL | cachelint-0.1.0a1-py3-none-any.whl |
|---|---|
| Size | 16.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
01798a6e9854470e065058baf316c99d884d0e134e732baf0a06d6fe937ec69a
|
|
BLAKE2b-256 checksum How to use checksums |
fe67cce645fb351ddddcf3a259a3803ca48e7b16b974afbeee4efea7c67be083
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logSecurity for cachelint 0.1.0a1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for cachelint-0.1.0a1.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.