claude-code-startup-audit
What did Claude Code load into your context before you typed a word?
Claude Code already records the answer. Every API response's usage object is
appended to a JSONL file under ~/.claude/projects/. This reads those files and
tells you what the first request of every session actually cost.
No dependencies. No network. Nothing leaves your machine.
uvx --from git+https://github.com/Ankit3794/claude-code-startup-audit cc-startup-audit
BEFORE YOU TYPE A WORD
45 sessions · 36 cold starts · 12 projects · Claude Code 2.1.206-2.1.220
cheapest cold start 22,638 tokens
median cold start 35,367 tokens 18% of a 200K window
worst cold start 131,314 tokens 66% of a 200K window · 5.8x the floor
paid to say hello $ 12.94 across 45 first requests, list price
TOOL DEFERRAL same machine, same account
active n=31 median 34,175
absent n=5 median 71,785 2.10x
Then open the full breakdown in a browser:
uvx --from git+https://github.com/Ankit3794/claude-code-startup-audit cc-startup-audit --serve
Three levels. Overview, click a project for its sessions, click a session for
the component breakdown and the raw usage object behind it.
Why not /context
/context estimates client-side, before anything is sent. When MCP servers are
loaded it sums per-tool count_tokens calls and double-charges the shared
schema. Cameron Cooke replicated the counting logic and measured 45,018
reported against 15,282 real —
async-let.com.
This tool never reads /context. Every headline number is the usage object
the API returned. It is the invoice, not the estimate.
Install
Not on PyPI yet, so install straight from the repository:
# run once, install nothing
uvx --from git+https://github.com/Ankit3794/claude-code-startup-audit cc-startup-audit
# or keep it on your PATH
uv tool install git+https://github.com/Ankit3794/claude-code-startup-audit
pipx install git+https://github.com/Ankit3794/claude-code-startup-audit
Requires Python 3.9 or newer and nothing else. Full instructions, including Windows, WSL and headless machines, are in INSTALL.md.
Usage
cc-startup-audit summary in this terminal
cc-startup-audit --serve build the report and open it
cc-startup-audit --html report.html write the report to a file
cc-startup-audit --anonymize --serve safe to screenshot or stream
cc-startup-audit --full every cold start, one per line
cc-startup-audit --json | jq . machine-readable
cc-startup-audit --root /path/to/projects
Sharing your numbers safely
--anonymize renames every project to project-a, project-b, deterministically
by sorted path, before any output exists. The key is printed to stderr only
and never enters the report. Numbers, shapes and per-session detail all survive.
cc-startup-audit --anonymize --serve 2>/dev/null
Safer than blurring a screen recording, because there is no frame to miss.
--serve
Binds 127.0.0.1 on an unused port, holds the report in memory, and answers
exactly one path. No directory is exposed, nothing is written to disk. --port
to pin it, --no-open to skip launching a browser.
What it measures
For each transcript, the first assistant record carrying a usage object,
excluding subagent sidechains. At that moment the only thing in the context
window is what Claude Code put there plus your opening message.
total = input_tokens + cache_creation_input_tokens + cache_read_input_tokens
A cold start has cache_read_input_tokens == 0. Warm starts are reported
separately, because a cache hit means part of the prefix was already paid for in
an earlier session.
Three kinds of number, never blurred
| Where it comes from | Shown as | |
|---|---|---|
| Totals | measured — the API's own usage |
solid, exact |
| Components | estimated — 4 chars/token over logged attachments | solid, labelled approximate |
| System prompt + tool schemas | inferred — total minus everything logged | hatched, never solid |
Claude Code logs the skill catalog, subagent listing, MCP instructions, deferred tool index and auto-read files as typed attachments. It never logs the system prompt or the tool schemas. That figure is recovered by subtraction: its size is known, its composition is not.
On the machine this was built on it was consistently 74–93% of a cold start.
Tool deferral
Sessions are split on whether a deferred_tools_delta entry is present. When it
is missing, every tool schema loads upfront instead of on demand.
That was a 2.10× median difference on the reference machine — 34,175 against 71,785 tokens, same account, same everyday work.
This is an observed association across your own history, not a randomised trial. Treat it as a thing to go look at.
Limitations
- Component tokens are approximate. Estimated at 4 characters per token to stay dependency-free. Headline totals are exact.
- The residual cannot be broken down further from the transcript alone.
- Prices are Anthropic list rates (August 2026). They ignore subscription plans, batch discounts and long-context surcharges. Treat cost as an order of magnitude, not an invoice.
- Your numbers are yours. They depend on your plugins, MCP servers, skills and memory files. The method transfers; the numbers do not.
- New attachment types appear as their own row rather than being dropped, so a Claude Code release cannot silently shrink your measured total.
Privacy
Reads only ~/.claude/projects/**/*.jsonl, and only the usage objects and
attachment sizes. It does not copy message content into any output, makes no
network requests, and writes nothing outside a path you name.
--serve binds loopback and serves a single in-memory document.
The whole thing is a few hundred lines of stdlib Python. Read it.
Prior art
Worth reading, and worth crediting:
- Systima — measured ~32,800 tokens of first-turn payload on Claude Code 2.1.207 with a logging proxy, against ~6,900 for OpenCode. Different method, same ballpark as this tool's median.
- ACDigest — 90 days of full-payload HTTP logging; ~75% of input tokens were overhead.
- Async Let
— the
/contextover-counting analysis this tool exists to route around. - Anthropic's context window docs — publishes a per-component startup table. It has no row for tool schemas.
The widely repeated figure of 16,063 tokens before you type appears in none of these, nor in the Claude Code changelog, nor in any issue we could locate. If you find its origin, open an issue — it deserves a citation or a correction.
Contributing
See CONTRIBUTING.md. Measurement corrections are especially welcome; this project makes numeric claims in public.
License
MIT. See LICENSE.
Release files for cc-startup-audit 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| cc_startup_audit-0.1.0.tar.gz | 34.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| cc_startup_audit-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 67.5 kB
Release files / cc_startup_audit-0.1.0.tar.gz
| Download URL | cc_startup_audit-0.1.0.tar.gz |
|---|---|
| Size | 34.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ef2e51acc713360f4521eb350838f1b08f6d64c3e82b96afdefa440a7e222935
|
|
BLAKE2b-256 checksum How to use checksums |
f467c256649f768ae7cf46f00f3df055d7465aef1be743aa24d7724d4559c6c9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 7, 2026.
Transparency logRelease files / cc_startup_audit-0.1.0-py3-none-any.whl
| Download URL | cc_startup_audit-0.1.0-py3-none-any.whl |
|---|---|
| Size | 33.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
5ba6ed853de87ba9700656502a2e4e1afedce9a00ee27a3d8131e95bd06ec50f
|
|
BLAKE2b-256 checksum How to use checksums |
4b6669cba52e1944b8022c1db3910abec7bdd156d088e8d3bd2d421df0cda8f4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 7, 2026.
Transparency log