This release is a pre-release and may not be stable for production use.
Cutback
Find AI costs. Test alternatives. Review every change.
Cutback discovers AI calls, observes supported runtime usage, evaluates authorized alternatives, and prepares reviewable changes. Apache-2.0 includes the CLI, collector, PostgreSQL, worker, encrypted datasets and React dashboard. No corporate account or hosted service is required.
Pre-alpha, not production validated. Tests use synthetic provider responses. Real pilot traffic, representative quality validation, paid requests and production deployment remain explicit approval gates. See progress and limitations.
python -m pip install --pre cutback
cutback doctor --json
cutback scan /path/to/python/project --json
cutback opportunities --target /path/to/python/project
Scanning is offline and never executes the application. Historical tokens, spend, latency and quality remain unknown from source alone. Lower prices establish a candidate, not preserved quality or realized savings.
uv sync --locked --all-extras --dev
uv run python infra/compose/prepare.py
docker compose -f infra/compose/docker-compose.yml up -d --build
uv run python scripts/demo.py
uv run cutback dashboard --local
The demo uses synthetic inference and an actual local collector/database. Dashboard credentials are separate control keys held only in browser memory. Read deployment, evaluation, provider compatibility, and agent setup.
The dashboard guides project setup, scoped keys, capture policies, CSV/JSON datasets, frozen experiment plans, budget approval and cancellation. It also exposes team access, retention, contract rates, schedules, rollout records, optional billing and local training jobs. Credentials stay in page memory; closing or reloading signs out.
The screenshot uses synthetic data. Unknown prices and incomplete coverage remain visible.
| Capability | What works |
|---|---|
| Discover | Offline Python scanner; optional JavaScript/TypeScript syntax scanning, stable call-site IDs, explicit unresolved coverage |
| Observe | Native pinned OpenAI and Anthropic SDKs, sync/async/streams, retry attempts, bounded fail-open export, separate Node observer |
| Account | PostgreSQL, idempotent ingestion, Decimal pricing, cached/reasoning usage, contract rates, retained summaries and unknown totals |
| Evaluate | Rights-scoped encrypted datasets, independent labels or provisional judges, paired uncertainty, disjoint pilot elimination, one-run hash approvals |
| Optimize | Model/prompt alternatives, native prompt caching, bounded routing, explicit encrypted response cache, local HF/PEFT LoRA training |
| Review | Source-bound model diffs and rollback, approved schedules, canary/guardrail records, evidence tiers and audited actions |
| Operate | Scoped RBAC, OIDC/PKCE, team grants, deletion/export, backup/restore, Compose, Helm and Terraform references |
flowchart LR
Source[Source repository] --> Scanner[Offline scanner]
App[Application SDK] --> Observer[Metadata observer]
Scanner --> API[Customer collector]
Observer --> API
API --> DB[(PostgreSQL)]
API --> Store[(Opt-in encrypted artifacts)]
DB --> UI[CLI and React dashboard]
Store --> Worker[Approved experiment or training worker]
Worker --> UI
UI --> Review[Evidence and reviewable changes]
Extras: cutback[openai], [anthropic], [instrumentation], [server], [eval], [storage], [identity], [commercial], [javascript]. The scanner core contains no SDK, server or GPU dependencies. Training uses a separate locked runtime. Optional commercial integrations do not restrict the OSS pipeline.
For JavaScript/TypeScript scanning:
python -m pip install --pre 'cutback[javascript]'
cutback scan /path/to/app --language python --language javascript --language typescript --json
The Node SDK is supplied as source and a release tarball; npm publication is separate. Exact supported SDK versions and stream limits are in provider compatibility.
Run working examples for both providers, FastAPI, Django, threaded workers and Lambda-style bounded flushing. For the complete scanner → native mocked SDK → HTTP → PostgreSQL → encrypted dataset → approved worker → paired report path:
uv run python examples/experiment_walkthrough.py
That walkthrough performs no paid inference and deletes its own synthetic project afterward. It exercises the same collector and worker used by ordinary authorized runs.
Operations guides: identity and teams, evaluation, advanced optimization, local training, continuous operations, optional billing, and Helm/Terraform. Read security and privacy before authorizing payload capture.
Development uses Python 3.11–3.13, Node 24 and PostgreSQL 17. See contributing for tests and completion evidence for implemented scope, executed checks and external acceptance gates. No production deployment or real customer savings is implied by a synthetic benchmark.
Watch or reproduce the synthetic demo. Its data is explicitly labeled; it is not a customer benchmark.
Metadata
Release files for cutback 0.1.0.dev2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| cutback-0.1.0.dev2.tar.gz | 694.3 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| cutback-0.1.0.dev2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 949.2 kB
Release files / cutback-0.1.0.dev2.tar.gz
| Download URL | cutback-0.1.0.dev2.tar.gz |
|---|---|
| Size | 694.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
1f6711ce6b570f7ce110f5f8a5480f88a00ad7f255b3cf68c54e5525fe32e1b5
|
|
BLAKE2b-256 checksum How to use checksums |
6979f633a0ca3b40145ee9e0c5904258a5d05feb428a5b59af25ef0ce63f120e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logRelease files / cutback-0.1.0.dev2-py3-none-any.whl
| Download URL | cutback-0.1.0.dev2-py3-none-any.whl |
|---|---|
| Size | 254.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f634717395b4d1e9e8d8cbcb4e2eec11b3636a19de7714580eead4b59c814227
|
|
BLAKE2b-256 checksum How to use checksums |
a8ffd332c9a1f5f46031722892a790059dc8edb4f4e834cdd737c2b97341bee8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logSecurity for cutback 0.1.0.dev2
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for cutback-0.1.0.dev2.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.