spendlint

Catch the code that inflates your LLM bill, before it ships.

spendlint reads your agent code and points at the patterns that quietly multiply token spend: prompts that never hit the cache, system prompts that change on every call, agent loops with no limit, retries that never stop, and cost reports that miss cached tokens. It works on Python and TypeScript/JavaScript, installs in seconds, and has no dependencies.

On a pull request it only speaks up about the lines that pull request adds, right where you review them. Your code never leaves your machine or your CI runner.

Built by Vernia. Free while we are in early access.

Get started

In GitHub Actions

Add .github/workflows/spendlint.yml:

name: spendlint
on: pull_request
permissions:
  contents: read
jobs:
  spendlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: vernialabs/spendlint@v0

Findings show up as annotations on the changed lines, with a summary on the run page. Every option (rule selection, confidence threshold, failing the build, SARIF for code scanning) is in docs/ACTION.md, and there is a complete example workflow.

On your machine

pip install spendlint
spendlint .                                    # scan a project
spendlint . --diff pr.patch --fail-on warning  # only lines a diff adds; exit 1 on warnings
spendlint . --format sarif --out spendlint.sarif

Configuration, exit codes and inline ignores are in docs/USAGE.md.

What it catches

Every rule comes from a real cost bug that an open-source agent team found and fixed. spendlint reads code, not invoices, so treat each finding as a pointer worth a second look in review.

What's next

spendlint is the first product from Vernia. Next up are Vernia Reason, a reasoning harness that reviews pull requests with the context of the whole repository, and Vernia Ledger, an agent that connects to your providers and billing to tie every dollar to a feature and a customer. Want early access? Write to ishan.upadhyay.iitb@gmail.com.

Telemetry

spendlint keeps anonymous usage counts so we can see which rules help and where they get in the way. Here is exactly what that means:

• What is recorded: spendlint version, Python version, operating system, CI provider, how many files were scanned per language, how many findings each rule produced, run time, exit code, the hour of the run, and a random install id.
• What is never recorded: your code, file names, paths, repository names, or anything that identifies you.
• Where it goes: a local file you can read at any time with spendlint telemetry show. Counts are sent only when a collection endpoint is configured through SPENDLINT_TELEMETRY_URL.
• In CI: off by default. Turn it on with SPENDLINT_TELEMETRY=on or the Action's telemetry: on input.
• Turning it off: spendlint telemetry off, SPENDLINT_TELEMETRY=off, or DO_NOT_TRACK=1.

The full schema is in docs/telemetry.md. A paid plan with telemetry fully disabled is on the way for teams that need it.

License

spendlint is source-available under the PolyForm Small Business License 1.0.0. It is free for individuals and for companies with fewer than 100 people and under US$1 million in annual revenue (the license has the exact terms). Larger organisations need a commercial license; see COMMERCIAL.md.

Contributing

See CONTRIBUTING.md. Run the tests with:

python -m spendlint.test_rules && python -m spendlint.test_cli && python -m spendlint.test_telemetry