llm.log

Lightweight LLM observability — costs, tokens, and full request/response capture.
Three commands to start. Local proxy, single binary, zero config.

Install · Quick Start · Dashboard · CLI · Export · Data Management · How it Works

_{TUI — llm-log dash}

_{Web UI — llm-log ui}

What is llm.log?

A lightweight local proxy for LLM observability. It sits between your apps and LLM APIs, captures every request and response, tracks token usage, and calculates costs — all stored locally in SQLite, without changing a single line of code.

Not as heavy as enterprise platforms (Langfuse, Helicone, etc.) that need Docker, databases, and cloud accounts. Not as limited as log parsers (ccusage, tokscale) that only show token counts. llm.log gives you full prompt/response capture with cost tracking in a single binary you can install in seconds.

• Zero code changes — works via HTTPS_PROXY, picked up by most apps automatically
• Full request/response capture — every prompt and response stored, searchable, exportable
• Real costs — auto-updated pricing for 800+ models, cache token breakdowns
• All major providers — OpenAI, Anthropic, OpenRouter, Groq, DeepSeek, Mistral, and more
• All API formats — Chat Completions, Responses API, Anthropic Messages
• Claude Code aware — on a subscription? see what you'd pay without it. On API keys? see your actual spend
• Web UI + TUI — browser dashboard with analytics, or terminal dashboard with interactive heatmap and mouse support
• Minimal overhead — async logging, never blocks your requests
• Single binary — pure Go, no CGO, no dependencies, no Docker

Install

# macOS / Linux (Homebrew)
brew install lanesket/tap/llm-log

# or with Go
go install github.com/lanesket/llm.log/cmd/llm-log@latest

# or from source
git clone https://github.com/lanesket/llm.log.git && cd llm.log && make build

Pre-built binaries for macOS and Linux on the Releases page.

Quick Start

llm-log setup   # one-time: generate CA cert, trust it, configure shell
llm-log start   # start the proxy
llm-log dash    # open the dashboard

After setup, open a new terminal (or run source ~/.zshrc) — then every LLM API call is logged automatically.

Already running apps need a restart to pick up the proxy.
On macOS, new apps from Dock pick it up automatically.

Note: llm.log intercepts requests that go directly from your machine to LLM APIs.
Tools that route through their own servers (Cursor Pro, VS Code Copilot with built-in subscription) won't be logged.
If the tool supports your own API key, requests go directly to the provider and llm.log captures them.

Web UI

llm-log ui   # opens http://localhost:9923

TUI Dashboard

llm-log dashboard   # or: llm-log dash

Keys: 1-4 tabs · tab switch · hjkl/arrows navigate · p period · s source · f provider · m model/provider · enter detail · c/p/r copy · e export · ? help · q quit

Mouse: click tabs, heatmap cells, request rows · scroll wheel to navigate lists

CLI

llm-log status                    # daemon status + today's summary
llm-log logs                      # recent requests
llm-log logs --id 42              # full detail with prompt/response
llm-log logs -s cc:sub            # filter by source
llm-log stats                     # usage stats by provider
llm-log stats -b model -p week   # by model, last week
llm-log stats --json              # JSON output

Export

Export logged data to CSV, JSON, or JSONL for analysis in Excel, Jupyter, pandas, etc.

llm-log export                            # CSV to stdout (last month)
llm-log export -f json -o data.json       # JSON to file
llm-log export -f jsonl -p week           # JSONL, last week
llm-log export --from 2025-03-01 --to 2025-03-15  # date range
llm-log export -s cc:sub --provider anthropic      # filtered
llm-log export --with-bodies -p today     # include request/response bodies

--from/--to override --period when both are provided.

In the dashboard, press e to quick-export the current filtered view to llm-log-export-{timestamp}.csv in the current directory.

Data Management

Request/response bodies can grow large over time. Use prune to delete old bodies while keeping all metadata (tokens, costs, timestamps).

llm-log prune --older-than 30d              # delete bodies older than 30 days
llm-log prune --older-than 30d --dry-run    # preview without deleting
llm-log prune --older-than 6m --force       # skip confirmation (for cron)

Supported durations: 7d, 30d, 6m, 1y.

How it Works

Your app ──HTTPS_PROXY──▸ llm.log (127.0.0.1:9922)
                              │
                              ├─ LLM provider? ──▸ MITM ──▸ parse usage ──▸ SQLite
                              └─ Other?         ──▸ tunnel through (no interception)

1. llm-log setup generates a CA certificate and adds it to your system trust store
2. llm-log start launches a daemon and sets HTTPS_PROXY + CA env vars for all major tools
3. The proxy MITMs only known LLM domains — everything else tunnels untouched
4. Streaming responses are tee'd — client gets data in real-time, proxy parses accumulated result
5. Costs are calculated from auto-updated pricing data (780+ models)

Providers and formats

Providers and wire formats are extensible — see Extending llm.log.

Proxy activation

CA trust is configured for Node.js, Python, curl, Go, and Ruby via NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and CURL_CA_BUNDLE.

Data storage

Everything in ~/.llm.log/ — SQLite (WAL mode), CA cert, cached pricing, env file, PID. Request/response bodies are gzip-compressed in a separate table.

License

MIT