modelstat

skill
Security Audit
Fail
Health Warn
  • License — License: NOASSERTION
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 9 GitHub stars
Code Fail
  • process.env — Environment variable access in .github/scripts/release-plan.mjs
  • rm -rf — Recursive force deletion command in .github/workflows/release-daemon.yml
  • process.env — Environment variable access in .github/workflows/release-daemon.yml
  • fs module — File system access in .github/workflows/release-daemon.yml
Permissions Pass
  • Permissions — No dangerous permissions requested

No AI report is available for this listing yet.

SUMMARY

Who let the tokens out!?

README.md

modelstat

Know exactly what your AI coding spend bought.

modelstat turns the session logs Claude Code, Codex, and Cursor already write into dollar-precise spend & ROI —
broken down by the real work it went to, by project, and by model. Nothing leaves your machine un-redacted.

modelstat.ai · Install · Integrations · MCP server · Guides

npm modelstat npm @modelstat/mcp Privacy: prompts stay on device


Install

One command installs the daemon, pairs this machine, and wires the modelstat MCP into every AI tool you have (Claude Code, Claude Desktop, Cursor, Codex, …). Paste it into a terminal — or into Claude Code / Codex / Cursor and let it run.

curl -fsSL https://modelstat.ai/install.sh | sh

Windows (PowerShell): irm https://modelstat.ai/install.ps1 | iex — wires the MCP into your Windows tools (the local capture daemon is macOS/Linux).

Already have Node? npx modelstat@latest (also bunx / pnpm dlx) does the same — pairs the daemon and wires the MCP. Re-run any installer to upgrade.

That's it. Open your dashboard at modelstat.ai/dashboard. The daemon runs on macOS + every Linux distro (Node 20+).


Why modelstat

  • Real work, not just raw tokens. After about a week of passive collection, modelstat learns your team's own vocabulary of projects and work-types — so the dashboard shows "$133 on DevOps, $114 on testing", not just "you spent $400 on Claude." No manual tagging.
  • Your actual sessions. It reads the logs Claude Code, Codex, Cursor, Cline, Continue, Aider, Windsurf, Zed, Copilot, and Claude Desktop already write — nothing to instrument, nothing to intercept.
  • Local-first by construction. A small model on your machine summarizes and redacts every session before anything is uploaded. Raw prompts, code, and secrets never leave the box — only token counts, cost, and a short scrubbed abstract. Audit it below.

What this repo is

This is the public source for everything that runs on your machine:

  • modelstat — the Node daemon that watches your AI-tool log files, prices them, redacts client-side, and uploads metadata.
  • @modelstat/mcp — a Model Context Protocol server so Claude Desktop / Claude Code / Cursor / Cline / Continue / Zed can answer "how much did we spend on X?" in chat.
  • macOS menu-bar tray — native Swift status-bar app.
  • @modelstat/sdk — the backend SDK: capture the LLM calls your own services make, redacted + compacted client-side before they leave the box.

Why it's open. The code that reads your files should be auditable. The hosted service that aggregates your team's metadata is closed-source; everything that runs on your laptop is right here — read it, fork it, build your own binaries, or pin a commit and install from source. See LICENSE.


What it does on your machine

    your AI coding tools                     on YOUR machine                     modelstat cloud
┌──────────────────────────┐           ┌─────────────────────────┐           ┌──────────────────────┐
│   Claude Code · Codex    │           │    modelstat daemon     │           │ analytics dashboard  │
│ Cursor · Cline · Aider   │  session  │ • parse + price turns   │ redacted  │ spend & ROI grouped  │
│ Windsurf · Zed · Copilot │ ───────▶  │ • redact (PII / keys)   │ ───────▶  │ by activity · repo · │
│ Claude Desktop · …       │   logs    │ • summarize (local LLM) │   HTTPS   │ model · person —     │
│ (logs already on disk)   │           │ → tokens + abstract     │           │ the charts above     │
└──────────────────────────┘           └─────────────────────────┘           └──────────────────────┘

                      ↑ raw prompts, code & secrets never leave your machine ↑
  1. Detects installed tools — scans ~/.claude, ~/.codex, ~/.cursor, ~/.aider, ~/.config/continue, and other tool-specific locations.
  2. Parses local log files — Claude Code's JSONL logs, Cursor's SQLite DB, Codex's conversation files, and so on. The per-tool parsers are the only code that opens these files.
  3. Redacts on-device — every excerpt goes through a regex pass for secrets/PII and (optionally) a local NER model before the uploader ever sees it.
  4. Summarises on-device — a small local LLM compresses each work-segment into a single ≤240-char abstract. The raw turns stay on disk; only the abstract goes up.
  5. Uploads metadata only — per-session totals (tokens, model, cost, duration) + the redacted abstract + provenance describing what was redacted.

Build from source (the trust path)

git clone https://github.com/modelstat/modelstat.git
cd modelstat && pnpm install && pnpm build

Requirements: Node 20.18+, pnpm 10.7+, Swift 5.9+ (tray only), and an account at modelstat.ai to pair with.


Integrations (10 supported tools)

Command-line + agent tools Editor / IDE
Claude Code Windsurf
Cursor Zed AI
Codex (OpenAI CLI) GitHub Copilot
Cline Claude Desktop
Continue
Aider

Full index: modelstat.ai/integrations


MCP — ask any AI client about your spend

Once paired, any MCP-compatible client can query your spend in natural language:

// ~/Library/Application Support/Claude/claude_desktop_config.json (or ~/.cursor/mcp.json, etc.)
{ "mcpServers": { "modelstat": { "command": "npx", "args": ["-y", "@modelstat/mcp"] } } }

"How much did my team spend on Claude Code last week?"
"Which project is driving my Cursor cost?"
"Recommend a model for a code-review task — based on what worked for us before."

No in-band auth — the server reuses the token npx modelstat@latest already wrote locally. Details: mcp.modelstat.ai · source in packages/mcp/.


Privacy & data handling (with proof)

You can verify, from this repository alone, exactly what does and doesn't leave your machine.

The boundary. Exactly one function talks to our server: IngestClient.upload() → POST /v1/ingest. There is no other outbound channel. The wire-format types live in packages/core/src/schemas.ts as Zod schemas — if a field isn't there, the uploader literally cannot send it.

What we receive: model/provider/tool, per-class token counts, the cost we computed, scrubbed cwd/git metadata, filenames (paths scrubbed), an optional ≤320-char pre-redacted excerpt, a ≤240-char on-device abstract, redaction counts (never the matched text), and a provenance stamp.

What we never receive: your raw prompts, your code, or any API key / token / password. Text fields are size-capped by Zod and pass through redaction first; the paranoid policy drops entire stdout/stderr/tool_output/raw_text blobs before upload.

Defence-in-depth, every byte crossing the boundary passes through: parser scoping → secrets regex (Anthropic/OpenAI/Google/AWS/GitHub/Slack/Stripe keys, JWTs, PEM blocks, bearer headers, DB passwords) → PII regex (emails, public IPs, URL creds, home paths) → a Shannon-entropy catcher for unknown key shapes → optional on-device NER → Zod length caps → policy gate → provenance stamp. All in packages/core/src/redact.ts.

Audit it yourself — three files tell the whole story:

  1. packages/core/src/schemas.ts — every type that can be uploaded.
  2. packages/core/src/redact.ts — the redaction policies + patterns.
  3. packages/daemon-core/src/http/index.ts — the single fetch() to our server.

npx modelstat@latest status prints, locally, the same token + redaction counters the server sees. Security disclosures: SECURITY.md · [email protected].


Repo layout

modelstat/
├── apps/
│   ├── daemon/          Node daemon CLI (modelstat)
│   └── tray-mac/        macOS menu-bar app (Swift)
├── packages/
│   ├── daemon-core/     Shared pipeline / queue / HTTP for the daemon
│   ├── core/            Shared enums + Zod schemas (wire format lives here)
│   ├── mcp/             Model Context Protocol server (@modelstat/mcp)
│   ├── parsers/         Per-tool log parsers (Claude Code / Codex / Cursor / ...)
│   └── pricing/         Provider + model price tables
├── sdks/                Backend SDKs (Node / Python / Rust)
└── .github/workflows/   npm + SDK publishing

Contributing

See CONTRIBUTING.md. The short version:


About modelstat

modelstat is the cross-tool AI spend analytics layer for engineering teams — the questions your finance team actually asks: How much did we spend on project X? Which work-type eats our budget? Personal vs company accounts on the same machine? Opus vs GPT-5 vs Sonnet on the same kind of task?


Built for teams who'd rather know where their AI spend actually goes — without giving up the source.

Reviews (0)

No results found