1. Paste your code
2. What it found
| Rule | Level | Line | Detail |
|---|
Prefer a CLI, or want this as a CI gate?
Same logic, zero dependencies, one command — walks a whole source tree, skipping node_modules, .git and similar:
node cli.mjs scan src # human-readable node cli.mjs scan . --json # machine-readable node cli.mjs scan src --calls-per-day 5000 --out-tokens 500 node cli.mjs scan src --fail-on warn # fail CI on warnings too node cli.mjs scan src --prices my-prices.json # your negotiated or current prices
Get cli.mjs and engine.mjs — Node 18+, nothing to install, no network call. Exits 1 on a retired model name (or on any warning with --fail-on warn).
What's recognised
| Vendor | Call sites matched |
|---|
Python and JS/TS, matched line by line. A model passed through a variable is reported as unpriced rather than guessed at. List prices in the built-in table are illustrative and dated; edit them with --prices or the CLI JSON file. More: why LLM bills surprise teams, and what a static scan can and cannot catch.
Common questions
Does this read my API traffic or my bill?
No. It reads source text only, so it can see what your code asks for, not what actually runs. Every dollar figure is arithmetic on a calls-per-day and token guess that you type, multiplied by list prices you can edit. It is an estimate for comparing options, never a measurement of what you are charged.
Why flag a call with no max-tokens?
Without an output cap, one call can generate the model's full output limit. A prompt that accidentally or deliberately asks for a long answer then costs far more than you budgeted, and it does so on every call. A cap is one line and bounds the worst case.
Why flag a premium model if I need it?
It is an information note, not an error. Teams often hard-code the largest model during prototyping and never revisit it. A small-tier sibling from the same vendor frequently handles classification, extraction and short rewrites; run an eval on your own prompts before switching, because quality is yours to verify.
Is my code uploaded anywhere?
No. The browser page scans the text you paste in your own browser and never sends it anywhere. The CLI reads only local files and makes no network call.
Switching models or editing a prompt rather than costing it? Diff saved outputs before and after to catch broken JSON, new refusals and truncation.