Two scripts, Python 3.11 or later, about five minutes. Everything runs on your machine and writes to a folder you choose. The only file meant to leave it is share.json, and you decide whether it does.
One minute
git clone https://github.com/metermaidai/audit
cd audit
pip install requests
The spend audit needs requests. The trace audit needs nothing beyond the standard library. No account, no telemetry, no network access except the calls you see in the next step.
Two minutes · if you have an admin key
Create a read-only admin key in the Anthropic Console (Settings, Admin keys) or on the OpenAI platform (Organization, Admin keys). Put it in the environment for this shell only. Never paste it into a file, a hosting dashboard or a chat.
# Anthropic and/or OpenAI; either one is enough
export ANTHROPIC_ADMIN_KEY=sk-ant-admin-...
export OPENAI_ADMIN_KEY=sk-admin-...
# optional: tell the audit which key or project belongs to which agent and owner
cp keymap.example.json keymap.json
python metermaid_audit.py --days 30 --share
It reads usage and cost for the window and writes audit/audit.md, the report you read, and audit/audit.json. Each finding is labelled observed or modeled with its assumption, and the headline is a range from the largest single finding to a capped sum, because findings on the same key overlap and are never added up. The rate card version and any price it used that is unverified or older than 90 days are printed at the top.
python metermaid_audit.py --demo runs the whole thing on synthetic data so you can see the report before asking anyone for a key. Want to check the numbers? --probe reads three days of usage and cost and says whether the provider's cost report matches usage priced from the rate card. The Anthropic reading was verified this way on 2026-09-15.Two minutes · if you have trace files
Point it at a folder of runs from SWE-agent, mini-swe-agent, OpenHands, or plain message lists (JSON or JSONL with role and content). It finds the format itself.
python trajectory_audit.py ./your-traces --out ./traj-audit --share
It writes traj-audit/trajectory-audit.md with loops, blind retries, oversized tool output, edit thrash, and runs that ended without a result; the Tasks section with cost per successful task, every attempt counted; the Intake section with what it parsed and what it could not; and, with 25 runs or more, your run-length curve: five buckets by step count, each with its share of spend and its success rate. attempts.jsonl and tasks.jsonl land beside it and stay local.
instance_id, task_id, problem_id, issue_id) under another name? Add --task-id-field yourname.python trajectory_audit.py --demo.One minute
python benchmark.py traj-audit/trajectory-audit.json --org "Your team" --out benchmark.html
One self-contained page: your spend by run length, the split between productive spend and the three kinds of mechanical waste, and where each of your numbers falls among the 29 public groups in the Index. Comparisons are shares, never dollars, because the Index's dollars are estimated from characters and yours are not.
Optional
--share on either tool writes share.json next to the local report. It is built by allowlist: totals, shares, the five run-length rows, per-detector counts and costs, findings with their evidence, and pseudonymised ids. It never carries per-run rows, run ids, commands, prompts, tool output, file paths, owner emails, or raw key and project ids, it says so inside the file, and the tool prints exactly what it contains before writing it.
# fix the salt so next month's file is comparable to this one; keep it like a password
export METERMAID_SALT="something long and private"
python trajectory_audit.py ./your-traces --share --salt "$METERMAID_SALT"
python metermaid_audit.py --share --salt "$METERMAID_SALT"
If you would like us to read it: leave your email on the form, and reply to the message you get from a person with share.json attached. We come back with the findings, your curve, and where you sit against the Index. If the audit finds nothing worth a pilot, we say that.