API Cost Waste Checker

When this helps

You want to cut your API bill, but you can't tell from the code where or how often it's being called

What it does

Scans your code for 19 patterns of wasteful calls to pay-as-you-go APIs (OpenAI, Anthropic, Gemini, Google Maps) — calls on every keystroke or re-render, retries without delay, an uncapped tool-use loop, resending full history every time, a key exposed to the browser, and more. The AI then opens each finding and marks it confirmed, false positive (with a reason), or needs checking. The report starts with the "first three to fix," with a fix and a check for each item. No dollar amounts, only counts like "about 1,440 times a day." Key values never appear in the report. It can go on to fix issues one by one with your OK. The code is only read; nothing changes without your approval.

The fixes baked into this kit

1. Flagged retries-without-delay as "already waiting"It matched on the literal string "wait" inside "await". Fixed by treating "wait" as a whole word, checked alongside sleep(, setTimeout and backoff.
2. Flagged a 2-line conversation as "sending full history"It assumed any variable named "messages" was history. Fixed so that an array built fresh and never appended to (no push/append) doesn't count as history.
3. Flagged a fallback-with-different-settings pattern as high-severity retryingIt didn't distinguish retrying the same call without delay from trying different settings in sequence (a fallback). Fixed by rating fallbacks as medium severity, with guidance to log how often the first attempt fails.
4. Flagged a database schema file as an "open endpoint"It matched "onRequest(" inside "ImageGenerationRequest(". Fixed to only match onRequest at the start of a word.
5. Missed calls that used a URL stored in a variableIt missed loops like requests.post(URL) where URL was assigned earlier. Fixed so that a variable holding an address is traced to where it's actually called.
6. Kit got blocked at listing time for "having a dangerous setting"The literal strings the tool searches for (like a browser-key setting name) were written out directly in the matching code and docs, so the listing check couldn't tell them from a real dangerous setting. Fixed so the tool and tests build the string programmatically, and docs describe it in words instead.

What's inside

• The flow (pick 3 settings → scan → AI reviews each finding → report → fix if you want)
• A tool that scans for 19 patterns of waste, straight from the code
• How to spot and fix things like per-keystroke calls, retries without delay, and sending full history every time
• How to spot risky setups like a key exposed to the browser or an open endpoint anyone can hit
• A report format that starts with the "first three to fix," with a fix and a check for each item
• A self-test for the tool itself, with a case added every time a miss gets fixed
• A log of mix-ups found while using the kit (NOTES.md)

The first three decisions

1. The folder to check (wherever package.json or requirements.txt lives)
2. Any APIs called by hardcoded address (say "none" if not)
3. How far to go (start with "report only")

What you need

• No extra costNode.jsRuns the scanning tool. Nothing else to install.
• No extra costClaude Code or CodexWorks with either.
• No extra costThe folder with the program to checkJavaScript, TypeScript or Python. Nothing is changed unless you ask it to fix something, one item at a time.

How to use

Just paste this into your AI.

I want to use the nice to have kit "API Cost Waste Checker". Follow https://nicetohave.app/en/g/JWB8QMPL-•••••••••• and set it up.

Works the same in Claude Code or Codex.
Read what this tells your AI to do, before you paste it

FAQ

Can this tell me how much I'm actually being charged?

No. It finds code patterns that look wasteful; actual call counts and charges come from each provider's usage dashboard. If you give it a unit price, it will calculate a rough estimate with its assumptions stated.

It showed calls doubling in development — is that a bug?

No. React's StrictMode intentionally runs useEffect twice in development, so that's expected. Check production logs to see if calls are actually increasing.

If something is a false positive, can I stop it from showing up again?

Yes. Add a comment like `// api-cost-check: ok L01 reason` on or above that line, and it won't be flagged again. Leaving out the ID silences every pattern on that line. Always state a reason.

Do key values ever show up in the report?

No. Keys the tool finds are always redacted, both by the tool and in the report.

Will it catch calls routed through several other files?

It follows one hop. Anything routed through more layers than that can be missed, so check that the call-site count in the list matches what you expect.

Supporters

Once support opens, the people who backed this kit will be listed here.