plimsoll

The problem

Teams spend real money on AI coding agents and cannot say what they got. Vendor dashboards stop at an org-level total. Nobody joins the spend to the thing that shipped. So the honest answer to "what did those tokens buy us" is a guess, and the guess is usually flattering.

What I built

Plimsoll is a local-first collector that watches Claude Code and Codex on your own machine, records what each session cost, and joins those sessions to shipped outcomes: merged pull requests and passing checks. Then it does the division: tokens per merged pull request, cost per validated outcome, and where the spend produced nothing.

The name comes from Samuel Plimsoll, who in 1876 forced shipowners to paint a load line on every hull. Deaths from overloading fell, not because the rule was clever, but because the limit became visible to anyone standing on the dock.

How it works in plain words

Claude Code sends hook events. Both tools send OpenTelemetry data. The collector listens on your machine at 127.0.0.1:48271 and writes to a local SQLite file. It does not send your work anywhere.

Before anything is written to disk, the collector throws away the content: prompts, model outputs, command bodies, file contents, diffs, and tool arguments. It hashes the things that identify you: emails, file paths, branch names, repository remotes. It keeps the boring parts plain: timestamps, tool names, models, token counts, costs, durations, and commit hashes.

Sessions join to pull requests by matching hashes, not names. Both sides hash the same normalized inputs, so the join works while the raw strings never leave your machine.

The health check is honest by design. doctor climbs four rungs, from not_installed to signal_verified, and only the top rung exits zero. A fresh install with no real token traffic fails, on purpose, instead of reporting a green light it has not earned.

What is not finished

Stated as unfinished in the README: background service mode for npm installs is not fitted yet, and the lifecycle command set is proofed in isolation but not released. Release signing and npm publication are tracked in issue #103.

The privacy claim is testable rather than promised. The suppression rules live in packages/shared/src/policy.ts and the forbidden-field list lives in packages/shared/src/schemas.ts. A fidelity test plants sentinel commands, paths, and prompts, then fails if any of them survive to disk.

Pending from Jamesis there a second published cost-per-merged-PR figure you want on this page, from your own fleet rather than from the repo? If yes, supply the number, the window, and the repo it covers. Do not publish a fleet figure without your clearance.

Stack

TypeScript. Node 20 to 24. OpenTelemetry logs, traces, and metrics. Local SQLite ledger with 90-day retention. pnpm monorepo. macOS LaunchAgent. Optional hosted sync that is off by default.