Engineer
“What did that cost, and did I leak anything?”
Cost per ticket and per project from branch names you already use. A credential check over every command your agent actually ran. No setup, no account, nothing to switch on.
The free product
Everything Actualis does,
and what it will never do.
One command, one machine, no account. It reads the logs your coding agents already write and answers three questions you currently cannot. This page is the complete list — nothing here is held back for a paid tier.
Who it is for
The same data, four different questions
Actualis is one tool, but what you want from it depends on which chair you are sitting in.
AI / platform lead
“Where is the budget going, and why?”
Spend by model, project, branch and ticket, with cache read and write priced separately — on real workloads ~98% of tokens are cache reads, and pricing that wrong overstates spend roughly tenfold.
Security
“What has been in agent context?”
Credentials grouped by fingerprint, with first seen, last seen, use count and projects — ranked for rotation. Plus every shell command that really ran, and the permission mode in force at the time.
CTO / CISO
“Can I trust the number?”
Every figure traces to its records. Unknown model rates are excluded rather than guessed. Agent binaries are checked against their publisher's signature before their logs are believed.
If you wear several of those hats at once — which most people at a startup do — that is the point. It is one command, and the report answers all four.
What you get
Three answers, and six ways to get at them
Everything below is in the free tool. Nothing is reserved for a paid tier, and nothing here ever will be.
Exposure
What reached the model
- 12 credential types, grouped by fingerprint
- First seen, last seen, use count, projects
- Ranked for rotation
- Values never stored or printed
Activity
What the agent did
- Nine audit categories, no model in the loop
- Permission mode at the time
- Every denial recorded
- Subagent work attributed to its parent
Cost
What it cost, and where
- By project, branch, model, ticket
- Cache reads and writes priced separately
- Hit rate against your own median
- Unknown rates excluded, not guessed
How you use it
Command line
actualis — one command, no flags needed. Add
--days, --project or --bash to narrow it.
Menu bar
Native tray app for macOS, Linux and Windows. One notification per new credential, never a backlog dumped at launch.
MCP server
Your agent queries its own history. See below — this is the one most people do not expect.
Live monitor
--watch alerts as new secrets and risky commands appear,
rather than when you remember to look.
JSON
--json for scripts and CI. Every key documented, and a test
fails the build if one is not.
Safe sharing
--share strips everything identifying — verified by
tests that plant identifying strings and assert none survive.
It verifies the agent before believing its logs
This is the part most people do not expect, and it is free.
actualis --agents checks the code signature of every
installed agent binary against its expected publisher — Anthropic for
Claude Code, OpenAI for Codex — and reports anything unsigned or
tampered rather than quietly accepting it.
Tested the only way that means anything: flipping one byte of a 325 MB signed binary makes the check fail.
It matters because a patched coding agent is a credential harvester with a shell on your machine and a legitimate reason to read every file. That is a larger blast radius than a bad npm package, and almost nobody checks.
AGENT PLATFORMS Claude Code 1.2.4 signature valid publisher Anthropic PBC (Q6L2SF6YDW) verdict ✓ genuine Codex 0.9.1 signature valid publisher OpenAI OpCo, LLC (2DC432GLL2) verdict ✓ genuine
Illustrative output.
What it surfaces, across both vendors
Coding agents run shell commands, read files and hold credentials in context. Almost none of that is visible today. Actualis makes seven things visible in one shape, whichever agent produced them.
| Signal | The question it answers |
|---|---|
| Binary signature | Is the agent on this machine genuinely the publisher's? |
| Credentials in context | What secrets reached the model, and how long ago? |
| Commands executed | What the agent actually ran — not what it proposed. |
| Permission mode | What share of turns ran unsupervised? |
| Tool denials | What did the agent try that was refused? |
| Subagent blind spots | What the record cannot show, stated rather than hidden. |
| Model and effort mix | Where is premium reasoning being spent? |
Every figure traces to its evidence: --explain shows the
arithmetic, the rate applied and what was excluded; --why shows
the records behind a finding. There is no number you have to take on trust.
Claude Code and Codex. AGPL-3.0. Python 3.9+, no runtime dependencies.
MCP
Let the agent audit itself
Actualis runs as an MCP server. Point your coding agent at it and it can query its own history — in the same session, in plain language, without you leaving the terminal.
> what have I spent on this project this week, and did anything leak? Checking actualis… $41.80 over 6 active days, 88% on opus-5. Cache hit rate 96%. 2 credentials in command history: Stripe key critical first seen 12 days ago GitHub PAT high first seen 3 days ago Rotate the Stripe key first — it is older and it is critical.
Illustrative. Your agent's phrasing will differ.
Why this matters more than it sounds
- The agent that caused the spend can now see it. Ask it to justify a cost, or to check whether the command it is about to run resembles one already flagged.
- Same redaction, same code path. An agent querying Actualis cannot see credential values a human running the CLI could not.
- Read-only, like everything else. The MCP server exposes the same data the report shows. It cannot change anything.
- No network. It speaks over stdio to a process on your machine. Nothing is hosted.
$ actualis --mcpThe commitment
Free stays free, and free stays local
There is a paid product coming. These two promises are what it is being built around, not in spite of.
Nothing here ever moves behind a paywall
Every capability on this page stays free, permanently. A paid tier will add what a single machine cannot do — it will never remove what a single machine already did. A security tool that cripples its free version to sell the paid one has destroyed the reason anyone trusted it.
This tool will never phone home
Not opt-in, not off-by-default, not later. The paid product is a separate install you choose deliberately. That is the whole reason it is separate: so this one can keep an absolute promise instead of a qualified one.
The paid product will be cross-vendor and security-shaped — fleet visibility, retained history, policy and attestation across a team. Not a cost dashboard, and not a better detector: the detectors are the same ones you get here.
Honest about limits
What it cannot do
Stated here rather than discovered later.
- It only sees what the agent already logged. Deleted or rotated transcripts are gone.
- Secret detection is pattern-based and will miss bespoke token formats. A clean report means nothing matched.
- Subagent shell commands are absent from the parent transcript; the report says what share that is rather than under-counting.
- Unknown model rates are excluded from totals rather than guessed, so a total can be short — and it says so.
- It will not rotate, revoke or block anything. Read-only cannot break your workflow, and that guarantee is worth more than the convenience.