llm.log

Track tokens, costs, and every prompt across all your LLM APIs.
Runs locally. Web + TUI dashboard, single binary, zero config.

Install · Quick Start · Dashboard · CLI · Export · Data Management · How it Works

_{Web UI — llm-log ui}

_{TUI — llm-log dash}

What is llm.log?

A local proxy that sits between your apps and LLM APIs. It intercepts requests, extracts token usage, calculates costs, and stores everything in SQLite — without changing a single line of code.

• Zero code changes — works via HTTPS_PROXY, picked up by most apps automatically
• All major providers — OpenAI, Anthropic, OpenRouter, Groq, DeepSeek, Mistral, and more
• All API formats — Chat Completions, Responses API, Anthropic Messages
• Real costs — auto-updated pricing for 780+ models, cache token breakdowns
• Claude Code aware — on a subscription? see what you'd pay without it. On API keys? see your actual spend
• Web UI — browser-based dashboard with real-time charts, analytics, and detailed request inspection
• TUI dashboard — terminal-based overview, charts, cost breakdown, request inspector
• Minimal overhead — logging is async and never blocks your requests
• Single binary — pure Go, no CGO, no dependencies

Install

# macOS / Linux (Homebrew)
brew install lanesket/tap/llm-log

# or with Go
go install github.com/lanesket/llm.log/cmd/llm-log@latest

# or from source
git clone https://github.com/lanesket/llm.log.git && cd llm.log && make build

Pre-built binaries for macOS and Linux on the Releases page.

Quick Start

llm-log setup   # one-time: generate CA cert, trust it, configure shell
llm-log start   # start the proxy
llm-log dash    # open the dashboard

After setup, open a new terminal (or run source ~/.zshrc) — then every LLM API call is logged automatically.

Already running apps need a restart to pick up the proxy.
On macOS, new apps from Dock pick it up automatically.

Note: llm.log intercepts requests that go directly from your machine to LLM APIs.
Tools that route through their own servers (Cursor Pro, VS Code Copilot with built-in subscription) won't be logged.
If the tool supports your own API key, requests go directly to the provider and llm.log captures them.

Web UI

llm-log ui   # opens http://localhost:9923

TUI Dashboard

llm-log dashboard   # or: llm-log dash

Keys: 1-4 tabs · p period · s source · f provider · m model/provider · j/k navigate · enter detail · c/p/r copy · e export · ? help · q quit

CLI

llm-log status                    # daemon status + today's summary
llm-log logs                      # recent requests
llm-log logs --id 42              # full detail with prompt/response
llm-log logs -s cc:sub            # filter by source
llm-log stats                     # usage stats by provider
llm-log stats -b model -p week   # by model, last week
llm-log stats --json              # JSON output

Export

Export logged data to CSV, JSON, or JSONL for analysis in Excel, Jupyter, pandas, etc.

llm-log export                            # CSV to stdout (last month)
llm-log export -f json -o data.json       # JSON to file
llm-log export -f jsonl -p week           # JSONL, last week
llm-log export --from 2025-03-01 --to 2025-03-15  # date range
llm-log export -s cc:sub --provider anthropic      # filtered
llm-log export --with-bodies -p today     # include request/response bodies

--from/--to override --period when both are provided.

In the dashboard, press e to quick-export the current filtered view to llm-log-export-{timestamp}.csv in the current directory.

Data Management

Request/response bodies can grow large over time. Use prune to delete old bodies while keeping all metadata (tokens, costs, timestamps).

llm-log prune --older-than 30d              # delete bodies older than 30 days
llm-log prune --older-than 30d --dry-run    # preview without deleting
llm-log prune --older-than 6m --force       # skip confirmation (for cron)

Supported durations: 7d, 30d, 6m, 1y.

How it Works

Your app ──HTTPS_PROXY──▸ llm.log (127.0.0.1:9922)
                              │
                              ├─ LLM provider? ──▸ MITM ──▸ parse usage ──▸ SQLite
                              └─ Other?         ──▸ tunnel through (no interception)

1. llm-log setup generates a CA certificate and adds it to your system trust store
2. llm-log start launches a daemon and sets HTTPS_PROXY + CA env vars for all major tools
3. The proxy MITMs only known LLM domains — everything else tunnels untouched
4. Streaming responses are tee'd — client gets data in real-time, proxy parses accumulated result
5. Costs are calculated from auto-updated pricing data (780+ models)

Providers and formats

Providers and wire formats are extensible — see Extending llm.log.

Proxy activation

CA trust is configured for Node.js, Python, curl, Go, and Ruby via NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, and CURL_CA_BUNDLE.

Data storage

Everything in ~/.llm.log/ — SQLite (WAL mode), CA cert, cached pricing, env file, PID. Request/response bodies are gzip-compressed in a separate table.

License

MIT