Unbounded loops around AI/LLM calls and missing output token limits are the two patterns behind almost every "we left it running and the bill was insane" story. Thuban Cost Guard finds both, automatically, in every scan — 100% locally.
npx thuban protectCost Guard runs automatically — no flag, no config.
Someone builds an agent or automation to monitor something, watch a feed, or process a queue — puts the company card on the API key, and walks away. A month later the invoice arrives. Nobody was checking, because nothing was watching the watcher.
Cost Guard exists so your codebase gets checked for this before it ships, not after the bank statement does.
An OpenAI, Anthropic, or Vercel AI SDK call sitting inside a while, do-while, or for loop with no bounded exit condition and no guarded break. That's the pattern behind an agent that never stops calling the API on its own.
An AI SDK call with no max_tokens / maxOutputTokens set, so a single call has no ceiling on cost. Severity escalates to HIGH automatically when that same call is also inside an unbounded loop — the two rules compound.
// before — flagged: TCG-101 (unbounded loop) + TCG-201 (no token limit)
while (true) {
const res = await openai.chat.completions.create({
model: 'gpt-4',
messages: [{ role: 'user', content: getNextTask() }],
});
handle(res);
}
// after — clean
let attempts = 0;
while (attempts < MAX_ATTEMPTS) {
const res = await openai.chat.completions.create({
model: 'gpt-4',
messages: [{ role: 'user', content: getNextTask() }],
max_tokens: 500,
});
handle(res);
attempts++;
}Cost Guard only matches known AI SDK call chains — openai.*, anthropic.messages.create, Vercel AI SDK's generateText/streamText/embed, and similar. A db.user.create(), prisma.invoice.create(), or stripe.customers.create() never trips it — verified by test, not by guesswork.
It ships as part of every scan and install — nothing to turn on. Run it now and see what it finds.
npx thuban protect