Other AI cost tools keep notes. We keep accounts.
guided demo
GOD-MODE VERIFIED
raw authoritystorm active
Every flash is usertools acting on a live agent — a post, a hold, a resume, a refusal — across 1,284 loops at once.
None of it asks the agent . The authority sits at the ledger, and anything that spends, it governs.
target acquisitionacquiring
The glass tightens from 1,284 loops to the four your app names — found the way they are governed: by spend, never say-so.
The reticle is riding deploy-agent’s cluster: the four loops the next beat hands to your thumbs.
power × precisionarmed
Power reaches every agent ; precision picks out the one. Together they hand you the exact agent , the exact action.
The app that follows is live — its rows are wired to the four loops in the glass. Press things.
usertrust under the hood, with TigerBeetle at its core.
Your agents run at model speed. The check finishes before the call even leaves.
Two orders of magnitude apart, on any hardware. 500K a second is TigerBeetle’s ceiling.
Every entry seals the one before it. No edit leaves the chain intact.
Hash-linked, Merkle-proved, anchored past the operator’s reach.
A thousand agents , one budget. Two that race cannot both overspend.
1,000 concurrent agents , 2,000 calls, zero unaudited.
TigerBeetle holds balances as debits and credits on accounts, so a spend is a movement between two of them — the agent’s and the operator’s budget. There is no row to update and no counter to increment, which is why two writers cannot disagree about the total.
The amount is reserved without being committed. It is no longer available to any other call, and no money has moved. This is the interval the dimension line measures: the only point at which stopping the agent costs nothing, because nothing has been spent.
debits_must_not_exceed_credits is a flag on the account itself, so the reserve is refused by the ledger rather than by a layer above it that could be argued with. Two agents racing cannot both overspend: they draw on the same account, and the database settles the order.
The reserve failed, so the call never reached a provider — nothing sent, nothing billed. The refusal is still written to the chain, because a call you declined to make is a fact about your spending too.
post_pending_transfer commits the hold at the real metered cost, which is usually less than was reserved because the reserve had to assume the worst. The difference returns to the budget in the same operation.
void_pending_transfer returns the whole hold. A failed call is free — which is only true because the money was never moved, rather than moved and refunded.
TigerBeetle: a database that only does accounts and transfers, so the operations this drawing needs are the only ones it has. It replicates every write to a quorum before acknowledging it, and it is strictly serializable — which is what makes the invariant above hold under a thousand agents rather than one.
Anthropic, OpenAI and Google — the three SDKs trust() wraps. This is the single point at which a governed call leaves your process, which is why it is drawn with a broken outline: everything else on this sheet is yours, and a refused call never gets this far.
Every settled transfer appends an event carrying the hash of its predecessor. Alter any record and every hash after it stops matching. A Merkle inclusion proof then lets an auditor verify one entry without being handed the whole log.
Give them one in under 30 seconds
One dependency. No account, no key, no service in the path.
Writes .usertrust/ — config, policy rules, an empty chain.
Prompts and control flow untouched. The signature gains what it cost.
import Anthropic from "@anthropic-ai/sdk"; import { trust } from "usertrust"; const client = await trust(new Anthropic(), { budget: 50_000, dryRun: true, // $5.00 · ledger deferred }); const { response, receipt } = await client.messages.create({ model: "claude-fable-5", max_tokens: 1024, messages: [{ role: "user", content: "Analyze this contract" }], }); await client.destroy(); // required
{
transferId: "tx_msm19z93_e603a1a2",
cost: 104, budgetRemaining: 49896, settled: true,
auditHash: "08c22f6127aa76d3…ccabf030f8622",
chainPath: ".usertrust/audit",
model: "claude-fable-5", provider: "anthropic",
usage: {
inputTokens: 317, outputTokens: 131,
cacheReadTokens: 87, cacheWriteTokens: 43
},
pricing: { appliedRates: {
inputPer1k: 100, outputPer1k: 500,
cacheReadPer1k: 10, cacheWritePer1k: 125
}, tableVersion: "2026-08-09" }
}
| input | 317 | × | 100 | ÷1k | 31.700 |
| output | 131 | × | 500 | ÷1k | 65.500 |
| cache read | 87 | × | 10 | ÷1k | 0.870 |
| cache write | 43 | × | 125 | ÷1k | 5.375 |
| sum | 103.445 | ||||
| → | cost 104 | ||||
104 usertokens, 1 = $0.0001 — just over a cent. Counts and rates are both the receipt’s own, so the number is checkable from the record alone. That is the difference between a log and an account.
What is open: the part that does the governing. Policy, holds, settlement, the server that stands on the wire and the verifier that audits it — Apache-2.0, one npm i usertrust away. Not a client shim around a hosted black box: the package talks to the ledger directly.
Why it matters: we are asking to sit in the path of your money, which is a lot to take on faith. So the part that does the governing is the part you can read.
What that buys you: audits nobody takes our word for — the verifier replays the chain and proves the books. No lock-in — use it alone, or don’t use us at all. And a LIMITATIONS.md that names what usertrust does not govern — a trust layer that overstates itself is worse than none.
Read the sourceThe usertools app is coming soon. Join the waitlist — one email when it matters.