static audit · 2026-10-26T04:02:15.764Z

Block/goose

120 source files scanned · 2 LLM call site(s) · ~7% of LLM spend looks recoverable (static heuristics)

$80per 10k runs today (gpt-4o, ~2000 prompt tokens)
$74.4per 10k runs with fixes applied

badge   ![TokenZero audit](https://tokenzero.sh/v1/badge/audit/aud_mBlZt1GTH_ZJN4_8mBCG2Q.svg)

repo badge   [![LLM spend audited by TokenZero](https://tokenzero.sh/v1/badge/repo/Block/goose.svg)](https://tokenzero.sh/audit/Block/goose)

Models referenced

gpt-4o ×2 (cheaper sibling: gpt-4o-mini)

Findings

SeverityWhereFindingEst.
lowscripts/bench-postprocess-scripts/llm-judges/llm_judge.py:82LLM call inside a loop
Per-item calls repeat the full prompt prefix for every element. If items are independent and latency-tolerant, the provider Batch API is 50% cheaper, and OpenAI Flex processing (`service_tier: "flex"`) gives the same 50% on ordinary calls without restructuring; if the prefix is shared, caching pays off immediately.
Fix: Batch where possible, or set `service_tier: "flex"` on OpenAI calls that can wait; otherwise keep the shared prefix cache-formatted (TokenZero does this automatically).
25%
lowscripts/bench-postprocess-scripts/llm-judges/llm_judge.py:124LLM call inside a loop
Per-item calls repeat the full prompt prefix for every element. If items are independent and latency-tolerant, the provider Batch API is 50% cheaper, and OpenAI Flex processing (`service_tier: "flex"`) gives the same 50% on ordinary calls without restructuring; if the prefix is shared, caching pays off immediately.
Fix: Batch where possible, or set `service_tier: "flex"` on OpenAI calls that can wait; otherwise keep the shared prefix cache-formatted (TokenZero does this automatically).
25%
lowscripts/bench-postprocess-scripts/llm-judges/llm_judge.py:82"gpt-4o" retires on 2027-01-14
The provider announced on 2026-10-14 that this model retires on 2027-01-14 (80 days). Recommended replacement: gpt-6-luna.
Fix: Move to gpt-6-luna (eval first); TokenZero's cascade can route to it, and the gateway warns in X-TokenZero-Warning until you do.
0%

Fix all of it with one line

OPENAI_BASE_URL=https://tokenzero.sh/v1
ANTHROPIC_BASE_URL=https://tokenzero.sh

Keys pass through untouched. Cache formatting and exact caching are on by default; cascade routing stays opt-in. How it works