UsageTap Guard · Monitoring for application builders

Know when customer usage changes.

More calls, different token behavior, or faster consumption. Monitor LLM economics and API activity by customer and feature, with evidence to investigate unexpected cost, runaway workflows, and suspected abuse.

Explore Monitoring demo Connect your application

Included with Meter · Keep your providers · Opt-in email and Slack alerts

LLM cost & cache

The same traffic. A different cost.

Understand changes in cache reuse, output behavior, and cost per call.

API & agent activity

The same access. More work happening.

See which customer or workflow is consuming calls and units faster.

Two reasons to look closer

Follow both the volume and the behavior.

A usage surge and a quiet cost regression need different evidence. Guard brings the signals appropriate to each kind of work into one Monitoring view.

LLM behavior & economics

Traffic is steady. Why did each call get more expensive?

A prompt change can break cache reuse. Longer responses can increase output cost. Guard compares model-call behavior within each customer and feature so you can see where the economics changed.

Illustrative demo · Expected → Observed

Completed calls / minute: 20 → 20
Cache-read share: 71% → 18%
Cost per call: $0.010 → $0.028

Cache-read share · Output/input ratio · Cost per call · Completed-call rate · Token coverage · Token mix · Output-size distribution

Explore the LLM example →

API & agent consumption

A handful of calls yesterday. Thousands today. What changed?

Agents, APIs, and MCP integrations expand access to your product. A new integration, runaway automation, or a compromised application key can change consumption. Guard shows the customer, feature, and meter to investigate.

Illustrative demo · Expected → Observed

Reporting events / minute: 20 → 20
Calls per reporting event: 1 → 8
Calls consumed / minute: 20 → 160

Consumption rate · Units per reporting event · Reporting-event rate · Increment sizes · Allowance burn · End-user and task attribution

Explore the API example →

Try it before signing in

Explore Guard in the public Monitoring view.

Switch between LLM and API examples, select signals, and inspect the incident evidence. The demo uses browser-only fixtures; connected workspaces show your reported usage.

Open full demo ↗

Start with cache-read share, then select cost per call. Call rate is steady while each call becomes more expensive.Illustrative fixture data · No account required · No production access

The actual Monitoring view

Select a signal. Compare the evidence.

Explore expected ranges, recorded values, related signals, and incident details in the public Live View.

See → Notify → Investigate

You don't have to keep the dashboard open.

Background evaluation continues when you close Live View. Opt into email or Slack notifications, then open the affected scope to compare the observed usage with its expected range.

1
See the change
Select the customer, feature, meter, and comparison window. Learning and data-quality states tell you when a comparison is not yet available.
2
Choose how to hear about it
In Configure → Notifications, enable Guard monitoring for email, Slack, or both. Add email recipients or connect Slack and choose a channel.
3
Follow the evidence
The alert links to the affected Monitoring scope. Inspect related signals, review estimated excess LLM window cost where available, and record investigation feedback.

Illustrative notification · Email or Slack

UsageTap monitoring warning for Acme AI

Usage for customer acme changed unexpectedly.
Feature: document-assistant
5-minute window · 100 completed calls

Cache-read share: 18% observed · 71% expected
Cost per call: $0.028 observed · $0.010 expected

Estimated extra LLM window cost: $1.80

Inspect the demo evidence →

Example values, not a delivered customer alert. Usage changes warrant investigation; they do not establish a security incident.

Custom meters & task context

Follow the work your product sells.

An import can make model calls and process pages. An export can consume records. Monitor the unit that matters, and use a shared task ID to look up related usage for one customer. LLM cost and each meter's units stay separate.

A complementary view of spend

From customer behavior to the overall bill.

Guard explains recent reported behavior. Spend monitoring compares provider-reported totals and metered estimates; forecasts show where usage is heading. Configured Meter controls enforce supported policies when your application applies them.

Explore spend monitoring and controls →

Start with one application feature

Keep your providers. Connect your usage.

Instrument existing model calls or report completed API and custom-meter events. Attach a stable customer ID and feature label. Guard learns from reported usage in the background; notification delivery is opt-in.

Read the setup guide Start free with Meter

Included with Meter

100,000 events free / month

Existing Meter event rates apply after the included allowance. Guard evaluations and alerts do not create additional billable events. No separate Guard subscription or Gateway adoption is required.

See Meter pricing →

Already using the metadata-only observer trial? Keep the cost baseline, then connect a Meter workspace for customer attribution, Guard investigation, and notifications.

Explore the usage analysis trial →

Why usage patterns matter

Successful requests can still deserve a closer look.

Sourcegraph reported that an unusual API-usage spike triggered its investigation into abuse of its LLM-backed service. Anthropic has also described detecting active extraction campaigns through traffic patterns and specialized analysis.

Sourcegraph incident disclosure ↗Anthropic threat report ↗

Independent reports, not UsageTap customer outcomes. Guard flags usage changes; it does not perform prompt-intent classification or coordinated-account attribution. These reports do not establish that Guard would have detected the incidents earlier.

Before you connect.

Is Guard part of Meter?+

Yes. Guard is customer usage monitoring and alerting within UsageTap Meter. It uses reported LLM calls and meter events. Monitoring evaluations, dashboards, and alerts do not create extra billable Meter events.

Do I need to use the Gateway?+

No. Keep your existing providers and model integration. Attribute completed calls and meter events to a customer and feature; Guard evaluates that usage in the background.

When does monitoring start?+

Learning starts as completed usage arrives. Comparisons use closed 5- and 30-minute windows and require 24 eligible earlier windows, sufficient traffic, and usable telemetry. The view shows Learning, Insufficient data, or Data delayed when a reliable comparison is unavailable. Alerts follow sustained or severe deviations, rather than every fluctuation.

Does Guard detect data theft or block an abusive account?+

Guard flags measured usage changes for investigation. It does not determine prompt intent, prove data theft, or automatically block traffic. Separately configured Meter controls can enforce supported policies where your application checks and applies them; reporting completed API or custom-meter usage does not stop work that already happened.

Can I monitor custom units or investigate a task?+

Yes. Monitor pages, searches, records, or another configured meter. When your integration supplies a task ID, look up related calls and meter events for that customer. Recorded LLM cost, each meter’s units, and commercial charges remain separate, and task totals can change as usage arrives.

How does Guard relate to spend monitoring and forecasts?+

Guard examines reported customer and feature behavior in 5- and 30-minute windows. Spend monitoring also compares provider-reported daily spend and hourly metered estimates. Forecasts estimate future usage and runout. Together they help explain current behavior, overall spend, and where usage is heading.

Read detection and alert details →Open your Monitoring workspace →