AI Pet Usage is a local-first macOS menu-bar app. It reads AI CLI usage logs already on your machine and shows quota / cost / activity. It does not upload usage data, has no telemetry, and requires no account or login. The only outbound network calls are reviewed opt-in, off-by-default checks — the GitHub Releases update check, the OpenRouter credits check, the Grok quota check (each sending its one stored credential only to its one host as request auth headers), and an upcoming Codex usage check. See PRIVACY.md for the privacy promise in plain language, docs/DATA_BOUNDARY.md for the per-data-class boundary checklist, and docs/DATA_SOURCES.md for exactly what is read.

This is alpha software. Security fixes are made against the latest alpha-v* release and main. There is no long-term-support branch yet.

Please report suspected vulnerabilities or data leaks privately — do not open a public issue.

Use GitHub's private advisory flow: Report a vulnerability »

When reporting, please include enough to reproduce, but never include:

• prompts, assistant messages, or tool payloads,
• API keys, tokens, or auth files,
• full local file paths or project contents.

Redacted evidence (provider, version, error code, the shape of a log line with values replaced) is enough and is what a fix is built from.

• An unexpected outbound network call (anything beyond the reviewed opt-in integrations above — GitHub update check, OpenRouter credits check, Grok quota check, Codex usage check (upcoming) — each disabled by default).
• Any stored credential (the OpenRouter key, the Grok session token) appearing anywhere other than the auth headers of its own opt-in request (a log line, an export, a diagnostic, disk, another host).
• Prompts / assistant messages / tool payloads / auth files ending up in the ledger, a report, an export, or a diagnostic bundle.
• Reading files outside the documented provider log locations (for the opt-in monitors, that means anything beyond opencode's auth.json / grok's auth.json as documented in docs/DATA_SOURCES.md).
• Local privilege / TCC issues in the bundled app or the aipet CLI.

• Estimated numbers being imprecise (Grok tokens are a lower bound; Claude percentages without the statusline hook are estimates) — these are documented as estimates, not exact figures. File an accuracy issue instead.
• Gatekeeper warning on first launch (the alpha is ad-hoc signed, not yet notarized).