What does an AI security review actually cost? I measured it per run

Description and use

The article explains how to use the secfoo CLI to measure the cost of an AI security review, including token usage and monetary spend, and how to enforce a cost threshold in CI pipelines.

Problem

Teams need to know the cost of each AI security review run to manage budgets and CI gates.

Outcome

A 30‑line Flask app was scanned in 11.2 s with 2,183 input and 981 output tokens, costing <$0.01. The same run with Codex took 27.5 s and used ~15,201 tokens, but cost was not recorded. secfoo can aggregate spend and enforce a max‑cost gate in CI.

Workflow

• Install secfoo with API support
• Set OPENAI_API_KEY
• Run secfoo with --skill sast --agent api --target . --project-name demo --app-id ""
• Observe output table with duration, findings, cost, and run ID
• Repeat run to confirm token consistency
• Run with --agent codex to compare token usage
• Use secfoo cost commands to aggregate spend by agent or skill
• Add --fail-on high --max-cost 2.00 to CI scripts to gate on cost

Evidence

secfoo run --skill sast --agent api --target . --project-name demo --app-id "" success — SAST — Static Code Analysis Assessment results … AI spend for this run: <$0.01

Source

It finished in 11.2 seconds and reported one finding: the SQL injection in get_user()

Source

Codex runs on a subscription login, so there is no per‑run price to record. A dash is the right answer.

Source

secfoo cost --by agent --project demo AI spend by agent … 2,183 input tokens, 981 output tokens, <$0.01

Source