What does an AI security review actually cost? I measured it per run

Описание и применение

В статье описывается, как с помощью CLI‑инструмента secfoo измерить стоимость выполнения AI‑обзора безопасности, включая токены и денежные расходы, а также как включить лимит стоимости в CI.

Задача

Teams need to know the cost of each AI security review run to manage budgets and CI gates.

Результат

A 30‑line Flask app was scanned in 11.2 s with 2,183 input and 981 output tokens, costing <$0.01. The same run with Codex took 27.5 s and used ~15,201 tokens, but cost was not recorded. secfoo can aggregate spend and enforce a max‑cost gate in CI.

Рабочий процесс

• Install secfoo with API support
• Set OPENAI_API_KEY
• Run secfoo with --skill sast --agent api --target . --project-name demo --app-id ""
• Observe output table with duration, findings, cost, and run ID
• Repeat run to confirm token consistency
• Run with --agent codex to compare token usage
• Use secfoo cost commands to aggregate spend by agent or skill
• Add --fail-on high --max-cost 2.00 to CI scripts to gate on cost

Доказательства

secfoo run --skill sast --agent api --target . --project-name demo --app-id "" success — SAST — Static Code Analysis Assessment results … AI spend for this run: <$0.01

Источник

It finished in 11.2 seconds and reported one finding: the SQL injection in get_user()

Источник

Codex runs on a subscription login, so there is no per‑run price to record. A dash is the right answer.

Источник

secfoo cost --by agent --project demo AI spend by agent … 2,183 input tokens, 981 output tokens, <$0.01

Источник