Spend alertsBuilt for

Claude Code

Your AI budget,spent on workthat isn't yours.

Claude Code bills to your company account wherever a developer opens it - a personal fork, a side project, 2am on a Sunday, or well past what this month was meant to cost. Normally you find out when the invoice does. Lineman checks every session against six rules and tells you within minutes, in Slack, Discord, email, PagerDuty or any signed webhook.

Book a demo Start for free

A walkthrough on your own setup. Alerts are on Pro; cost reporting is free.

Alerts arrive where you work

Slack

Discord

Teams

Google Chat

Mattermost

Rocket.Chat

Zulip

PagerDuty

Webhook

New Relic

Datadog

Grafana

Honeycomb

Coralogix

Zapier

Make

Pipedream

Power Automate

Activepieces

Evaluated every: 5 min
Destinations: Chat, ops, webhook

The blind spot

The agent runs wherever the terminal is pointed.

A coding agent has no idea which repositories are yours. It reads the checkout it is given and bills the key it is handed. A fork, a side project, an experiment on a personal account: all of it lands in the same invoice, four weeks later, as one number.

The provider console cannot see a repository

It reports keys, models and dates. Whether the work was on your codebase is not a question it can answer.

Month end is too late to matter

By the time an unusual line item is visible, the spend is committed and the context is gone.

Policy without detection is a document

Every company has a rule about where company resources may be used. Almost none can tell you when it was broken.

What arrives

An alert you can act on without opening a dashboard.

The message carries the rule, the repository, the person, the amount and the window. The link goes straight to the spend behind it.

LinemanAPP14:35

Unauthorised repository

$412.87 recorded against a repository that is not on the authorised list.

Repository: grant-personal/scratch-agent
Developer: sam.rivera@meridian.example
Spend: $412.87
Window: Today, 09:00 to 14:35 UTC

View in Cost Explorer

Figures are illustrative. The layout is the one the Slack renderer produces.

Who it answers

Spend control, for the three people who ask for it.

A runaway agent, a policy breach and a blown budget are the same event seen from three chairs.

Engineering leads

A runaway agent becomes a notification

Not a line item somebody finds in arrears. The alert names the repository, the person and the amount, and links straight to the spend behind it.

Finance

Budgets that are observed, not just written down

Daily, weekly, monthly and per-person budgets, with threshold crossings raised as they happen rather than reconciled a month later. Every breach carries its evidence.

Founders and execs

Policy you can actually prove

Every company has a rule about where company resources may be used. This is the one that can tell you, the same day, when it was broken and by how much.

Alerts and budgets are on Pro. Cost reporting, including the full breakdown, is on the free tier.

ISO 27001 + 27701 accreditation in progress
No prompt or source code leaves your machine
UK company, DPA available

See pricing Security and compliance

Destinations

Send it where the team already is.

Send the alert where the team already looks. Availability is per destination, because each one is released only after it has been run against the real service.

Chat

The alert renders as a card with the rule, the amount and a link back to the spend.

SlackAvailable
DiscordAvailable
Microsoft TeamsRequest access
Google ChatRequest access
MattermostRequest access
Rocket.ChatRequest access
ZulipRequest access

Incident and observability

For teams that would rather see spend beside their other signals than in a chat channel.

PagerDutyRequest access
New RelicRequest access
DatadogRequest access
GrafanaRequest access
HoneycombRequest access
CoralogixRequest access

Observability destinations are reached over OTLP, so anything that accepts OpenTelemetry works, whether or not it is named here.

Anywhere else

A signed webhook covers every destination we have not built a first-class connector for, including your own service.

EmailAvailable
Signed webhookAvailable

Zapier
Make
Pipedream
Power Automate
Activepieces

The rules

Six rules, and nothing invented.

These are the exact rule types the evaluator produces, and the exact event names they publish as. A name with no producer behind it would be worse than no name at all, so there are none on this page.

Rule	Event	Fires when
Unauthorised repository	`cost_alert.unauthorized_repo`	Spend was recorded against a repository that is not on your authorised list.
Out of hours	`cost_alert.out_of_hours`	A member spent outside the working hours configured for them.
Daily budget	`cost_alert.budget_day`	Company spend crossed a threshold of the daily budget, including passing it outright.
Weekly budget	`cost_alert.budget_week`	Company spend crossed a threshold of the weekly budget.
Monthly budget	`cost_alert.budget_month`	Company spend crossed a threshold of the monthly budget.
Member budget	`cost_alert.member_budget`	An individual's spend crossed a threshold of their own budget.

Unauthorised repository
Spend was recorded against a repository that is not on your authorised list.
cost_alert.unauthorized_repo
Out of hours
A member spent outside the working hours configured for them.
cost_alert.out_of_hours
Daily budget
Company spend crossed a threshold of the daily budget, including passing it outright.
cost_alert.budget_day
Weekly budget
Company spend crossed a threshold of the weekly budget.
cost_alert.budget_week
Monthly budget
Company spend crossed a threshold of the monthly budget.
cost_alert.budget_month
Member budget
An individual's spend crossed a threshold of their own budget.
cost_alert.member_budget

Unauthorised-repo and out-of-hours alerts are classed as policy breaches, so they stay separable from budget noise in the board and in the payload.

For whoever reads the payload

Signed, typed, and testable.

The parts that matter if you are going to wire an alert into something that pages a human.

Every delivery is signed
An HMAC signature over the raw body, so a receiver can prove the payload came from us before acting on it.
The event type is machine-readable
Each alert carries its rule type, the subject, and a dedupe key, so a receiver branches on a field rather than string-matching an English title.
Money is unambiguous
Amounts are carried as integer micro-USD with a floating-point sibling beside them. No cents, no guessing which unit a field is in.
There is a test event
Send webhook.test on demand, so an endpoint and its signature verification can be proven without waiting for a real alert to fire.

{
  "type": "cost_alert.unauthorized_repo",
  "dedup_key": "unauthorized_repo:grant-personal/scratch-agent:2026-07-28",
  "subject_user_id": "9f2c...",
  "detail": {
    "repo": "grant-personal/scratch-agent",
    "spend_usd_micro": 412870000,
    "spend_usd": 412.87,
    "window_start": "2026-07-28T09:00:00Z"
  }
}

The honest part

What it does not do.

Three things worth knowing before you rely on it.

Five minutes, not five seconds
The evaluator runs every five minutes against completed sessions. It is a governance control, not a circuit breaker: it tells you a rule was broken, it does not stop the session that broke it.
Alerts and budgets are on Pro
Cost reporting, including the full breakdown by repository, developer and ticket, is on the free tier. The alerting and budget surfaces are the Pro-only part, and we would rather say so here than at the checkout.
It can only see what Lineman sees
Spend from a machine without the plugin installed is not evaluated, because it never reaches us. Authorised-repository alerting is only as complete as your plugin rollout.

Your AI budget,spent on workthat isn't yours.

The agent runs wherever the terminal is pointed.

The provider console cannot see a repository

Month end is too late to matter

Policy without detection is a document

An alert you can act on without opening a dashboard.

Spend control, for the three people who ask for it.

A runaway agent becomes a notification

Budgets that are observed, not just written down

Policy you can actually prove

Send it where the team already is.

Chat

Incident and observability

Anywhere else

Six rules, and nothing invented.

Signed, typed, and testable.

Every delivery is signed

The event type is machine-readable

Money is unambiguous

There is a test event

What it does not do.

Five minutes, not five seconds

Alerts and budgets are on Pro

It can only see what Lineman sees

Questions people actually ask

Know the same day.