static audit · 2026-10-26T03:54:00.315Z

Mintplex-Labs/anything-llm

120 source files scanned · 18 LLM call site(s) · ~0% of LLM spend looks recoverable (static heuristics)

badge   ![TokenZero audit](https://tokenzero.sh/v1/badge/audit/aud_aPqKXRNpYFk81MR49Ase-g.svg)

repo badge   [![LLM spend audited by TokenZero](https://tokenzero.sh/v1/badge/repo/Mintplex-Labs/anything-llm.svg)](https://tokenzero.sh/audit/Mintplex-Labs/anything-llm)

Models referenced

none detected

Findings

SeverityWhereFindingEst.
lowserver/utils/agents/aibitat/providers/helpers/anthropicTooled.js:177Tool definitions sent without a cache breakpoint
Tool schemas render before the system prompt in the cached prefix. Without a breakpoint on the last tool they are billed in full on every call.
Fix: TokenZero marks the last tool automatically; manually, add `cache_control` to the last tool definition.
8%
lowserver/utils/agents/aibitat/providers/helpers/anthropicTooled.js:321Tool definitions sent without a cache breakpoint
Tool schemas render before the system prompt in the cached prefix. Without a breakpoint on the last tool they are billed in full on every call.
Fix: TokenZero marks the last tool automatically; manually, add `cache_control` to the last tool definition.
8%

Fix all of it with one line

OPENAI_BASE_URL=https://tokenzero.sh/v1
ANTHROPIC_BASE_URL=https://tokenzero.sh

Keys pass through untouched. Cache formatting and exact caching are on by default; cascade routing stays opt-in. How it works