What shipped: cost history and three new AI providers

Since launch

The governance foundation shipped first: multi-tenant isolation, per-tenant encryption, and the rule engine behind the flags this blog keeps talking about — zombie keys, stale keys, wildcard scopes — plus the OpenAI leak-detection webhook that’s still the one real automated action in the product. Bulk .env import landed here too, along with a daily Slack quota report.

A few weeks later: a vendor-template library for faster onboarding, the first BYO-Postgres groundwork, a nightly CI job that actually calls every vendor’s API to make sure nothing’s quietly broken, and a security pass — cross-tenant access blocked at the session layer, secrets stopped leaking into client-side settings payloads, and the billing webhook stopped accepting unsigned requests.

Late July – August: cost visibility gets real

This is the work most of what’s on this site describes today.

• Real cost history and the integration catalog page — the page you’re looking at right now if you’re on /integrations, plus per-vendor historical cost charts instead of point-in-time snapshots.
• Claude token usage and cloud cost breakdown — Anthropic usage data joined the OpenAI spend tracking that already existed.
• Per-day metrics and a token-flow chart — daily-granularity fetchers instead of whatever-granularity happened to be cached, plus a Sankey diagram for how token spend splits across models.
• OpenAI account-type detection and spend-guardrail visibility — SubScope now shows the spend ceilings you’ve already configured in OpenAI’s own console, instead of guessing at them. It still doesn’t set them for you — that part hasn’t changed.
• A double-counting bug in spend attribution, fixed — the kind of bug that makes a “cost spiked 412%” flag embarrassing if it’s still there. It’s not, as of August 4th.
• Three new AI providers — Kimi (Moonshot AI), GLM (Zhipu AI) and MiniMax joined the register in the first two weeks of August, alongside the OpenAI, Claude and OpenRouter coverage that was already live.

What hasn’t changed

Worth saying plainly, since it’s easy to read “spend guardrails” and “cost visibility improvements” as inching toward automation: none of this adds enforcement. SubScope still doesn’t set a spend cap, throttle a request, or rotate a key on your behalf. It shows you what’s true, faster and in more detail than it used to. What you do with that is still entirely on you.