alerts

alerts is a command for coding agents from omrikais/cctally. It costs 0 tokens per session (2,711 once invoked), scanned A, original, Apache-2.0.

A command for optional desktop notifications when Claude usage crosses chosen percentage thresholds. It can notify on the weekly subscription limit or the five-hour usage block.

In plain words
What is it for?
Use it to enable threshold alerts and receive notifications through macOS, Linux, or a custom notification command. Claude cost figures in alerts are transcript-based estimates.
Why use it?
It warns you when usage reaches a limit during a long run, so you do not have to keep checking reports manually.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/omrikais/cctally/alerts
Clone the repo
git clone --depth 1 https://github.com/omrikais/cctally
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,711 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.02711
Opus 5 $0.00000 $0.01355
Sonnet 5 $0.00000 $0.00542
Haiku 4.5 $0.00000 $0.00271

Measured 3d ago against content hash 9cec7a4d4e62, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

alerts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

docs/commands/alerts.md · 258 lines

How it starts

The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.

cctally alerts — threshold notifications

Opt-in OS notifications when usage crosses a percent threshold on the weekly subscription axis or the 5h-block axis. Off by default; once enabled, alerts fire automatically from record-usage on any new percent crossing — no extra wiring beyond enabling the feature. The OS popup is dispatched cross-platform — osascript on macOS, notify-send on Linux, or a custom command (see Dispatch backends).

Cost coverage: Claude costs shown in weekly, five-hour, or budget alert payloads are transcript-derived lower bounds, not exact /usage billing totals. Codex budget alerts use the separate Codex accounting source.

When it helps

You're pacing fine right now, but a long agent run mid-week could push you past 90% before you notice. Threshold alerts surface the crossing the moment it lands in the next snapshot, with a Notification Center popup, a dashboard toast (if open), and a persistent line in the "Recent alerts" panel.

Enable

CLI:

cctally config set alerts.enabled true

Or in the dashboard: open Settings (s) → AlertsClaude alerts → check Enable threshold alerts. The overlay has a filter, so typing alerts.enabled finds the row directly. The dashboard mirrors via POST /api/settings; both paths share the same config.json writer lock.

Defaults

alerts:
  enabled: false
  weekly_thresholds: [90, 95]
  five_hour_thresholds: [90, 95]

When you enable alerts and start a fresh week, the first crossing of 90% fires once; the next crossing of 95% fires once. Re-crossings within the same window are deduped — alerted_at IS NOT NULL on the milestone row gates re-fire.

Test the pipeline

cctally alerts test [--axis weekly|five-hour] [--threshold N]

Sends a synthetic alert through the same dispatch pipeline and alerts.log writer as a real crossing, but with mode=test in the log line so it's distinguishable. No DB writes, no envelope mutation. Use it to verify your notifier is wired up before relying on real crossings.

Read the full file on GitHub · 258 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 258 lines · 0 tokens per session scan A 9cec7a4d4e62

Subscribe to this mod's changes

alerts is a command published in the GitHub repository omrikais/cctally (5 stars, last pushed 4d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 2,711 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.