quotabot

htop for your agentic-AI quota plans.

quotabot shows how much included quota remains across AI coding subscriptions and recommends where to send the next request. It also reports supported local runtimes, so work can fall back locally when subscription caps are low.

Current stable: 0.10.0. quotabot remains under active 0.x development. Next: continue the focused 0.10.x hardening line with the bounded provider-ID cache migration, native field validation, Windows and Apple publisher identity provisioning, and one signed lifecycle rehearsal before 1.0. No new product breadth. See roadmap Next and the documentation index.

Releases state Windows and macOS signing mode at the top of the GitHub release notes. The source workflow now has fail-closed signing paths for both platforms, snapshots that policy once per run, and binds final signed-asset digests to native fresh-download verification. Existing published artifacts are immutable and remain unsigned. No future signed artifact can publish until owner provisioning, both protected native rehearsals, explicit mode activation, and the signed lifecycle gates succeed. Provisioning and activation live in docs/RELEASE-SIGNING.md.

quotabot is a local advisor, not a proxy. Quota and routing reads make no model calls, spend no usage tokens, and never read prompts or source code. The CLI is the complete workflow; the desktop app is optional.

What it looks like

_{The standalone quotabot top CLI, captured from the real terminal dashboard renderer with built-in synthetic demo data.}

_{Five generated demo views at 3 seconds per frame. Desktop still | Analytics still}

Quick start

Install the latest checksum-verified CLI release.

macOS / Linux

curl -fsSL https://raw.githubusercontent.com/blisspixel/quotabot/main/install.sh | bash

Windows PowerShell

irm https://raw.githubusercontent.com/blisspixel/quotabot/main/install.ps1 | iex

Restart the terminal, then run:

quotabot doctor
quotabot suggest

doctor explains stale or unavailable evidence and gives a repair command. suggest ranks usable subscriptions and supplies a local fallback when one is available. The quotabot update command begins with release candidate 16; an older install can bootstrap it by running the one-line installer with the exact stable v0.10.0 tag. Windows rc.16 users should use that same exact stable bootstrap once because the immutable rc.16 Windows bundle has a PowerShell self-update compatibility defect. For inspect-before-run installation, login, updates, rollback, and uninstall, use the setup guide.

Core commands

Goal	Command
Show the full quota snapshot	quotabot or quotabot --json
Check one provider	quotabot check claude
Pick the next provider	quotabot suggest
Prefer a local runtime	quotabot suggest --local-first
Preserve an included-quota reserve	quotabot suggest --quota-stretch
Pick a model for a task	quotabot suggest --task=hard
Inspect model availability and budget	quotabot models
Watch quota and routing changes	quotabot top or quotabot watch
Require selected reads to be live	quotabot verify --require-live
Install the latest release for this channel	quotabot update

Provider routing is balanced by default. --local-first prefers reachable on-device capacity immediately. --quota-stretch keeps fresh measured included quota above a reserve before preferring local capacity. Model suggestions use included quota and local runtimes by default; paid or credit-backed catalog entries require an explicit --budget=any opt-in.

See the usage guide for profiles, accounts, model capability filters, alerts, analytics, drift recovery, routing receipts, and every command.

Supported sources

Supported cloud and application sources include Claude, Codex, Antigravity / Gemini, Grok, Cursor, Windsurf, Kiro, and optional NVIDIA NIM discovery. Cursor 3.x support passively detects an owner-bound local plan, but Cursor does not persist its current quota pools in the supported local state, so quotabot cannot yet route on Cursor headroom. Local sources are Ollama, LM Studio, and Lemonade. Manual entries remain explicitly self-reported. Exact endpoints, evidence classes, credential behavior, and limitations are in Data sources; provider-owned cross-checks are in Provider CLIs.

Desktop app

Portable desktop bundles are published for Windows, macOS, and Linux alongside the CLI. The app is optional. Windows signing and macOS Developer ID signing, notarization, and stapling remain required native trust gates before 1.0. The release workflow now supports Azure Artifact Signing and macOS Developer ID modes for both the CLI and desktop assets. Those modes fail closed when required identity, credential, signature, notarization, staple, or verification evidence is missing. They remain inactive until owner provisioning and successful protected Windows and macOS rehearsals; each release's notes state the mode used by its artifacts. The grouped Settings dialog includes the installed build and an explicit Check for updates action. It contacts GitHub only after that action, shows the latest candidate and latest stable release separately, and opens the chosen release so signing status, checksums, assets, and update instructions stay visible. Stable builds recommend stable updates without hiding newer previews; release candidates follow the preview channel. The app never checks automatically or prompts on launch. Verification, launch, update, rollback, and uninstall belong in Desktop release bundles. Source setup and packaging are in Building from source.

Agents and integrations

The MCP server supports stdio and authenticated loopback HTTP. Its complete tool and schema contract is in AGENTS.md. See the LiteLLM integration and minimal MCP clients for working examples.

Privacy and trust boundary

• No quotabot account, hosted service, advertising, or telemetry.
• No model calls or reads of prompts, code, model output, or other user content.
• Local metadata stays local. Live adapters contact only provider quota or model-list metadata endpoints; Antigravity may perform required onboarding.
• CLI and desktop update checks read public GitHub release metadata only after the user invokes them. They send no quota, account, history, prompt, or code data. quotabot update installs one exact tag with its required checksum.
• Plain loopback HTTP reads pseudonymize email-shaped account labels unless the caller supplies the server's owner-only bearer token. The bundled LiteLLM router proves the identity of the exact loopback server connection before it sends that token, so exact account routing remains available without trusting whichever process happened to bind the configured port first.
• Routing fails soft, so callers can continue if quotabot is unavailable.

Run quotabot explain to inspect files and network destinations used by each adapter. The complete promises and verification methods are in Principles, Security, and Architecture.

Release and project status

The immutable v0.10.0 release is the stable promotion of the fully verified rc.17 inventory. Every release repeats native build, archive, checksum, provenance, fresh-download, install, upgrade, source-setup, and desktop-run checks. Current Windows and macOS artifacts remain unsigned transition artifacts, so the focused 0.10.x line must repeat that evidence with platform-signed artifacts before 1.0. The exact v0.10.0 release run and published install smoke are green. See the release evidence, roadmap, documentation index, contributing guide, and security policy.

Disclaimer

quotabot is independent and unofficial. Quota metadata is best-effort; verify billing and compliance against each provider. Provided "AS IS", without warranty, under the Apache License 2.0.