LiteLLM

Nobody Audits Their OpenAI Invoice

Teams running LLMs in production commonly see a mismatch between their tracked usage and the provider invoice. Causes include different provider accounting for cached tokens (OpenAI folds cache reads into input tokens while Anthropic separates cache fields), community pricing registries that are explicitly estimates, untracked API calls, and tooling heuristics that treat ~10% gaps as normal. The author surveys reconciliation options—trackers, gateways, cloud spend platforms, enterprise audits, DIY with provider cost APIs—and describes Kenda, an early product to reconcile logged LLM events against provider billing and surface per-line deltas and residuals.

OpenRouter: One API Key for All Models

OpenRouter is a unified API gateway for large language models that lets developers use a single API key and a single credit balance to access 300+ models across multiple providers. It normalizes responses into an OpenAI-compatible format, offers provider fallback and an auto-router mode for selecting free models, and integrates with OpenAI-compatible tools like OpenCode. The service provides a free tier (around 29 rotating free models, 50 requests/day without credits, 1,000/day after first top-up) and a pricing model that charges a flat 5.5% fee on credit purchases while passing provider token prices through at cost. There is a 5% usage fee for BYOK routing beyond 1 million requests/month.

MCP readOnlyHint Flaw Enables Agent Tool RCEs

The article analyzes a design-level security flaw in the Model Context Protocol (MCP): the readOnlyHint metadata field is an unenforced hint that servers can falsify, allowing malicious MCP servers to advertise destructive tools as "read-only." An ecosystem-wide audit found zero of eight major frameworks validate tool declarations at runtime, and the readOnlyHint issue compounds with transport risks (notably unsafe STDIO transports) to enable remote code execution chains. The author lists multiple high-severity CVEs discovered across frameworks (CrewAI, Microsoft AutoGen, AG2, LlamaIndex, Haystack, LiteLLM, Anthropic SDK, and others), demonstrates a code-level bypass, and proposes a security checklist and runtime call verification (Correctover CCS) as the practical mitigation until protocol-level attestations and verification hooks are standardized.