by nickelsec
Claude Code, Codex and Pi write down everything you do. bough draws it and prices it: a day, the work inside it, every prompt, and what each piece cost. One Go binary, runs on your machine, sends nothing anywhere.
# Add to your Claude Code skills
git clone https://github.com/nickelsec/boughLast scanned: 9/15/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-09-15T09:14:29.263Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how bough compares with popular alternatives.
bough is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by nickelsec. Claude Code, Codex and Pi write down everything you do. bough draws it and prices it: a day, the work inside it, every prompt, and what each piece cost. One Go binary, runs on your machine, sends nothing anywhere. It has 117 GitHub stars.
Yes. bough passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/nickelsec/bough" and add it to your Claude Code skills directory (see the Installation section above).
bough is primarily written in Go. It is open-source under nickelsec on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh bough against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Not how long your streak is. Claude Code's own /stats covers that. This
answers a different question: what did you build, and what did each piece of
it cost?
Usage tools stop at a session, and a session is a hash that can cover weeks of unrelated work. bough works out where one piece of work ends and the next begins, so the money lands on things you recognise: that feature, that afternoon lost to one bug.
bough
That is the whole thing. It finds your projects and opens them in your browser, a card for each with your time at the keyboard and what it cost. Search them, narrow them to one agent, or sort by time or cost, then click one to open it. Projects, at the top left, takes you back.
Inside a project you get a diagram of your own work. A square on the line is a sitting, labelled with the day, the time you started and how long you were at the keyboard. Smaller squares hanging off it are the tasks inside that sitting. Every circle is a single prompt you typed.
Hover anything and the path back to its day lights up, with a note saying what it was. Click it and the full record opens beside the drawing, scrolled to the exact prompt, in your own words and untrimmed. Work that went badly is drawn in rust rather than green.
A task carrying a small mark is one that ended in a commit, and the note gives you the hash and the message. Everything else in the drawing is worked out from your history; this is the part you can go and check.
Dotted lines can join sittings that went back to the same files, so work picked up again later can be followed across the gap. On a long project there are a lot of them, so they start hidden, and "What to show" in the rail turns them on.
Behind each task is a faint circle, sized by what that piece of work was charged. Hover it and the note breaks the figure down, in tokens and in dollars; the coins in the rail open the whole table, every day and every task, in the columns the agents themselves report. Most of it is the model re-reading the conversation, which is why a long discussion can cost more than a hard piece of engineering.
Following the figure on a record opens that table at that piece of work rather than at the top, and the rail will narrow the drawing to whatever passed a threshold you set, in dollars or in any of the token counts. The rates are published ones, built into the binary rather than fetched, so this works with the network unplugged like everything else here.
To get those right, bough also reads the git history of the project it is
describing, at the path your transcripts already name. That is a read and
nothing else: no writes, no network, no remote. It only ever looks at a
repository already on your disk, so whether it is private on a host somewhere
makes no difference. --no-repo turns it off, and a project that has moved or
was never a repository simply carries on without it.
The count may not match the number your host shows, and bough says so where it
is written. It counts what the agent did; git log holds what survived. A
commit you typed in a terminal never reaches your history, an amend is one
event more than the history keeps, and a rebase drops commits that really
happened.
The page is served from 127.0.0.1 and nothing else can reach it. Everything it needs is inside the binary, so it keeps working with the network unplugged.
macOS:
brew install nickelsec/tap/bough
Linux, or macOS without Homebrew:
curl -fsSL https://www.bough.run/install.sh | sh
Windows:
irm https://www.bough.run/install.ps1 | iex
Those scripts work out the newest release, check what they downloaded against
the published checksums, and put one binary on your path. Running the same
line again is how you upgrade. Homebrew is the exception, since brew install
on something already installed stops and says so: use
brew upgrade nickelsec/tap/bough.
If you would rather not pipe a script into a shell, every build is on the
releases page with a
checksums.txt beside it: unpack it and put bough anywhere on your path.
With Go, if you have it:
go install github.com/nickelsec/bough/cmd/bough@latest
Or build it yourself:
git clone https://github.com/nickelsec/bough
cd bough
go build ./cmd/bough
One dependency, golang.org/x/term, for reading arrow keys.
Add --text and the same work comes back as an indented list:
$ bough bough --text
bough
=====
~/code/bough
486 prompts across 27 sittings
469 changes to 236 files, 32 hours at the keyboard
84 commits
2.8M written, 2.0B re-read: 730x more context than output
claude-opus-5
$1232.80 at API rates, priced Sep 2026
------------------------------------------------------------------------
31 Aug to 1 Sep Before we move further a small change the product will be...
16:57 4 tasks, 40 prompts, 4 hours
kept coming back to hovercheck.js (5 times, 52 lines)
Before we move further a small change the product will be...
14 prompts, 5 failures, an hour and 29 minutes, 131k written, 420x context, $34.77
28d4930 Rename the project to bough
c541dd9 Implement the Claude Code source, and make it cheap to read
That figure is what the work would have cost at published API rates. It is not a receipt: a subscription is flat rate, and the transcript does not say which you were on.
Anything piped or redirected is written as text automatically, so
bough > notes.txt and bough | less behave as you would expect rather than
opening a window.
bough project-one open a project by name
bough --pick choose a project in the terminal, then open it
bough --text write to the terminal instead
bough --list show every project with history
bough -v include every prompt in the text view
bough --json write the graph as JSON
bough --no-repo leave the project's git history unread
bough --agent=pi read one agent only: claude, codex, pi, or all
bough -o notes.txt write to a file instead of standard output
bough --root DIR read history from here instead of the usual place
bough project-one --rename "Portfolio site"
give a project a name of your own; "" gives the folder's back
--json gives you the whole structure to do something else with. It carries no
colours, sizes or positions, only what is true about the work; the page works
those out for itself.
Everything happens on your machine. Nothing is sent anywhere, no model is called, and everything bough opens, your history and your repository alike, it only ever reads.
A project is named after its folder, and when that name is no help, which is
often the case with the folders Codex names after your first prompt, you can
give it one of your own, with the pencil beside its name or with --rename.
The name is kept in bough's own settings folder
(%AppData%\bough on Windows, ~/Library/Application Support/bough on a Mac,
~/.config/bough elsewhere), so updating bough keeps it. It belongs to the
folder, so moving the folder loses it, and the old name still finds the
project.
Claude Code, Codex and Pi keep a transcript of every session. Those transcripts hold the shape of what you built, and nothing surfaces it. bough reads them and rebuilds three levels:
Prompts are what you typed, with the files and failures that followed.
Tasks are runs of prompts working towards one thing. Where one ends and the next begins is worked out from how long you paused, where the agent compacted its context, and whether you changed both subject and files at once.
Sittings are the days, or the parts of one. People stop for the night and come back to something else, and that turns out to be a better guide to what belongs together than anything cleverer. Two sittings can fall on the same date, which is why each one also says when it started.
It also notices when a sitting picked up work from an earlier one, and which file you kept going back to, and how much of that file actually changed each time. Coming back nine times to fix a typo is not the same as coming back nine times to rewrite it.
What it cost is carried per task as well as per project, which is the part no other tool can give you: a session id is the finest grain they have, and one of those covers weeks of unrelated work. Most of the figure will be the model re-reading the conversation rather than writing anything: on the histories this was built against, between 176 and 732 times more context than output. A long session is expensive because it is long, not because the model said much.
Claude Code, OpenAI Codex CLI and Pi. All three are found automatically, and a project worked on with any of them shows up in the same list.
bough --agent=clau