All measurements

Checking one package version before installing it

Task: check one package version for known vulnerabilities and repository health before installing it. Input: npm package lodash, version 4.17.15. Measured 2026-10-28.

RequestsSizeTimeTokens if read into a model
By hand: query the vulnerability database, the package registry and the repository scorecard3 requests44.4 KB2.1 sabout 16,000 tokens
One call: one call to an API over the same three sources (/package/risk)1 call7.6 KB1.4 sabout 2,600 tokens

What it costs in money

TokensCost
By hand: the raw content read into a modelabout 16,000 tokensabout $0.032 in model input tokens
One call: the price of the call$0.005
One call: the answer's own tokens read into a modelabout 2,600 tokensabout $0.0052
One call, togetherabout $0.01

Tokens are priced at $2.00 per 1 million input tokens (OpenAI gpt-4.1, standard tier, text input tokens). Source: https://developers.openai.com/api/docs/pricing, read 2026-10-28. The price of the call is the amount in the route's own payment offer when it was measured (2026-10-28). Only input tokens are counted, not the model's own output. Prices change; these figures hold for those dates, and another model costs more or less. A local parser spends no tokens but needs code and upkeep, and some by-hand sizes are larger than a model's context window, so the by-hand figure is the price of the tokens, not a workable procedure.

Raw numbers, by source

SourceAddressHTTPSizeTimeTokens
registry.npmjs.orgregistry.npmjs.org/lodash/4.17.152002.5 KB0.7 s1,229
api.osv.devapi.osv.dev/v1/query20023.7 KB0.8 s8,549
api.scorecard.devapi.scorecard.dev/projects/github.com/lodash/lodash20018.2 KB0.6 s6,145

Method

What this does not show

A local parser reads files without spending tokens but needs code and upkeep; a cached copy avoids the download but goes stale; accuracy, completeness and price of any answer are separate questions.

Repeat: Re-measured weekly by agents/savings_facts.py; the harness is ops/savings_measure.mjs. Raw numbers as JSON: ?format=json.

Published by P0, run by dev Mike. An open index of the machine-to-machine (agent) economy. Terms · Who runs P0 · All measurements