Skip to main content
Glama

Investigate Cost Spike

investigate_cost_spike
Read-onlyIdempotent

Compare recent LLM spending with a baseline and rank the models or services contributing most to the spike.

Instructions

Investigate an LLM cost spike: compare a recent window against a baseline and rank which models/services contributed most to the change.

On-request/pull-based analysis, not a push alert - mirrors SigNoz's own "investigate telemetry cost" skill. Call this when you suspect (or want to check for) a cost increase, rather than polling get_llm_usage by hand.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of traces to analyze per window (default: 1000)
top_nNoMaximum ranked contributors to return per breakdown (default: 5, max: 50)
recent_endYesRecent window end time in ISO 8601 format
baseline_endNoBaseline window end (ISO 8601)
recent_startYesRecent window start time in ISO 8601 format
service_nameNoFilter by service name (applied to both windows)
gen_ai_systemNoFilter by LLM provider (applied to both windows)
baseline_startNoBaseline window start (ISO 8601). If omitted along with baseline_end, auto-computed as the same duration immediately preceding recent_start.
gen_ai_request_modelNoFilter by requested model name (applied to both windows)
gen_ai_response_modelNoFilter by actual model used (applied to both windows)

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed10 schema fields changedv0.11.0
    • addedInput schema / properties / baseline_end / description
      Added value: +"Baseline window end (ISO 8601)"
    • addedInput schema / properties / baseline_start / description
      Added value: +"Baseline window start (ISO 8601). If omitted along\nwith baseline_end, auto-computed as the same duration\nimmediately preceding recent_start."
    • addedInput schema / properties / gen_ai_request_model / description
      Added value: +"Filter by requested model name (applied to both windows)"
    • addedInput schema / properties / gen_ai_response_model / description
      Added value: +"Filter by actual model used (applied to both windows)"
    • addedInput schema / properties / gen_ai_system / description
      Added value: +"Filter by LLM provider (applied to both windows)"
    • addedInput schema / properties / limit / description
      Added value: +"Maximum number of traces to analyze per window (default: 1000)"
    • addedInput schema / properties / recent_end / description
      Added value: +"Recent window end time in ISO 8601 format"
    • addedInput schema / properties / recent_start / description
      Added value: +"Recent window start time in ISO 8601 format"
    • addedInput schema / properties / service_name / description
      Added value: +"Filter by service name (applied to both windows)"
    • addedInput schema / properties / top_n / description
      Added value: +"Maximum ranked contributors to return per breakdown (default: 5, max: 50)"
  2. Addedv0.8.1

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior, so the lower bar is appropriate. The description adds meaningful behavioral context beyond annotations: it is on-request/pull-based, not a push alert, and it performs a comparative analysis rather than a simple fetch. It does not discuss rate limits or auth, but nothing in the context suggests those are needed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two compact sentences with the core purpose front-loaded. The second sentence earns its place by giving invocation guidance and an explicit alternative. There is no redundancy or filler; even the SigNoz reference is a brief provenance cue that helps an agent recognize the expected behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and full parameter documentation in the input schema, the description does not need to restate return values or syntax. It provides the selection context, the pull-based behavior, and the trigger condition. It could more explicitly differentiate from compare_time_windows, but that is a minor gap given the strength of the structured fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% parameter description coverage, so the baseline is 3. The description adds a useful high-level framing of comparing windows and ranking contributors, but it does not add parameter-level detail beyond what the schema already provides. That is acceptable because the schema carries the load here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific task (investigate an LLM cost spike), a concrete method (compare recent window against a baseline), and a distinct output (ranked contributors). It clearly separates itself from raw usage polling via get_llm_usage and from error-focused investigation via investigate_error_spike.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit trigger condition: 'Call this when you suspect (or want to check for) a cost increase'. It also names the alternative approach it replaces ('rather than polling get_llm_usage by hand') and clarifies it is pull-based, not a push alert, so an agent knows when it is appropriate to invoke.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.