Platform features
Every dollar attributed. Every spike caught. Every report written for you.
Cognocient is a proxy that sits in front of every AI API call your application makes. One URL change gets you attribution, budget enforcement, automated waste detection, and board-ready reporting — with zero code changes beyond that.
Click through the platform
Illustrative previews of each view — not live customer data.
Every dollar, every team — in real time
Core platform
Change one URL. See every dollar.
Cognocient replaces your provider base URL with a proxy URL. Your existing OpenAI SDK client code — model names, message format, streaming — stays exactly the same, and the same format reaches Claude, Gemini, Bedrock and Vertex models.
Universal multi-provider proxy
One proxy key routes calls to any of 10 provider types, including AWS Bedrock, Google Vertex AI, and your own OpenAI-compatible servers. Your real provider API keys are encrypted at rest and never appear in your application code, logs, or API responses — only your Cognocient proxy key does, and it can be revoked independently at any time.
- OpenAI, Anthropic, Gemini, Azure OpenAI, Mistral, Groq, Together AI, AWS Bedrock, Vertex AI, custom endpoints
- Provider keys encrypted at rest, never exposed
- Proxy keys are revocable — no per-key spend cap, pair with a budget instead
Multi-dimensional attribution
Nine attribution headers slice every call by feature, department, user, session, tier, project, GL account, workload type, and business outcome — set once as default headers on your client, or per call.
- X-Cost-Feature, X-Cost-Department, X-Cost-User, X-Cost-Session
- X-Cost-GL-Account for chargeback and accounting
- Untagged calls surface as "untagged" — nothing silently disappears
Pre-call budget enforcement
Set a monthly limit scoped to global, department, feature, or user — checked atomically on every call, so the tightest matching ceiling always wins. Choose what happens when it's hit.
- Alert, Degrade (auto-downgrade model), or Block (429) — every mode on every plan
- 1 budget on Free, 3 on Base, unlimited on Growth and above
- Optional per-run spend limit for agent workflows, set at budget creation
Anomaly detection
A rolling 14-day hourly baseline per feature — not a fixed threshold that goes stale as usage grows. An hour at 2.5× or more of that baseline fires, with root-cause signals attached. A third detector watches the opposite signal: a spike in calls your own proxy is rejecting — catches an attack that gets mostly blocked (near-zero spend impact) and a fail-closed gate misconfigured tight enough to block legitimate traffic, either of which a pure spend detector would miss.
- Spend spikes, call-frequency spikes, and rejection-rate spikes
- Root-cause signals: prompt-length increase, new proxy key, model change
- Alerts by email on every plan, and to Slack on Base and up
Guardrails for agentic workflows
Stop a runaway agent before it hits the invoice
Per-call budgets can't catch a loop where every individual call looks reasonable. These guardrails operate on a faster or wider timescale than a monthly total.
Token- & dollar-velocity circuit breaker
Tracks both tokens-per-minute AND dollars-per-minute per proxy key on a sliding 60-second window. The dollar check exists because a flood of image/video generation calls can burn real money with barely any token footprint at all. Auto-trips at a fixed 10× the key's own rolling baseline in either dimension, or set manual caps for tighter, hard-number protection.
- Fixed 10x multiplier — not user-configurable
- Manual TPM and $/min caps available in Settings → Proxy Keys
- Every plan, including Free
Emergency Freeze
A one-click kill switch — every proxied call is rejected with HTTP 403 until you unfreeze, regardless of what any budget or plan says. For the moment a spend limit isn't the right tool: you suspect a compromised key or a runaway agent and need to stop everything right now.
- Self-service freeze and unfreeze, no support ticket required
- Optional auto-freeze on a velocity spike or high-risk signal — opt-in, off by default
- Available on every plan
Compromise Risk signals
Flags a proxy key suddenly called from a source IP or model family it has never used before — independent of cost anomaly detection, which can miss a compromise that stays cost-normal for a while. A chat-only key's first-ever image-generation call is treated as high severity.
- New-source-IP and new-model-family detection, per key
- Guarded against flagging a brand-new key's first few calls
- Base plan and above
Failure Loop Breaker
Catches what the velocity limit misses: an agent repeating the same tool call or hitting the same error back to back, without necessarily generating tokens fast enough to trip a TPM limit.
- Detects repeated tool calls and consecutive error streaks
- Independent of the token-velocity signal
- Growth plan and above
MCP / A2A workflow attribution
Track cost across multi-agent workflows end to end. Pass X-Cost-MCP-Server, X-Cost-Parent-Run-Id, and X-Cost-Agent-Handoff to see which agent called which tool and what it cost.
- Full workflow tree: parent run → child tool calls
- Per-run budgets via X-Cost-Run-ID work on every plan
- Business plan
Smart routing rules
Redirect a feature's calls from an expensive model to a cheaper one automatically — matched on feature and an optional token-count condition. Your application code keeps calling the original model name; the proxy rewrites it before forwarding.
- Apply directly from a waste-detection recommendation
- Pause a rule instantly if quality regresses — no deployment
- Growth plan and above
Cost intelligence & optimization
Find the waste. Fix it in one click.
Cognocient classifies every feature's spend, flags the specific patterns that waste money, and surfaces a fix you can apply without a deployment.
Investment vs. Waste classification
Every feature is classified as Investment, Waste, or left for you to review — starting from an automatic keyword-and-token-count heuristic, overridable with one click. See exactly how much is recoverable and where.
- Automatic classification, manual override preserved across re-analysis
- Waste Identified and Investment Protected summary totals
- Growth plan and above
Token Maxing Detector
Flags feature/model pairs where a frontier model (GPT-4o, Claude Opus, Gemini Pro) is producing completions averaging under 500 tokens — a classification-sized task on a flagship-priced model.
- Flags at 5+ calls averaging under 500 completion tokens
- One click creates a routing rule to the cheaper model
- Growth plan and above
Context Tax Analyser
Finds features with a low coefficient of variation in prompt size and a large average prompt — a signal of a mostly-static system prompt sent in full on every call, and a prime candidate for caching or compression.
- CV < 0.15 and average prompt over 500 tokens flags a candidate
- Distinct from context bloat — systematic overhead, not a one-off large call
- Growth plan and above
Exact + semantic response caching
Byte-identical prompts are cached and billed at $0.00. Semantically similar prompts — different wording, same question — are matched via a pgvector similarity search at a configurable threshold (default 0.95).
- Opt in with X-Cog-Cache; add X-Cog-Similarity-Cache for near-match hits
- Exact and semantic hits both appear in the call log at $0.00
- Growth plan and above
Prompt cache + batch routing recommendations
Detects features with stable, repetitive prompts and surfaces provider-native prompt-cache opportunities — Anthropic bills cache reads at about 10% of normal input, and OpenAI discounts cached input by an amount that varies by model. Flags high-latency or high-spend features as batch-API candidates at 50% off.
- Anthropic cache reads ~90% off; OpenAI discount varies by model
- Batch API: 50% off, up to 24h turnaround
- Growth plan and above
30/60/90-day spend forecast
A linear regression fit to your last 60 days of daily spend per feature, projected forward. Trend badges show which features are growing, stable, or shrinking, with a confidence bar based on how much history backs the projection.
- Per-feature 30/60/90-day projections
- Separate What-If Scenario Planner for growth modeling (Business)
- Growth plan and above
FinOps Maturity Score
A 0–100 score calculated in real time from your actual product usage, mapped to the FinOps Foundation's Crawl / Walk / Run model — with a specific next action shown for wherever you are.
- Crawl: attribution and visibility · Walk: budgets and enforcement · Run: governance and routing
- Recalculated on every dashboard load — not a survey
- Growth plan and above
Agentic Cost Simulator
Model how an agentic workflow scales your bill before you deploy it. Set an agent call multiplier (1× to 10×) and a flat monthly growth percentage on top of your real spend forecast — get a 30-day and 90-day projection plus a suggested budget.
- Requires 7+ days of real traffic to establish the baseline
- Growth applied as a flat multiplier, not compounded month over month
- Business plan
Outcomes, reporting & governance
Turn spend into a number your board believes
A raw spend total invites a budget cut. A cost-per-outcome number, a chargeback breakdown, and an AI-written narrative invite a budget conversation instead.
Cost per business outcome
Define an outcome — a resolved ticket, a drafted contract — then record events for it as they happen. Cognocient matches AI spend to those events by session or user, and shows the resulting average cost per outcome.
- Define once, record events via a simple API call
- Total Outcomes, Total AI Investment, Avg Cost per Outcome
- Growth plan and above
Board-ready PDF reports
Download an AI ROI Summary or a Full Detail report with an AI-written 150–200 word narrative in Board/CFO, Technical Finance, or Engineering tone. On Growth and up, have the AI ROI Summary emailed monthly, weekly, or on the last day of the month, with an optional approver who signs off before it goes out.
- AI ROI Summary and Budget vs Actuals on Base and up
- Scheduled email delivery with optional approval — Growth and above
- Written by whichever provider you've connected: Anthropic, OpenAI, or Azure
Chargeback & GL account mapping
Map each department to a GL account code once. Every call tagged with that department resolves automatically, so month-end chargeback is a CSV export, not a spreadsheet reconciliation.
- Generic CSV, NetSuite CSV, and FOCUS-aligned CSV export
- Per-department spend breakdown with top features
- Chargeback on Base and up; FOCUS export on Growth
Executive View
A CFO-level dashboard with unit economics and strategic spend insight — total spend, month-over-month trend, savings delivered, and the AI Efficiency Score, in one screen built for a five-minute pre-board-meeting check.
- AI Efficiency Score: cost per outcome in dollars, trended month over month — not a 0–100 score
- Designed to answer "what did we get for this AI spend?"
- Growth plan and above (Efficiency Score itself requires Business)
Shadow Spend Reconciliation
Every other protection here runs on traffic that passes through Cognocient's proxy. This is the one built for traffic that doesn't — a compromised provider account, or a raw API key called directly. Give Cognocient your provider's reported spend for a period and it's compared against what the proxy actually observed; a gap above your threshold — including the clearest case, spend the proxy never saw at all — raises an alert.
- Live daily pull from OpenAI and Anthropic; manual entry or CSV for other providers
- Dollar and percentage thresholds, both configurable, to avoid noise on small accounts
- Growth plan and above
AI Cost Advisor
Ask any question about your AI spend in plain English — “why did spend increase 40% last month?” — and get a data-grounded answer with reasoning shown, using your own connected AI provider key. It reads your call metadata and waste analysis, never your actual prompt or response content.
- Grounded in your real spend data, cost, and waste history
- Uses your own connected provider key — no separate per-query charge from Cognocient
- Business plan
Model access & routing
Any model, any cloud, right-sized per request
Reach the models you already pay for, wherever they run, and stop sending easy requests to your most expensive one.
AWS Bedrock, Vertex AI, and your own servers
Bedrock and Google Vertex AI are first-class providers, and any OpenAI-compatible server (Ollama, vLLM, LM Studio, a LiteLLM gateway) can be added as a custom endpoint. All of it is priced, attributed and budgeted like every other provider.
- Bedrock: Converse API with streaming and tool calls, signed with SigV4
- Vertex AI: routed with a vertex/ prefix, service-account auth
- Custom endpoints: public HTTPS only, checked against server-side request forgery; tracked at $0 unless you set your own rates
Auto Router
Send one model name. Each request is classified as simple, medium, complex or reasoning, and routed to the model you chose for that tier, mixing providers if you like. The classifier runs inside the proxy with no extra LLM call, so it adds no cost and the same request always routes the same way.
- Every response says which tier and model were used, and why
- Keyword overrides, and X-Cost-Priority to pin a call to your strongest model
- Savings measured per call against your most expensive tier model
One OpenAI-shaped API, translated for you
Your code keeps using the OpenAI client. Cognocient translates to Anthropic and Bedrock formats and back, including system prompts, image parts, tool calls, and streaming with usage reporting.
- Streaming and tool calls work on Anthropic, Bedrock and Vertex
- Provider errors pass through unchanged
- Cross-provider failover on timeout, 429 or 5xx (Growth and above)
Prometheus metrics endpoint
Scrape month-to-date spend, requests, tokens, latency and budget utilisation into Prometheus, Grafana Cloud or any compatible tool, and alert on AI spend next to the rest of your infrastructure.
- Per provider, model and feature, with a hard cardinality cap
- Bearer-key authentication; a standard scrape config
- Available on Growth and above
OpenAI Responses API
POST /v1/responses works on every provider, including streaming, function tools and structured output. Requests run through the same pipeline as chat completions, so budgets, guardrails, routing and cost tracking apply unchanged.
- Point client.responses.create at Cognocient with a one-line base-URL change
- Stateless: previous_response_id and OpenAI-hosted tools return a clear error
- Available on every plan
Load balancing
Define one model name that spreads requests across several models or providers: weighted, round-robin, or always the cheapest. Deployments that keep failing are skipped automatically, and every response says which one served it.
- Mix providers, including Azure, Bedrock, Vertex and self-hosted endpoints
- Skips a deployment after repeated 429, timeout or 5xx errors, then retries it
- Available on Growth and above
Langfuse and OpenTelemetry export
Send every call to Langfuse or any OTLP backend, with cost, tokens, latency and your attribution tags, so AI spend sits next to the rest of your telemetry. Delivery is asynchronous and never slows a call.
- Cost and usage only; prompt and response text are never sent
- Credentials encrypted at rest; destinations must be public HTTPS
- Available on Growth and above
Audio, rerank and batch endpoints
Transcription, translation, speech, rerank and the OpenAI Batch API through the same proxy, with the same budgets, guardrails, freeze and cost tracking as chat. Each response says how its cost was derived.
- Whisper and gpt-4o-transcribe, TTS, and Cohere, Jina and Voyage rerank on every plan
- Batches are costed once, at the discounted price, to the tags you created them with (Growth and above)
- No unpriced surprises: an unknown model is estimated visibly, never recorded as zero
Multi-key balancing
Add several API keys for one provider and requests spread across them by weight, so a single key\'s rate limit stops being your ceiling. A key that keeps hitting limits is skipped for a short while.
- Health comes from real traffic, with no synthetic probes
- Keys are encrypted and write-only; only the last four characters are shown
- Available on Growth and above
MCP gateway
Put your MCP servers behind Cognocient. Agents connect to a gateway URL, and every tool call is authenticated, checked against a tool allow or deny list, scanned for sensitive arguments, budgeted and attributed.
- Forbidden tools are refused and hidden from the agent\'s tool list
- Logged with server, tool and an argument hash, never the arguments themselves
- Available on Business
For engineering teams
Catch cost regressions before they ship
Cost belongs in the development loop, next to tests and latency, not in next month's invoice review.
CI cost gate
Run your test suite through Cognocient with a run id, then one HTTP call compares that run with a baseline and fails the build if cost went up more than you allow. Catch a context blow-up or a pricier model in the pull request, not on the invoice.
- Total or per-call comparison, optional per-feature and absolute limits
- GitHub Actions snippet included; works from any CI
- Available on Base and above
Environments
Tag calls with X-Cost-Environment and see how much of your AI bill is production and how much is staging, CI and evals. Put a hard budget on CI so a runaway test loop cannot eat production's headroom.
- Spend, share, tokens and errors per environment
- Environment-scoped budgets: alert, degrade or block
- Available on every plan, including Free
Experiments: cost by variant
Tag calls with X-Cost-Variant and compare prompt versions, models or environments side by side on your real traffic: cost per call, tokens, latency, error rate and, if you track outcomes, spend per outcome.
- Pick a baseline; every other variant shows its change
- Compares cost, not answer quality: prompts and responses are not in the call log
- Available on Growth and above
MCP server for your spend
Connect Claude Code, Cursor or any MCP client and ask about spend, budgets, variant comparisons and CI results in plain language. Read-only: it can answer questions but cannot change anything.
- Six tools over your live data, authenticated with a proxy key
- One command to add it to Claude Code
- Available on Base and above
Saved views & custom charts
Build the charts your team keeps asking for from any metric, split and filter, save them for everyone and pin them to the Overview.
- Spend, calls, tokens, cost per call, error rate, p95 latency
- Split by feature, model, environment, variant, user and more
- Available on Growth and above
Enterprise security & access
Give the right people the right access, and prove it
Cognocient now runs the controls a security review asks for: single sign-on, least-privilege roles, and a trail of who did what.
Single sign-on (SAML 2.0)
Your team signs in with your identity provider: Okta, Microsoft Entra ID, Google Workspace, or any SAML 2.0 IdP. Domains only route to your IdP after you prove you own them with a DNS record, and you can require SSO for every member.
- Just-in-time provisioning into your organization with a default role you choose
- Require SSO for all members; the owner keeps break-glass access so a misconfigured IdP cannot lock you out
- Business plan
Role-based access control
Five roles (Owner, Admin, Developer, Finance, Viewer) enforced on every API call from one reviewable policy. Anything new defaults to admin-only, and only the owner can grant the admin role.
- Finance manages budgets and chargeback but not provider keys or routing
- Developers manage keys and routing but not team, billing or provider credentials
- Proxy keys cannot manage team, billing, SSO, provider keys, or other keys. Every paid plan with team seats
Audit log
A searchable record of who changed what and when: role changes, provider keys, budgets, routing, SSO, data exports, and every denied attempt, with actor, role, IP and result. Request contents are never stored, so secrets can't leak through it.
- Filter by action, actor and date; export to CSV (formula-injection safe)
- Exporting the log is itself logged
- Business plan
Hardened by default
The controls behind the controls: provider keys encrypted at rest, endpoint URLs checked against server-side request forgery on every request, and DNS-verified domains so nobody can claim yours.
- Customer-supplied URLs must be public HTTPS; private and cloud-metadata addresses are rejected
- Denied and out-of-policy attempts are recorded
- Consumer email domains (gmail.com and similar) can never be claimed for SSO
SCIM user provisioning
Okta, Microsoft Entra ID or another SCIM 2.0 identity provider creates, updates and removes your team automatically. Deprovisioning ends access immediately, and a removed person cannot sign back in through SSO.
- Users, role groups and both vendors\' PATCH formats, with seat limits enforced
- SCIM can never grant the admin role; only the account owner can
- Every change is written to the audit log. Business plan
JWT authentication
Call the proxy with short-lived tokens from your own identity provider instead of long-lived API keys. Claims such as user, department and project become cost attribution automatically.
- Asymmetric algorithms only; none and HMAC are rejected, closing algorithm-confusion attacks
- Issuer, audience and expiry enforced, with signing keys fetched safely from your JWKS URL
- Limits, budgets and the Emergency Freeze apply as for any key. Business plan
Provider keys in your own vault
Keep provider API keys in AWS Secrets Manager, HashiCorp Vault or Azure Key Vault. Cognocient fetches them at request time and never stores them, so your security team keeps custody and rotation.
- Held in memory for five minutes, never logged or returned
- If the vault is unreachable the call fails clearly; it never falls back to a stale key
- Business plan
Works with every major AI provider
Vs. the alternatives
Built for finance teams. Not just engineering.
Tracing tools record what happened, and gateways route traffic. These are the parts built for whoever owns the budget, and the plan each one starts on.
Capability
Starts on
Comparing against a specific tool? See Why Cognocient for named, line-by-line comparisons.
Try it yourself — no signup required
What does your own AI workload actually cost?
Pick a model, enter your call volume and token counts, and the AI Inference Cost Calculator shows your monthly bill, cheaper model alternatives, and estimated caching and batch-routing savings — free, before you connect any real traffic.
Frequently asked questions
Do I need to change my application code to use Cognocient?
Just one line: point your OpenAI SDK client's base_url (or any OpenAI-compatible client's) at the Cognocient proxy. Claude, Gemini, Bedrock and Vertex models are reached through that same OpenAI format. Everything else — attribution, budgets, caching — is opt-in via request headers, not a rewrite.
Does routing through the proxy add latency?
The proxy adds attribution, budget, and velocity checks before forwarding your call — the checks themselves are fast, but they run in addition to the provider's own response time. If Cognocient's own budget-check layer becomes unreachable, calls fail open and reach your provider unaffected rather than being blocked.
What happens if Cognocient goes down?
Two cases. If Cognocient's budget-check layer is unreachable, it fails open: calls pass through to your AI provider and you temporarily lose cost visibility and enforcement, not your application. If the proxy itself is unreachable, calls sent to it fail like any other API outage, so add a client-side fallback to your provider's URL for critical paths, or use the Python wrapper, which never sits in the request path. See /docs/reliability.
Does Cognocient store my prompts or responses?
No. Cognocient stores call metadata — token counts, model, feature tag, cost, latency — not prompt or response content. The one exception is response caching, which you opt into per request: a cached response is stored so it can be replayed.
Which features require which plan?
Attribution, environments and environment budgets, budgets (1 on Free), Emergency Freeze and the velocity breaker are on every plan, including Free. Waste detection, chargeback, reports, role-based access control, the CI cost gate and the MCP server for your spend data start on Base. Experiments (cost by variant), saved views and custom charts, routing rules, the Auto Router, load balancing, multi-key balancing, the Batch API, semantic caching, Langfuse and OpenTelemetry export, the Failure Loop Breaker, the live Shadow Spend billing pull and the Prometheus endpoint require Growth. The AI Cost Advisor, the Agentic Cost Simulator, MCP/A2A attribution, single sign-on, the MCP gateway, SCIM, JWT authentication, secret-manager keys and the audit log require Business. See the full breakdown on the pricing page.
Does Cognocient support single sign-on and role-based access?
Yes. Business includes SAML 2.0 single sign-on (Okta, Microsoft Entra ID, Google Workspace, or any SAML identity provider) with DNS-verified domains and an optional require-SSO policy, plus a searchable, exportable audit log. Role-based access (Owner, Admin, Developer, Finance, Viewer) is enforced on every API call on every plan with team seats.
Can I use AWS Bedrock, Vertex AI, or a model I host myself?
Yes. AWS Bedrock and Google Vertex AI are supported providers, and any OpenAI-compatible server (Ollama, vLLM, LM Studio, a LiteLLM gateway) can be added as a custom endpoint and reached with model=custom/<name>. Custom endpoints must be public HTTPS URLs because Cognocient calls them from the cloud.
How do I put a hard cap on all AI spend, not just a budget limit?
Emergency Freeze — a one-click kill switch on every plan that blocks all proxied calls immediately, regardless of any budget or enforcement mode. It can also trigger automatically on a spend-velocity spike or a high-severity compromise signal if you opt in, off by default.
Can Cognocient catch AI spend that never goes through the proxy?
Shadow Spend Reconciliation compares what your provider actually billed against what Cognocient's proxy observed for the same period, and alerts on the gap — the only way to catch a compromised provider account or a raw API key called directly, since nothing inline can see traffic that never reaches the proxy. For OpenAI and Anthropic it pulls the provider's actual daily cost live with an admin key; other providers use manual entry or a CSV upload of the reported spend.
Get started today
Try every feature free for 10 days.
Full access, no credit card, no sales call. Afterwards you stay on the Free plan on one provider unless you choose a paid plan.