Cloudflare Cost Guard: a read-only agent skill for runaway-billing audits
Layer Cache’s open-source agent skill, announced by Domenico (@purposelyblnk), audits a Cloudflare codebase from source alone for paths that can run up uncontrolled billable usage, and reports findings without changing code or calling Cloudflare.
- Products
- WorkersDurable ObjectsQueuesD1
- Source
- Community resourceGitHub repository
- Author
- Layer Cache / Domenico (@purposelyblnk)
Key points
- SKILL.md frames the audit around Workers Paid, where the monthly subscription is a minimum charge rather than a spending limit. It runs read-only from source code, needs no Cloudflare credentials, and forbids deploying, running project scripts, triggering crons, alarms or queues, or opening secret files.
- It inventories bindings, triggers and public hostnames (including workers.dev and preview URLs, which zone WAF and rate-limiting rules do not cover) plus every table or key prefix the code writes, then traces each lead from handler to billable operation and classifies it as autonomous, externally drivable or credential-gated.
- Patterns it looks for include self-rescheduling Durable Object alarms, queue re-enqueue loops, recursive Worker fetches, unbounded retries, D1/KV/R2 write amplification, hot queries over growing data, and repeating jobs that never save their progress. Only autonomous and unbounded paths start at Critical.
- Exposure is stated as operation counts times a documented rate, with the rate’s source and date; the skill never adds these into a predicted invoice. Its dashboard checklist says budget alerts and usage notifications only send email and do not stop usage, and that Workers Paid has no hard spending cap.
Original sources
Original source · Last updated
Open original sourceThe author writes that the $5 plan has no spending caps and lists patterns he found in public runaway-bill reports: Durable Object alarms scheduled on Date.now(), queue workers calling themselves and creating new jobs, and cron jobs that never save progress and rewrite the same rows; he built the cost guard skill in response.
Read on 𝕏Domenico
@purposelyblnk · Original 𝕏 post
600 alarms a second from a line of code Cloudflare $5 plan is undisputable value, but it has no spending caps right now. I went through public reports of runaway bills and found some patterns > Durable Object alarms scheduling their next run on https://t.co/IBLcQv6OHL > Queue workers calling themselves which creates a new job instead > Cron jobs which never save their progress, so every run writes the same rows again Cloudflare made this right, but you’re one deploy away from vibe bankruptcy. I’m building on Cloudflare, so I decided to make a cost guard skill to help prevent a nightmare. Link below 👇 Which one is going to get you?
In the follow-up reply the author posts the skill’s skills.sh listing link.
Read on 𝕏Domenico
@purposelyblnk · Original 𝕏 post
Check yourself before you wreck yourself https://t.co/iNC3fPYe0X
More to read
How I keep Cloudflare under $5: where surprise bills come from
Ashish Sharma (@sarmaasis) runs several sites on the $5 Workers Paid plan and lists, product by product, the usage patterns he says quietly run up a Cloudflare bill, ending with a 12-item checklist.
A 12 MB D1 database, a reported USD 1,966.35 invoice.
@imselmon reports a USD $1,966.35 D1 invoice for a roughly 12 MB database with over two billion row writes. The author says the activity is abnormal and is investigating the database usage.
Cloudflare Medivh: a self-hosted near-real-time bill estimator
An open-source, self-hosted monitor that adds today’s estimated usage cost to Cloudflare’s daily-updated billable usage, sends summaries, and calls a webhook when the current cycle crosses a budget.