I had the same suspicion so made this to examine where my tokens went.
Claude code caches a big chunk of context (all messages of current session). While a lot of data is going through network, in ccaudit itself, 98% is context is from cache.
Granted, to view the actual system prompt used by claude, one can only inspect network request. Otherwise best guess is token use in first exchange with Claude.
I had the same suspicion so made this to examine where my tokens went.
Claude code caches a big chunk of context (all messages of current session). While a lot of data is going through network, in ccaudit itself, 98% is context is from cache.
Granted, to view the actual system prompt used by claude, one can only inspect network request. Otherwise best guess is token use in first exchange with Claude.
https://github.com/kmcheung12/ccaudit
I got kinda obsessed with observability a month ago and wired together a full stack for personal use.
https://github.com/simple10/agent-super-spy - llm proxy + http MiTM proxy + LLMetry + other goodies
https://github.com/simple10/agents-observe - fancier claude hooks dashboard
It started as a need to keep an eye on OpenClaw but is incredibly useful for really understanding any agent harness at the raw LLM request level.
What is the system prompt for $1000 Alex (RIP)?
a git status + "recent commits" (that will _always_ change) https://github.com/anthropics/claude-code/issues/47107
and a missing cache-mark that will make skills & project-claude.md cachemiss every time too https://github.com/anthropics/claude-code/issues/47098
I don’t buy it. The same problem was reported in Claude.ai at the same time which means same underlying root cause.