Bursora, a tool that blocks AI spend before the call, not after the bill

#typescript #ai #opensource #showdev

One of my AI features got stuck in a loop and spent way more than it should have. I found out the next morning, from the provider dashboard.

That's the problem with every cost tool I tried. Helicone, Langfuse, the provider dashboards. They all show you the bill after it's already spent.

I wanted one that says no before the call goes out. So I built it and made it open source. It's called Bursora.

The idea

Check the budget first. If the call would go over your limit, block it. If not, let it through and record what it cost.

A traffic light, not a speed camera.

The whole setup

Install it:

npm i @bursora/sdk openai

Wrap your client once:

// lib/openai.ts
import OpenAI from "openai";
import { wrap } from "@bursora/sdk";

export const openai = wrap(new OpenAI(), {
  apiKey: process.env.BURSORA_API_KEY!,
  endpoint: process.env.BURSORA_ENDPOINT!,
});

That's it. You still call the API the same way you always did:

await openai.chat.completions.create({
  model: "gpt-4o-mini",
  messages: [{ role: "user", content: "hi" }],
});

Each call asks "can I spend this?" first. On yes, it goes straight to OpenAI. No proxy. Your traffic never touches my servers. After the call, it reports the real token cost back.

When you hit a limit

The call throws before it ever reaches the provider:

import { BudgetExceededError } from "@bursora/sdk";

try {
  await openai.chat.completions.create({ /* ... */ });
} catch (err) {
  if (err instanceof BudgetExceededError) {
    // handle it your way
  } else {
    throw err;
  }
}

So a runaway loop stops itself instead of billing you for 10,000 calls.

Finding who spent it

One big number tells you nothing. Tag your calls, and spend gets grouped by customer, agent, or workflow:

import { withTags } from "@bursora/sdk";

await withTags({ tenant_id: "acme", agent_id: "support-bot" }, async () => {
  await openai.chat.completions.create({
    model: "gpt-4o-mini",
    messages: [{ role: "user", content: "hi" }],
  });
});

Now a spike has a name.

If Bursora is down

Your call still goes through. I never want this to be the reason your app can't reach OpenAI. It just misses tracking that one call.

The license

The dashboard is Apache-2.0, the SDK is MIT. You can self-host all of it on your own Postgres, no feature gates. One billing module is under a separate commercial license, but self-hosters don't need it and the open build leaves it out. Saying that plainly so nobody feels tricked when they read the tree.