# Claude Code

The Claude Code dashboard has five tabs: **Overview**, **Cost**, **Usage**, **Users**, and **[GitHub repos](#github-repos)**. Every figure is derived from Claude Code's own usage metrics over the time range and filters you've set.

The **[GitHub repos](#github-repos)** tab ties every session's cost and code impact to the repository it actually touched, then splits managed company repos from unmanaged personal ones — so you can see what each repo is getting for the spend, catch company IP being built in personal projects, and keep the Code Agents license funding work the company actually owns.

Before the dashboard shows data, set up the integration — see [Connect Claude Code](https://coralogix.com/docs/integrations/ai-observability/claude-code/index.md).

## Overview

A snapshot of who's using Claude Code, what they're running, and what it's costing — models in use, total sessions, token usage, estimated cost, the highest-cost model, the average cost per session, your power user, and how many unique users were active.

## Cost

Built to answer one question: where is your Claude Code spend going, and where can you cut it?

- **Total cost** and **Cost change** — spend for the period, and how it compares to the previous equal period.

- **Avg cost per session** — a quick read on how expensive a typical session is.

- **Cache hit rate** — how much of your input is served from cached context. The single biggest lever on input-token cost.

- **Token breakdown** and **Cost over time** — what's driving the bill and when spend spiked.

- **Cost by model** — cost, share, cache hit rate, and effective cost per million tokens for each model.

- **High-spending users** — top spenders by cost, share, and tokens — the starting point for a usage conversation.

- **Optimization insights** — ranked, metric-based suggestions for cutting spend; each card links to the widget it relates to.

## Usage

- **Activity** — total sessions and sessions over time.
- **Code impact** — commits, pull requests, lines of code, and the share of AI suggestions accepted by developers.
- **Productivity ratio** — split of human vs. Claude activity. A higher Claude share means more output came directly from the agent.
- **Top used tools** — the tools Claude invoked most across sessions.

## Users

Active users ranked by cost, with sessions, tokens, lines of code, commits, PRs, and models per user. Select any row to drill into that user's session activity, token consumption, code impact, and model usage over time.

## GitHub repos

See not just how much Claude Code is costing you, but what each repository is actually getting out of it. The **GitHub repos** tab on the Claude Code dashboard attributes every per-session signal — cost, tokens, code impact (lines of code, commits, pull requests), models invoked, session counts, and the developers behind them — to the repositories Claude Code actually touched. You can see how that activity distributes between **Managed** repos (those in your connected GitHub organization) and **Unmanaged** ones: personal projects, external clones, or private projects that consume the company's Code Agents license.

To populate this tab, [attribute sessions to repositories](https://coralogix.com/docs/integrations/ai-observability/claude-code/#github-repository-breakdown) on the Claude Code integration.

*The GitHub repos tab attributes per-session activity to each repo, splits it between Managed and Unmanaged repos, and surfaces the top users on unmanaged repos.*

### What this unlocks

- Every Claude Code session's full signal — cost, tokens, code impact (lines of code, commits, PRs), and the model used — attributed to the repository it actually touched.
- A clean split between **Managed** repos (your connected GitHub organization) and **Unmanaged** ones — personal projects, external clones, and private projects running on the company's Code Agents license.
- Pivot freely: from a repo to its top users, or from a user to their repos, models, and tokens-over-time pattern.

### Use cases

Two stories that show what the **GitHub repos** tab makes possible. **Same trigger, different conclusions.** Expand each one to follow the drill.

Catch IP walking out the door

You notice a sharp spike in Claude Code spend on the **Cost** tab — **$7K in the past hour**. The question forms instantly: *is this work the company is paying for, or work the company is losing?*

Switch to the **GitHub repos** tab. The **Repo type** pie tells you where the money's actually going.

**58% on Unmanaged is a lot of money on code outside your organization.** Select the slice. The drawer scoped to Unmanaged surfaces every user contributing, ranked by cost, with the specific repos they touched.

Scan the table for a repo name that *sounds* like internal work but lives on a personal account — `knowledge-base`, `architecture-notes`, anything that maps to internal IP. Select that user.

**Three-quarters of this developer's Claude Code spend is going into a *personal* repo that holds company-relevant code.** When they leave the organization, that work leaves with them — and the company has no claim on the IP they built.

**What you do with this**: you now have the data and the receipts to surface the conversation with the developer early — and route the work back into your organization's GitHub before the IP walks out the door.

Catch private projects on the company license (FinOps)

Same view, different question. You're not chasing a spike — you're running the routine FinOps audit: of every dollar the Code Agents license is spending, how much is going into work the company actually owns?

The number itself isn't the question. *Where* that number is going is. Switch to the **GitHub repos** tab, where the **Repo type** pie splits spend between code your organization owns and code it doesn't.

More than half the spend — **$4.4K on Unmanaged** — is buying agent capacity on code outside your GitHub organization. Some of that is legitimate (external clones, exploratory work), and some of it isn't. Select the Unmanaged slice. The drawer ranks every developer contributing to that bucket by cost, with the specific repo names they touched alongside.

This time you're scanning for repo names that don't fit company work at all — `weekend-game`, `myschool-startup`, `family-website`. Each one of those is the company's paid agent capacity being spent on a developer's personal project. Pick the user with the most spend against names like that and select their row.

The user drawer breaks that developer's spend down two ways. The **GitHub Repository Spend** stacked bar shows the split between company work and personal projects in a single glance — so you can see at once whether this developer's company-license use is mostly legitimate with a personal-project tail, or mostly personal with a thin company veneer. The **Tokens over time** chart, filtered to Unmanaged, then shows *when* that personal activity is actually happening — and that timing is what shapes the conversation.

If the unmanaged usage clusters during work hours, the personal project is being built on company time, and the conversation is about budget and time. If it recurs week after week at off-hours, the company's Code Agents license is funding ongoing personal work, and the conversation is about usage policy. If it's a one-off burst on a weekend with low cost, it's a hobby project on someone's own time — probably not worth flagging.

The data tells you which conversation to have. More importantly, it lets you have it with receipts in hand instead of suspicion.

### What you need

The **GitHub repos** tab is enabled by three independent layers, each set up on the Claude Code integration:

- **[Claude Code's native OTLP exporter](https://coralogix.com/docs/integrations/ai-observability/claude-code/#claude-code-integration-with-coralogix)** — feeds the core per-session signals (cost, tokens, sessions). Every tab in the Claude Code dashboard inherits this data.
- **[Coralogix repository-tracking hook](https://coralogix.com/docs/integrations/ai-observability/claude-code/#github-repository-breakdown)** — attributes each session to the repository the developer was working in. Without it, sessions still appear elsewhere on the dashboard, but they're not attributed to a repo.
- **[GitHub integration with AI SPM](https://coralogix.com/docs/integrations/ai-observability/github-app-for-ai-discovery/index.md)** — splits attributed activity into **Managed** and **Unmanaged** buckets based on your connected GitHub organization. Without it, the **Repository cost distribution** pie still renders, but the **Managed vs unmanaged** pie is replaced with a **Connect GitHub** empty state.

For installation steps, the hook architecture, and org-wide rollout, see [Connect Claude Code](https://coralogix.com/docs/integrations/ai-observability/claude-code/index.md).

### Widgets

#### Repository cost distribution

A pie of cost share by repository. The top seven repositories render as individual slices; everything else collapses into an **All other repos** aggregate slice.

#### Managed vs unmanaged

A pie that splits spend three ways: **Managed** (repository names that appear in your connected GitHub organization), **Unmanaged** (repository names that don't appear in your organization), and **Unknown** (sessions where the agent didn't report a repository name). Visible only when GitHub is connected.

#### Top users on unmanaged repositories

A ranked table of the five users with the most spend on Unmanaged repos. Columns: User Email, Cost, Sessions, Repos, Models, % of user's total spend.

Per-session cost is split across the repositories a session touched, proportionally to file activity. Sessions launched outside any Git repository land in the **Unknown** bucket.

### Drill into a repo or bucket

Selecting a slice in either pie opens a side drawer scoped to what you clicked:

- **Repository cost distribution** — Selecting an individual repo slice opens the drawer scoped to that repository.
- **Managed vs unmanaged** — Selecting a slice opens the drawer scoped to that classification bucket (Managed, Unmanaged, or Unknown).

The drawer shows **Total Cost**, **Sessions**, and **Users** for the selection, plus a top-users table — up to 10 rows of User, Cost, Sessions, Repos, Models, % of spend.

Selecting a row in the **Top users on unmanaged repositories** table opens the standard user drawer, pre-filtered to that user's unmanaged-repo activity.

## Alert examples

Example alerts you can build on Claude Code's metrics to catch cost spikes, runaway sessions, and unapproved models early. Each one expands to show what it detects and the query to use.

New or unapproved Claude model detected (7-day offset)

Alerts when token usage is recorded against a Claude model that wasn't present over the previous 7 days — a newly released or previously unseen model version (for example, Claude Fable 5) is in use. The alert surfaces the exact model name so leadership can assess whether it's sanctioned and act accordingly.

```promql
count by (model) (
  claude_code_token_usage_tokens_total
)
unless
count by (model) (
  claude_code_token_usage_tokens_total offset 7d
)
```

Per-user daily cost spike

Alerts when a single user's cumulative spend over 24 hours crosses a threshold (for example, more than $100 per user). Surfaces individual runaway usage before it distorts org totals.

```promql
sum by (user_email) (increase(claude_code_cost_usage_USD_total[24h]))
```

Cost rate anomaly (spike vs baseline)

Compares the last 15-minute cost rate against the 1-hour rolling average. A ratio above 3 means spend is accelerating 3× faster than baseline.

```promql
sum(rate(claude_code_cost_usage_USD_total[15m]))
/ sum(rate(claude_code_cost_usage_USD_total[1h]))
```

Model cost concentration

Alerts when a single model accounts for more than 80% of total spend. Useful when an expensive model should be used selectively but is dominating usage.

```promql
sum by (model) (increase(claude_code_cost_usage_USD_total[1h]))
/ sum(increase(claude_code_cost_usage_USD_total[1h]))
```

High activity, zero commits

Alerts when token consumption is high but no commits have been recorded for 2 hours (threshold: tokens > 50k and commits == 0).

```promql
sum(increase(claude_code_token_usage_tokens_total[2h])) > 50000
and
sum(increase(claude_code_commit_count_total[2h])) == 0
```

Runaway session: active time

Fires when a single session accumulates more than 2 hours of active agent time. Active time far beyond a normal coding session signals an unattended or looping agent.

```promql
max by (session_id, user_email) (
  increase(claude_code_active_time_total_s_total[3h])
)
```

Single session token runaway

Fires when any individual session consumes more than 200k tokens in a 1-hour window.

```promql
max by (session_id, user_email) (
  increase(claude_code_token_usage_tokens_total[1h])
)
```

## Troubleshoot

**The Claude Code dashboard reports fewer tokens than a custom dashboard built on the same metric.**

When you compare token totals between the Claude Code dashboard and a Custom Dashboards widget built on the same metric, the Code Agents number can come out lower. The Code Agents widgets use PromQL `increase()` over the visible time range, and for short windows or sparse time series, `increase()` can skip individual data points — the resulting total ends up smaller than a raw counter sum. For longer time ranges, the two values converge.

If you need an exact counter total, build a [Custom Dashboards](https://coralogix.com/docs/user-guides/custom-dashboards/introduction/index.md) widget with `sum by (cx_application_name) (claude_code_token_usage_tokens_total{})`.