Why use standard deviation instead of a flat percentage?

A flat "alert if cost is 50% above average" ignores how variable your usage already is. A spiky workload trips that constantly; a steady one misses real anomalies. Sigma-based thresholds adapt to your actual variance.

What does a 3σ threshold mean in practice?

Under a normal distribution, only about 0.13% of days exceed 3σ above the mean — roughly one false alarm every two years. 2σ is about 2.3% (a few per quarter), and 1σ about 16% (most weeks).

How do I get the standard deviation?

Export 14–30 days of daily LLM cost from your provider dashboard, then compute the standard deviation in a spreadsheet (STDEV) or analytics tool. It captures how much your daily spend naturally bounces around.

Is my data sent anywhere?

No. The calculator runs entirely in your browser. Nothing you enter is uploaded, stored, or logged.

Should I set just one threshold?

A two-tier setup works well — a 2σ warning for early attention and a 3σ page for genuine emergencies. The tool shows both so you can wire a graduated alert.

LLM Cost Alerting Threshold Calculator

Set cost alerts that fire on real anomalies, not noise

A flat “alert if today costs 50% more than average” either spams you on a naturally spiky workload or stays silent through a real runaway. The right threshold depends on how much your daily LLM cost already varies. This tool turns your average and standard deviation into sigma-based thresholds with a known false-positive rate.

How it works

Daily cost is treated as roughly normally distributed around your average. A threshold set k standard deviations above the mean fires only when cost exceeds:

threshold = average + k × standard_deviation

The further out you set k, the rarer false alarms become. Under a normal distribution the one-sided exceedance probabilities are about 16% at 1σ, 2.3% at 2σ, and 0.13% at 3σ — which the tool converts into expected false positives per month from your noise tolerance.

Tips for effective alerting

Two tiers beat one. Use a 2σ warning to investigate and a 3σ page for emergencies, so on-call only wakes for genuine runaways.
Re-measure variance periodically. As traffic grows your average and standard deviation both shift — recompute monthly so thresholds stay tuned.
Pair with a hard cap. Sigma thresholds catch relative spikes; an absolute daily ceiling also protects you from a slow, steady climb that never trips a variance-based alert.