Quickstart

From zero to your first investigation in 60 seconds.

1. Install

pip install ghosthunter

Requires Python 3.12+. The core install is paranoid-mode only — no cloud SDKs.

2. Set your Anthropic API key

export ANTHROPIC_API_KEY=sk-ant-...

Ghost-hunter calls Claude Opus and Sonnet directly. You bring the key.

3. Export your billing data

Drop a billing CSV from your cloud's billing console into the working directory. See the provider guides for exact export steps:

4. Investigate

ghosthunter investigate --csv billing.csv

Ghost-hunter reads the CSV locally, asks Opus for hypotheses, prints proposed read-only commands, and waits for you to paste output back. Nothing leaves your machine except the prompts to Anthropic.

What you get

A ranked list of hypotheses with confidence bars, the read-only commands that would confirm each one, and a final root-cause report you can hand to your finance team.

Understand paranoid mode — Why the default is zero-cloud-access and how the human-in-the-loop loop works.
Run with live credentials — Active mode for sandbox and personal accounts.