openFactoryAI
How it worksThe catchThe boardFAQ
ToolsAIDA ScoreWhat your agent sessions cost you, rankedTokenTopperYour AI usage index and tier
BlogSign inGet a seat

Tools · AIDA Score

Your agent wrote the code.
You paid the price.

Thirty rules read your Claude Code, Codex and Cursor transcripts and work out what that price was: minutes lost per finding, and the date each one last happened.

Download for macOSSee a real report first
Free to runNo code leavesApple notarised
all projects · light · 90 daysReal run
Findings135 worth attention
Time lost43h 40mmeasured, not guessed
Automation95out of 100
marks at 50 and 70, the thresholds the rule uses
440sessions
100projects
265 / 175claude / codex
59.8turns per step-in
01

Transcripts in, an ordered list out · all of it on your machine

Nothing to configure, nothing to upload, no key to paste.

How AIDA Score works, end to endSessions from three coding agents are read by thirty rules across four lenses, which produce a nine-page report, which ends in an ordered list of what to change. Every step runs locally.Every step above runs on this machine. No API key, no model, and no network call to produce any of it.Claude CodeCodexCursor30 rulesSecurity13Practices5Effectiveness5Repository7One report, nine pagesHolding it back · What worksWhy agents fail · Repo readinessYour style · Stats · Fun factsCoding practices · Owning itWhat to changeDo these firstWhat to learn, in orderOne goal at a timeeach with a re-measure date
How AIDA Score works, end to end
ReadsThe sessions Claude Code, Codex and Cursor already keep on this machine
Applies30 rules: Security 13, Practices 5, Effectiveness 5, Repository 7
ProducesOne nine-page report: Holding it back, What works, Why agents fail, Repo readiness, Your style, Stats, Fun facts, Coding practices, Owning it
Ends withWhat to change: do these first, what to learn in order, one goal at a time — each with a re-measure date
WhereEvery step runs on this machine. No API key, no model, and no network call to produce any of it.
02

Four lenses · and what fired on that run

Every rule names the mechanism by which the thing it found harms agent output.

Security

Sandbox off, approvals suppressed, credentials in transcripts, destructive commands.

6 of 13 fired

Practices

Stuck loops, files rewritten five times over, edits never checked by anything.

5 of 5 fired

Effectiveness

Tool errors, context pressure, shelling out for what a native tool already does.

2 of 5 fired

Repository

The repo is a lens too. Nothing proves a change is sound, files too big to read.

n/a pick one repo to run it
03

What comes back · ranked by what it cost, never alphabetically

Real output, from the run in the hero.

AIDA Score · all projects · light mode · 440 sessions
Your styleWhy agents failStatsRepo readinessWhat worksHolding it backFun factsCoding practicesOwning it
● Worth attention1

20 stuck loops, roughly 2h 44m burned

The same command failed three or more times with no change between attempts. It was retrying rather than diagnosing. Every retry re-sends the full context.

practices/repeated-failure-loop · 20 occurrences · 9 sessions · worsening3
2h 44m2last seen 8 Aug
● Worth attention

Sandbox was off for 212 agent actions

The sandbox bounds the blast radius when an agent misreads a command. With it off, that boundary is your machine, and whether that trade is right is your call.

security/sandbox-disabled · 212 occurrences · 107 sessions · worsening
107 sessionslast seen 8 Aug
● Worth attention

69 credential-shaped values appeared in sessions

Transcripts are plaintext, long-lived and often synced. We match on shape, so we genuinely cannot tell live keys from placeholders, so it is worth a look.

security/secret-exposed-to-agent · 69 occurrences · 14 sessions · worsening
14 sessionslast seen 7 Aug
● Worth a look

267 files rewritten 5+ times in a single session

Converging by trial and error instead of from a settled plan. Every rewrite re-reads and re-emits the file while the useful diff stays small.

practices/file-thrash · 267 occurrences · 47 sessions · worsening
40h 48mlast seen 8 Aug
1 · Severity, in plain wordsWorth attention, worth a look, minor. It guides, it does not grade.
2 · The priceWall-clock derived from real event timestamps. No price, no finding.
3 · The ruleEvery finding names its rule id, and lists each session the rule fired in.
4 · The trendFirst seen, last seen, direction. A stale habit gets demoted, not sold to you.
04

Two of its charts · real data, no library

Where the time went
Only three of thirteen findings cost measurable minutes. The rest cost you in risk.
Wasted wall-clock by rule, last 90 daysFile thrash 40 hours 48 minutes, repeated failure loops 2 hours 44 minutes, write before read 8 minutes.File thrashpractices/file-thrash · 40h 48m40h 48mStuck loopspractices/repeated-failure-loop · 2h 44m2h 44mEdit before readpractices/write-before-read · 8m8m0linear scale · 43h 40m total
Wasted wall-clock by rule
practices/file-thrash40h 48m
practices/repeated-failure-loop2h 44m
practices/write-before-read8m
When the work happens
Session starts by hour, local time. 440 sessions.
Session starts by hour of dayTwo equal peaks of 38 sessions at 10am and 7pm, a second evening peak of 37 at 9pm, and a trough of 1 session at 6am.381900:00 · 15 sessions01:00 · 16 sessions02:00 · 15 sessions03:00 · 10 sessions04:00 · 6 sessions05:00 · 2 sessions06:00 · 1 session07:00 · 10 sessions08:00 · 19 sessions09:00 · 29 sessions10:00 · 38 sessions11:00 · 18 sessions12:00 · 9 sessions13:00 · 13 sessions14:00 · 8 sessions15:00 · 20 sessions16:00 · 19 sessions17:00 · 22 sessions18:00 · 22 sessions19:00 · 38 sessions20:00 · 24 sessions21:00 · 37 sessions22:00 · 17 sessions23:00 · 32 sessions00101923
Session starts by hour of day
Peaks10:00 and 19:00, 38 sessions each; 21:00, 37 sessions
Trough06:00, 1 session
Total440 sessions

That was someone else’s 90 days. What did yours cost?

Your transcripts are already on this machine. Point the app at them and you have your own version of the report above, in about a minute.

Download for macOS
05

What leaves the machine · the report, and nothing under it

The analysis is entirely local: 30 deterministic rules, no API key, no model, no network call to produce any of it. This is the organisation build, so the one thing that does leave is the finished report — that is what the sign-in is for, and it is worth knowing exactly what a report contains.

The egress boundaryYour transcripts and the thirty rules never leave the machine, and the analysis makes no network call at all. One thing crosses: the finished report, filed with the organisation you signed in to, with session identifiers stripped before it goes.THIS MACHINEYour transcripts30 rulesYour reportEACH FINISHED REPORTYour organisationevery report, filedsession identifiers arestripped first, and the uploadaborts if that cannot be verifiedWHY THE SIGN-IN EXISTSThis is the organisation build. A team improves on whatit can see, so each finished report is filed centrally andthe trend belongs to the team rather than to one laptop.Nothing is filed until an analysis finishes, andnothing under the report goes with it.
The egress boundary
Never leavesYour transcripts and the 30 rules. The analysis makes no network call at all — no API key, no model.
CrossesEach finished report, filed with the organisation you signed in to
Stripped firstSession identifiers. The upload aborts rather than completes if that cannot be verified.
Goes up with the report
  • Findings — rule ids, counts, severities, and the measured cost of each
  • Where they happened — project names, and the file paths a finding is about
  • When — timestamps, so a trend can be drawn across runs
  • Command excerpts — the shape a rule quotes, with credentials already redacted where the rule fired
Never leaves this machine
  • File contents and diffs — a finding names a file, it never carries the file
  • Prompt or message text — what you and the agent said to each other
  • Transcript files — of any kind, in any mode
  • Session identifiers — stripped before upload, so a report cannot be walked back to one developer’s session

Both lists are enforced structurally rather than by policy. The upload is built as a whitelist over each evidence row, so a field added upstream cannot start travelling by default, and a test stuffs a report with exactly the material in the right-hand column and asserts none of it survives. That test has already caught one real leak.

06

Get your score · about a minute, start to finish

Nothing to configure and no key to paste. Point it at the machine you already code on and read what comes back.

Step 1

Download and open it

Unzip, then open the Apple Silicon .dmg. Signed with a Developer ID and notarised by Apple with the ticket stapled, so it opens without a Gatekeeper warning and without a trip to System Settings.

Step 2

Sign in with Google

It opens your browser, so your existing session and security keys work as usual. This is the build that files each report with your organisation.

Step 3

Choose a scope and analyse

Everything on the machine, or one repository — picking a repository is what turns the repository lens on. The report opens in the app and in your browser, and stays on disk to compare against next time.

Download for macOSOr rank your usage with TokenTopper

SHA-256 of the .dmgccc4c42549…dd143a7246full checksum

Apple SiliconmacOS 11 or laterDeveloper ID signedNotarised & stapledRead-onlyNo seat required