13 requests became 1, and the sandbox is what said so

One run of plimsoll's efficiency advisor, generated 2026-10-03 by go run ./examples/advisor -report. Every number on this page was measured by the API or read from the daemon's own log, or is labelled as a model.

plimsoll is an open source sandbox service for running code that an AI agent wrote. Its broker authorizes every call that code makes to your API, keeps the credential outside the sandbox, and records only route templates, verbs, status codes, byte counts and timings. A route template is the granted route with its variable segment left as a *, so a call to /items/i-7 is recorded as /items/*: which route the code used, never which item it asked for. There is no field for a path, a body or a credential, so none can be recorded by accident.

The efficiency advisor reads that record after a run and reports where the call pattern cost the API more than the question needed. When the profile declares a batch route for the route the code looped over (its batch_of, the operator's statement that one request returns what the loop fetched) and grants it, the finding names that route and comes back to the caller, who can rewrite. Every other finding stays with the operator: a declared route the profile does not grant is one the agent cannot call, and a route found from its path alone may page, return fewer fields or cover another scope, so the operator checks it before declaring it. plimsoll never calls a model to do any of this. It is a work in progress, and it is off unless a profile asks for it: a profile that does not set advice has its traffic left unanalyzed, and nothing is computed.

This page is one real run of the repository's advisor example: a fake inventory API with twelve items, a plimsoll daemon on the WASM provider, and one grant profile with advice: caller that declares GET /items the batch form of GET /items/*. The same question is asked twice, first the way an agent tends to write it, then the way the advice suggests.

host.get("/items").then(function (list) {
  return Promise.all(list.items.map(function (it) { return host.get("/items/" + it.id); }));
}).then(function (rows) {
  var total = rows.reduce(function (a, r) { return a + r.onHand; }, 0);
  console.log(JSON.stringify({ total: total, rows: rows.length }));
});

host.get("/items").then(function (list) {
  var total = list.items.reduce(function (a, r) { return a + r.onHand; }, 0);
  console.log(JSON.stringify({ total: total, rows: list.items.length }));
});

Predicted next to measured

The finding's numbers compare the measured pattern with an assumed ideal of one call. The ideal is never measured, so the second run is the measurement.

Bytes matched here only because the collection call was already being made in run 1; in general the replacement call moves bytes of its own, which is why the number is a gross total and not a saving.

Run it yourself

With Go installed, clone the repository and fetch its dependencies. The example run then needs no docker, credentials, model or outbound network access:

git clone https://github.com/plimsollmark/plimsoll.git && cd plimsoll
go run ./examples/advisor                    # the run, in the terminal
go run ./examples/advisor -report out.html   # the same run as a page like this one

The program checks its own claims: it fails if the two answers differ, if the loop does not come back with a fan-out finding naming the declared, granted route, if the rewrite comes back with any finding at all, if the per-item loop is flagged as a repeated read, or if the audit line carries anything but that one finding with its 11 calls beyond one. Source: EXTERNAL · source repo ↗ examples/advisor/main.go. How the advisor fits the rest: EXTERNAL · source repo ↗ efficiency advisor docs.

What this page claims, and what it does not

• Advice never changes a run. It is computed after the result is final, over metadata the broker already held. A run with advice is byte-identical in execution to one without; advice cannot gate admission or change an exit code, an output byte or the isolation tier.
• The trace is metadata only. Route templates, verbs, status codes, byte counts, latency. The toggle above shows what that leaves out.
• No model is involved. Two deterministic detectors (a fan-out over a per-item route, and repeated reads of one fixed route), counting only calls the broker delivered with a 2xx status, and one lookup of the profile's declared batch routes (plus, for the operator only, a route the path suggests). The paste-ready prompt for an API-change finding is text the operator may choose to hand to their own AI.
• The numbers are what they say. The call count is measured. The latency and byte figures are a model of the pattern against an ideal of one call, and the table above puts them next to what the API measured.
• A finding claims only what the trace can support. In run 1, 8 of the 12 per-item responses were the same size, and the API's log shows they were 12 distinct items. The trace holds the route template and the size, not the item, so it cannot tell same-size from same-item, and the repeated-read detector does not read a wildcard route at all. It reads only a route without a wildcard, where the broker admits exactly one path and every call is the same request; an unchanged size there is evidence the data did not change, and the finding says evidence, not proof.
• This run used the WASM provider, which is process-tier isolation and fine for an example. The advisor is provider-independent: the same broker core records the trace under Docker, E2B and WASM, so the findings do not depend on the tier.
• The advisor is a work in progress, and off by default. A profile that does not set advice has its traffic left unanalyzed and nothing computed at all; this page had to opt in with advice: caller to produce anything. Two detectors ship today and the rule set is not settled: two earlier ones were removed once it was clear the trace could not support them, because it holds no call start times (so it cannot tell serial calls from concurrent ones) and no guest content (so it cannot tell a client-side reduce from any other loop). Expect the detectors to change.
• Status: pre-1.0, single author, no external users yet, no third-party security audit. The lesson INTERNAL · trainer site → API Efficiency Advisor walks the same ground with a 128-call example.