Why

---
description: Forensic audit of the user's most recent Claude Code session. Returns total spend, output ratio, duplicate file reads, idle context after auto-compact, the largest requests (with the tool call each one made), and an estimate of what Sipcode would have RECOVERED if optimizers were active. Use when the user asks "where did my tokens go?", "audit my last session", "why was that session so expensive?", or any forensic question about a past Claude Code session.
---

# Sipcode why (session forensics)

Call the `sipcode:audit_latest_session` MCP tool to produce a forensic report of the user's most recent Claude Code session.

If the user provides a session ID prefix (e.g., "audit session 3bca35e2"), pass it as the `session_id` argument. Otherwise, omit and the tool will pick the most recent session across all projects.

When presenting the result:
- Lead with the **output ratio** (`punchline.outputRatioPct`: output, meaning the text, code and reasoning the model wrote, as a share of the tokens not read from cache). The other tokens are the context sent with each request (the one-liner says how much of it was read from cache, which costs a fraction of the input price); do not call them exploration or waste.
- Surface the **top 3 leaks** with their dollar cost.
- If you mention the largest requests (`topExpensive`), say each row's tokens are the whole request's (mostly the context sent with it), not what the tool call cost.
- The "Sipcode estimates ~X tokens were RECOVERABLE" line is **potential**, not realized. Only realized after `sipcode rules --install` + new sessions + `sipcode impact`. Be explicit about this when relaying the number.
- If the session is unusually large (> $10), call that out.

Do NOT extrapolate the single-session savings across many sessions. Each session is its own forensic snapshot.