Sending LLM Cost Alerts to Slack

A cost anomaly detected in a dashboard nobody watches is a tree falling in an empty forest. The fastest path from "spend is drifting" to "someone is fixing it" is a good LLM cost Slack alert - landing where your team already looks, with enough context to act without opening five tabs.

Send it where on-call lives

Cost incidents are incidents. Route them to the same channels as your other alerts - the on-call channel, not a #costs channel nobody has muted-then-forgotten. If it's big enough to page, wire it through to PagerDuty too.

Put the answer in the message

A good alert answers "what do I do about this" at a glance. That means attribution baked into the payload:

await postToSlack({
  channel: "#oncall",
  text: [
    ":rotating_light: *LLM cost spike*",
    "Feature: *summariser*  (10.4x baseline)",
    "Window: last 15 min  |  Spend: $214 (usual ~$20)",
    "Top user: acct_8fb2 (76% of the spike)",
    "<https://app/costs/summariser|Open dashboard>",
  ].join("\n"),
});

Keep signal high

• Baseline per feature, so a small-feature spike isn't drowned by total spend.
• Require sustained deviation - alert on N minutes elevated, not one noisy data point.
• Tier by severity - page for big absolute jumps, post quietly for small ones. A muted channel is worse than no alert.
• Add a threshold on the noise - don't fire a spike alert on $2 of spend.

Slack delivery is the last mile of the alerting system in AI budget alerts, fed by the per-call data you already capture when monitoring costs. Get the routing and context right and the same anomaly that used to surface on an invoice surfaces as a message you can act on in minutes.