Distil

About 9% off the real bill. On the maintainer's own Claude Code traffic — 13,191 requests, 1–24 September 2026 — distil saved an estimated 10.2% of what the bill would otherwise have been ($286 on $2,510, cache reads and writes priced in) before its own spend was netted out. Counting the expand re-queries and shadow replays that measurement left out, the corrected estimate is 8.3–9.2% (how). Your share depends on how much large, repetitive tool output your agent reads (why). Source data →

uv tool install distil-llm && distil setup

_{Or: curl -LsSf https://dshakes.github.io/distil/install.sh | sh · brew install dshakes/tap/distil · Windows: powershell -ExecutionPolicy ByPass -c "irm https://dshakes.github.io/distil/install.ps1 | iex"}

distil wrap -- claude      # run your agent through distil (or let `distil setup` make it always-on)
distil savings             # what it saved you, from your own traffic
distil doctor              # if something looks off

distil wrap -- claude also keeps Claude Code's MCP tool search switched on, which Claude Code otherwise turns off behind a proxy, so unused connectors can stay deferred instead of riding along on every turn. Verified live on 1.54.0 (2026-09-25): a wrapped Claude Code session recorded tools_deferred of 4–5 on every request, tool payload 9,733 tokens, prompt-cache reads intact, no request failures. (ADR 0013)

Why trust the number

• It doesn't break your prompt cache. Distil never rewrites bytes the provider still has cached; older context changes only once that cache has already expired. We shipped that bug once, measured what it cost, and made the rule an enforced invariant. The cache contract →
• Every compressed byte is recoverable. What distil folds away it keeps in a local store, and the agent gets a distil_expand tool to pull the exact original back mid-task. How the digest works →
• It's measured on your own bill. Savings are counted per request, then calibrated against the usage your provider actually bills — not estimated from a benchmark. The number above is one real bill. How it's measured →

_{Going deeper: what distil checks, and what it found when it pointed those checks at the providers' own compaction ↓}

What it does

• Wrap your agent — 18 presets: distil wrap -- <agent> for aider · claude · codex · gemini · copilot · goose · grok · kilo · kimi · vibe · opencode · openhands · qwen · cline · cn · crush · droid · omp. Zero config, no code change. distil wrap --list prints every target, its mechanism and the provider shape it speaks.

• Run a proxy — point any base_url client at it. Python, TypeScript, any language, any framework. Sync proxy, async proxy, and a standalone gateway, with the same provider coverage in each: Anthropic Messages, OpenAI Chat Completions and the Responses API, Azure OpenAI, and Gemini generateContent.

• Call it as a library — from distil import compress_messages in your own agent loop.

• Give your agent a recall tool — MCP server: it compresses its own output and gets the exact bytes back on demand.

• Framework hooks — LangChain · LangGraph · LiteLLM · Agno · Strands · AutoGen · LlamaIndex, in-process, no network hop — plus an ASGI middleware for any Starlette/FastAPI app that hosts its own LLM endpoint, and the npm package for the Vercel AI SDK.

• Where a proxy can't reach — distil setup --hooks: Claude Code, Cursor (MCP output), Gemini CLI and Codex CLI compress tool output through their documented post-tool hooks. Lossless-only on a subscription unless you add --digest; every digest recoverable with distil expand <handle>. No proxy, no credentials touched. distil quota shows the rate-limit window it buys back. Hooks →

• VS Code Copilot Chat — its BYOK Custom Endpoint can point at a distil proxy: distil setup --vscode.

• Keep a span verbatim — <distil:keep>…</distil:keep> in a prompt or tool output is never compressed.

• Real code skeletons — pip install 'distil-llm[code]' adds tree-sitter parses for Go, Rust, Java, C/C++, Ruby and TS/JS. Code skeletons →

• See what it did — live status line, session dissect, per-request headers, OTel spans, Prometheus metrics.

uv tool install distil-llm && distil setup    # detects your agent + billing, wires everything

Not sure which of those you want? Two questions pick your mode → — plain language, honest savings ranges, no jargon.

Will it save you money? On metered billing (an API key), yes — directly, off the bill. On a flat-rate Pro/Max subscription there is no per-token bill to cut, but there is a rate-limit window, and spending fewer tokens per turn leaves more of it for the next task. distil quota shows that window live. Savings come from large, repetitive tool output: verbose JSON and duplicated log runs compress 25–99%, while prose and unique-line output compress ~0% — a short session that never reads a big file showing near 0% is the tool working correctly, not failing. Why → Shell output (grep, git, test runs, ad-hoc scripts) goes through that same generic, reversible digest; there are deliberately no per-command profiles, because measured on real transcripts they would add too little on top of it. ADR 0015 →

🧩 Use it as a library

Building the agent yourself? Compress the message list where it lives — no proxy, no network hop:

from distil import compress_messages, expand_handle

result = compress_messages(messages)          # OpenAI/Anthropic-style dicts
print(f"{result.saved_pct:.1f}% smaller")
response = client.messages.create(model=..., messages=result.messages)

original = expand_handle(result.handles[0])   # byte-exact, any time, any process

Tool results get the reversible digest; user and system text get lossless transforms only; the model's own turns are never rewritten. Handles resolve across processes and restarts, so a digest made by the proxy expands here and vice versa. verbatim=True disables digests entirely.

_{Named compress_messages/expand_handle rather than compress/expand because distil.compress and distil.expand are modules — a top-level export sharing those names would resolve to the function or the module depending on unrelated import order.}

TypeScript too — compress(messages) from the npm package, byte-identical to the Python engine. Full reference: Library API → · runnable examples: python_library.py · js_library.ts.

Maintain a framework? docs/INTEGRATING.md is the ~20 lines and the four rules — we would rather the integration live in your repo than ours.

🔬 What distil checks — and what it found

• It proves decision-equivalence per request — and can say no. Shadow mode replays a sampled request three times: twice on the original context and once on the compressed one, then reports 1{A=B} − 1{A=A'} — a paired difference against the model's own self-agreement, with a bootstrap 95% CI, unclipped, so it is allowed to be negative. One reporting floor (50 A/B + 30 A/A) gates every surface; below it, every surface says below reporting floor instead of a number. The current live sample cleared that floor on 2026-09-15 and reads 97.5% [95.5, 99.5] over n=398 A/B — under 99%, so the status line flags it ⚠ rather than ✓.
• What it folds, it can give back byte-exact. A digest is a marker plus a handle into a local content-addressed store, and the agent gets a distil_expand tool to recover the original mid-task. The gateway ships Tier-0 only rather than emit a stub it cannot restore.
• It will not digest a line your agent has to quote back. An Edit(old_string=…) is a literal match. Reading exact-quote provenance from the shell command, not just the tool name, took byte-exact quote loss from 39.3% → 16.2% on real coding traffic — and it costs real savings, which we price rather than hide.
• It does not break your prompt cache. Compression is suffix-only and cache-monotonic by construction: a later turn may never rewrite bytes the provider has already cached. We shipped that bug once, measured it at 2× the cost of compressing nothing, and made the invariant enforced. The cache contract →
• It has been pointed at a hostile input, not just a hard one. distil validate --adversarial runs a COMA-class battery through the same path the proxy uses, and we publish the two cases that do not come back clean. Threat model →
• Every rung of the dial is measured, not just the default. distil bench --curve traces savings against fact recall across the whole ladder, offline and free. The curve →

🚀 Use it now

Four commands. distil --help shows only these; distil --help-all shows the rest.

uvx --from distil-llm distil savings   # what your agent costs you now — no install, read-only
uv tool install distil-llm
distil setup                           # detects your agent + billing, wires the status line, tells you what's next
distil wrap -- claude                  # run your agent through distil
distil savings                         # spent, saved, daily graph, what to fix next
distil doctor                          # if anything looks wrong

distil setup detects your environment (Claude Code · Codex · Gemini CLI; metered vs subscription). Or wrap your agent directly — no config, no code change:

# Claude Code on a metered API key — saves real $$:
distil wrap --expand -- claude

# Claude Code on a Pro/Max subscription — flat-rate, ToS-safe (trims context, not $):
distil wrap --lossless-only -- claude

# Codex, Gemini CLI, aider — same pattern; env var auto-selected per agent:
distil wrap --expand -- codex     # → OPENAI_BASE_URL (routing unverified: codex-rs reads openai_base_url from its config)
distil wrap --expand -- gemini    # → GOOGLE_GEMINI_BASE_URL
distil wrap --expand -- aider     # → OPENAI_API_BASE
distil wrap --list                # every target, its mechanism, and the agents it can't reach

# Headless too — print mode, CI, and Agent SDK scripts route the same way:
distil wrap -- claude -p "summarise this diff"
distil wrap -- python my_agent_sdk_script.py

Using Cursor, the Cline editor extension, Windsurf, Zed, Warp or Amp? (The Cline CLI is different — distil wrap -- cline reaches it.) None of them publishes a base-URL contract distil wrap can set — some have no such knob at all, some have one that structurally cannot point at localhost (Warp runs the agent on its own servers and rejects private addresses). Run a proxy and point the tool's own setting at it: docs/IDE-AGENTS.md, where every one of them is listed with the page and date the claim was checked against. The VS Code Copilot extension is not redirectable at all and that page says so rather than wasting your afternoon — the GitHub Copilot CLI is a different tool and wrap does reach it.

Each recognized agent auto-selects the right env var and upstream — no --env-var or --upstream flag needed. 13 route through an environment variable (aider / claude / codex / gemini / copilot / goose / grok / kilo / kimi / vibe / opencode / openhands / qwen); 5 have no env-var contract at all and route through a config file wrap manages for the session and restores on exit (cline / cn / crush / droid / omp). Prints preset: <agent> detected → <VAR> on start. Explicit flags always win.

distil default            # adds a managed shell alias so `claude` always routes through distil
distil default --undo     # remove it anytime (backed up before any change)

Then watch genuine savings from your traffic — measured, not estimated:

distil savings              # billed spend vs saved, daily graph, top fixes (--since 7d / --all / --json)
distil leaderboard          # cumulative tokens + $ saved, from the local ledger
distil dashboard            # live terminal TUI — token-trim + decision-equiv bars, Ctrl-C to exit
distil dissect             # per-session deep-dive: savings, digest inventory, anomalies (--html/--serve)

Validate it on your traffic. --shadow runs a fraction of requests twice (compressed and full) and compares the agent's chosen next action:

distil wrap --shadow 0.1 -- claude   # wrap + shadow 10% of requests
distil shadow-stats                  # live decision-equivalence rate

Honest scope: that's next-action equivalence — a proxy, not task success (E7 shows it doesn't fully transfer under aggressive lossy compression). Distil fails safe to full context.

Will it save money? On metered billing (API key) — fewer tokens, fewer dollars, directly. On a flat-rate subscription there is no per-token bill, so the saving is rate-limit headroom: fewer tokens per turn means more turns before you hit the window (distil quota shows it live). Coding agents: short sessions ~7%, big wins on long, many-turn sessions the model never re-reads.

💡 Why Distil is different

You don't need byte-equivalence — you need decision-equivalence: your agent taking the same actions with compressed context. That's measurable and certifiable.

• Certified, not estimated — a strategy ships only if a non-inferiority test passes; can't certify → full context.
• An estimator that can report harm — the live check is a paired statistic, 1{A=B} − 1{A=A'}, with a bootstrap 95% CI and no clamp at zero. The old ratio estimator printed exactly 100% whenever chance favoured it and could not express harm at all. One reporting floor now gates the status line, the proof ledger, shadow-stats, the census feed and the public dashboard alike — and prints below reporting floor rather than a flattering number.
• Byte-exact quotes survive, so Edit still applies — an Edit(old_string=…) is a literal match against bytes the agent read earlier; digest that read and the edit silently does nothing while the agent reports success. Provenance is read from the shell command (cat, head, sed -n), not just the tool name — that is 33.6% of tool-result mass the name rule never covered. It costs savings, and the changelog prices it instead of hiding it.
• Adversarially gated, and honest about the two hits — distil validate --adversarial runs seven COMA-class cases through the same public path the proxy uses. Trusted/untrusted budget isolation is structural: there is no keep budget shared between blocks anywhere, asserted as an equality in CI. Two results we publish rather than smooth over: dedup-baiting does fold the genuine error line (reversibility is what saves it), and decoy-verdict flooding is a real, unmitigated denial of savings — 0.0% on that block.
• The whole dial is measured, not just the default — distil bench --curve reports savings, fact recall, visible recall, facts lost and reversibility at every rung, offline and free.
• Certified end-to-end, too — distil certify-trajectories bounds how many solvable tasks compression can cost (no other compressor certifies either level).
• Reversible, not lossy — digests behind a handle, keeps the original, hands the agent a distil_expand tool. Compress fearlessly.
• Keeps the answer, folds the noise — a per-content-type keep policy pins each kind's load-bearing lines (a log's pass/fail verdict, a traceback's frames, a diff's hunk headers); repeated near-identical error spam is deduped, and on a green run dedup tightens further since that noise didn't fail anything.
• Query-aware — keeps the line you're actually asking about — distil is a proxy, so it sees the agent's intent (its tool_use args + latest ask) in the same request as the output. The line matching what you searched for (a grep hit, a config value, a SHA) is pinned even in arbitrary output — additively, so reversibility and the certificate are untouched. No post-hoc compressor has that query/output pairing. It also goes semantic, and always-on: a zero-dependency bridge — morphology, a curated technical synonym map, and char-trigram fuzz — pins lines that answer the query without sharing a word with it. Ask "the retry limit?" and it keeps max_attempts = 5; ask "the connection timeout?" and it keeps deadline_ms. Two more layers grow from your own traffic, never from a shipped blob: associations distil learns from its content-free expand flywheel (hashed pairs, --expand sessions), and a learned relevance model that is promoted only after its held-out recall beats the lexical baseline on your labels — until promotion, the lexical + bridge layers are exactly what runs. An optional distributional-vector table can be supplied too (pure-Python cosine; none ships). Every layer is additive — it can only widen keeps, so reversibility and the certificate are untouched — and it needs no embeddings or model to work.
• Lossless even on a flat-rate plan — subscription/lossless mode isn't just verbatim: it minifies JSON, collapses duplicate runs, and folds tabular tool output into a compact self-describing table (~70–79% smaller, ToS-safe, no lossy digest). Recent tool outputs stay byte-exact.
• See exactly what happened — distil dissect turns a wrap session into a report: savings by model/mechanism, the digest inventory, billed-usage calibration, latency by path, and a worth-your-attention anomaly list that catches silent failures automatically.
• Compounds on outcomes — expansions and matched failures teach the policy what to protect (signatures only, never content) — always more conservative.
• Re-reads cost what changed, not what it re-read — a coding agent re-reads the same file constantly (51.4% of reads on 2,489 measured sessions) and almost never at the same offset, so block-level dedup misses it. Distil matches on lines: the run a new read shares with an earlier one still in context becomes a reversible reference, everything else stays byte-exact, and the freshest read is never touched. It runs inside the exact-quote guarantee — the only transform that recovers savings on content distil has promised to keep verbatim — and stays safe because an Edit's old_string only has to exist byte-exact somewhere in the forwarded payload. → ADR 0010
• Streams like it isn't there — SSE relays chunk-by-chunk; TTFT preserved — including recoverable digest, which speculatively streams and only intercepts an actual distil_expand call mid-stream, splicing the recovery in without buffering the turn (no TTFT tax on the reversible tier).

Fidelity tiers: lossless (--verbatim) · reversible (byte-recoverable on demand — default) · lossy (every other tool). Only Distil certifies the reversible tier (Headroom ships an uncertified retrieve; Distil's recovery is agent-facing — the model expands mid-task — and gated by the decision-equivalence certificate).

⚡ Prove the numbers yourself — no API key

Don't take the table above on faith. distil bench re-certifies savings and decision-equivalence on a bundled 8-domain corpus, offline, in seconds — the same gate that runs in CI. How we evaluate — and why a compression ratio without a task-success delta is meaningless — is written up in docs/EVALUATION.md, including our own negative result:

uvx --from distil-llm distil bench      # certify savings + quality across 9 domains, in seconds
distil verify                           # byte-fidelity: every compression is exactly reversible
distil validate                         # adversarial real-path gate: invariants on hostile inputs
distil retention                        # fact recall: what stays visible vs expand-recoverable
distil retention --dataset hotpotqa     # graded against a PUBLIC benchmark's ground truth
distil fidelity                         # state probes: artifact state, overclaim, continuation

Five gates, all in CI: bench (non-inferiority on the corpus), verify (byte-fidelity), retention (fact-level recall), fidelity (state probes, below), and validate — which drives the compressor against adversarial inputs (huge/unicode/nested/malformed/marker-injection/secret-looking) and asserts reversibility, reject-if-bigger, recency-exactness, fail-open, and content-free telemetry hold on every one. That last gate exists because a green unit suite kept coexisting with real-traffic bugs; validate is the adversarial layer that catches them.

Recall is not enough, and here's the case that proves it. A trajectory creates net/scratch_bench.py at turn 2 and deletes it at turn 4. Compress away turn 4 and every path token is still present — string recall reads 100% — while the agent now believes a file exists that doesn't, and will plan around it. distil fidelity folds tool calls into a file-state ledger and grades the final state, separating lost (path gone — the agent can see the gap) from stale (path present, state wrong — the agent acts confidently on a falsehood). On that case: string recall 100%, state fidelity 0%.

It reports three more things recall can't see: overclaim ("approximately 4200 ms" → "4200 ms" — the value survives, its uncertainty doesn't), continuation (does the agent still know what's left to do?), and error propagation (does a loss at turn k show up as a behaviour change at turn k+n?). The gate is on silent failures only — CI runs --max-silent 15 — because loud loss is already retention --max-lost's job, and gating one regression twice hides which property broke. The bound is the measured one, not zero: Tier-1 digests hedged spans behind restore handles and drops the qualifier on 9 of 171 claims, so gating at zero would assert a property the compressor does not have. On top of that, distil suite grades twelve public benchmarks whose answer keys were written by someone else — including BFCL, which compresses the tool schema and checks that every name the gold call needs — the function and each argument — survives. At matched savings (90.1% vs 89.3%) truncation keeps 0 of 70 names; distil keeps all 70 — though none of them visibly: the schema sits behind a restore handle, one distil_expand away. The suite prints that gap (visible → true support: bfcl 0%→100%) rather than the flattering number alone, because a reader who assumes the model can see a schema it must actually expand first has been misled by figures that are individually correct. Names are matched as identifiers — a quoted JSON token, escaping tolerated — not as prose: the generic matcher was crediting 11 of 85 golds by accident ('a' matching inside "tool-schemas"). Fifteen golds BFCL genuinely names a, b, c are excluded and counted, since a one-letter token can be neither credited nor failed honestly. Every row is labelled rich or thin payload, because a benchmark with nothing to compress is a control, not evidence — and a run that grades only controls exits 1. It needs no API key and no spend, so it is wired into make gate and the CI gate job rather than run before a launch. Full methodology, including what these probes found wrong with our own corpus, in docs/EVALUATION.md §6; how to run everything, in docs/RUNNING-EVALS.md.

Recall, and a number you can check yourself. The three gates above are graded on our corpus against our oracle — rigorous, but not checkable by you. distil retention --dataset hotpotqa grades against ground truth written by someone else (HotpotQA's gold supporting sentences, amid 8 distractor paragraphs), next to a truncation baseline tuned to distil's own savings on the same case:

distil retention also splits recall into visible (in front of the model) and recoverable (one distil_expand away, verified against the handle's restore bytes). On the corpus that's 100% true recall with 0 lost, and being reversible instead of lossy is worth 21.4% recall — the mean across all 9 domains, each counted once. That's deliberately the macro average: the fact-weighted one reads 62.6%, but it's set by whichever domain carries the most probes, and one HTML fixture moved it from 9.8% to 62.6% without the compressor changing at all — the moat, as a measurement rather than an argument. distil retention --live reports the same on your own traffic; the meter stores counts only, never content.

And it found a real hole. The first thing the recall harness caught was not a regression but a missing capability: distil was compressing 0.0% of HTML tool results — minified markup is one long line, so line-folding had nothing to fold. Agents with a fetch or browser tool were paying full price for <script>, <style>, and nav chrome. Now:

Reversible, which is the part a lossy extractor can't offer: the exact original stays behind the handle, so a bad heuristic call costs one distil_expand instead of the content.

To be precise about what each layer proves: the per-commit gates grade decision-equivalence with an offline deterministic oracle over the committed corpus (fast, free, runs on every push — but synthetic). A nightly live-cert job re-certifies the same trajectories against a real model (distil certify --runner anthropic), budget-capped with a hard --max-live-calls ceiling so an unattended run can never spend silently. The empirical results above (SWE-bench n=500, live head-to-head n=200) were graded by real models; the per-commit badge alone doesn't claim that.

domain            trajectory                $ saved   distil   aggr  pruned
---------------------------------------------------------------------------
ops/sre           sre-disk-incident           32.8%     PASS   FAIL     615
coding            coding-bugfix               25.5%     PASS   FAIL     736
support           support-refund              32.6%     PASS   FAIL     765
research          research-synthesis          25.7%     PASS   FAIL     809
data-analysis     data-analysis-sql           18.1%     PASS   FAIL     965
devops            devops-rollback             22.8%     PASS   FAIL     857
finance           finance-reconcile           24.9%     PASS   FAIL    1014
web-research      web-research                89.8%     PASS   FAIL     428
agent-worklog     agent-worklog               35.3%     PASS   FAIL     891
---------------------------------------------------------------------------
aggregate: distil cuts $0.24052 -> $0.12400 (48.4% cheaper) reversibly; 7080 tokens causally prunable.
GATE: PASS — every trajectory certified non-inferior; aggressive rejected on all.

Why trust the number? Token-savings numbers are easy to fake — measure quality at low compression, advertise savings at high compression. Distil refuses that: accuracy and compression are measured on the same trajectories, and a strategy that can't pass non-inferiority doesn't ship.

distil certify --strategy distil       # VERDICT: PASS  (100% decision-equivalence)
distil certify --strategy aggressive   # VERDICT: FAIL  (mean diff −1.0, blocked)

distil eval plots the certified compression frontier — a savings-vs-quality curve where every point carries its certification verdict, locating the cliff past which lossy compression drops decisions. The artifact no competitor publishes: benchmark.html.

📊 The proof

Three results, all reproducible, all published with caveats:

• Live head-to-head vs real llmlingua / headroom-ai (graded by claude-opus-4-8; 2026-07-05, distil 1.10.1 vs llmlingua 0.2.2 and headroom-ai 0.27.0): 83.2% savings at 0% decision-change, ~1,000× faster (no ML model loaded vs. competitors' local transformer inference). The live proxy behavior is pinned to the certified strategy by tests/test_live_certified_equivalence.py; the one reviewed delta is a recency carve-out that keeps the freshest tool-result turns verbatim (an agent needs its freshest output byte-exact). Since 1.45 that carve-out applies only to content the provider has not cached — anchored to the client's cache_control breakpoint, and dropped entirely for providers that cache implicitly. A carve-out counted back from the end of the conversation slid forward as it grew, rewriting already-cached content one turn later and costing more in re-billed prefix than the digest saved. → benchmark
• E7 (SWE-bench Verified): aggressive lossy compression craters task success (52% → 16%) — a per-step certificate doesn't transfer to multi-turn. The reversible tier survives (56% vs 52%). We publish it because it's true. → E7
• E8–E14 (500-instance agent): the reversible tier is the only compressor non-inferior to full context, generalizes across 5 models / 3 vendors, and the newest digest matches full within noise (42.0% vs 39.2%). → E8–E14

Full methodology, McNemar tests, per-instance data: docs/PAPER.md · PDF.

📡 See it working

Measured on your traffic, never estimated, nothing leaves your machine:

• Per request: x-distil-* response headers (tokens-saved, mode, compressible-tokens, expanded).
• Per machine: distil leaderboard (--html for a page).
• Shadow mode: distil proxy --shadow 0.05 reports the live decision-change rate — streaming-aware.
• What you're still leaving behind: distil discover aggregates your recent sessions and ranks what is still costing you — tool/MCP definitions resent on every request, MCP servers whose definitions rode along on every turn and were never called, sessions that never reached the digest tier, a cache prefix that drifts and re-bills itself, re-fold churn the provider is not already discounting, a system prompt that grew. Each action carries the tokens and dollars per week it would recover, how that number was derived, and the one command or setting to act on it. It prints the median and the p10/p90 of your per-session savings beside the best session, so a best case is never read as a typical one, and it uses the rate your own ledger measured — falling back to a published benchmark ratio only when this machine has never run that mode, and saying so on the line. A detector that cannot measure stays silent, so "nothing to recommend" is a result rather than a failure to look.
• Org-wide: distil proxy sidecar + set ANTHROPIC_BASE_URL once; every client routes through it.
• Community: an opt-in census (distil census on) shares your numbers-only totals — preview the exact payload with distil census show before consenting; TELEMETRY.md has the frozen schema. Default remains: nothing is sent.

Dashboard, status-line plugin, federated leaderboard: Deploy & observability.

🔌 Works with every SDK

One proxy. Point any base_url-honoring client at it — Python, TypeScript, any language — and get cache-aware reversible compression with no code change.

distil proxy --upstream https://api.anthropic.com   # localhost:8788

// JS/TS: npm i distil-llm  → helper so you don't hardcode the URL
import Anthropic from "@anthropic-ai/sdk";
import { distilBaseURL } from "distil-llm";
const client = new Anthropic({ baseURL: distilBaseURL() });

Anything that speaks the Anthropic / OpenAI / Gemini wire format works — the proxy is framework-agnostic, so CrewAI, AutoGen, LlamaIndex, Agno, Strands, Bedrock, etc. route through it unchanged by pointing their client's base URL at distil.

Prefer in-process? Wrap the client directly — still no call-site change:

from distil.adapters.anthropic import wrap
client = wrap(anthropic.Anthropic())   # compresses the request, keeps the cache warm

(OpenAI — Chat Completions and Responses API — and Gemini route through the proxy: distil wrap -- codex, or point OPENAI_BASE_URL at it. An in-process client wrap exists for the Anthropic SDK only.)

Framework hooks (no proxy, no network hop) — for agent frameworks that own the message list, compress it where it lives: