Cloudflare cuts the cost of AI code review by 68%, from $2.43 to $0.77

The average cost of a single review in Cloudflare's AI reviewer rose from $1.22 in March to $2.32 in August, and hit $2.43 in the most expensive two weeks. The architecture did not change in that time: the coordinator handed tasks to the same specialists, and the same risk tiers still set the depth of review. In mid-September, the team told its own agents to find where the tokens were going and cut the cost. The result is $0.77 per review with the high effort level enabled for code quality checks, a 68% reduction. As a side effect, median review time fell from 4m09s to 1m32s.

Where the growth came from

The workload mix explains a small part of the increase: the share of reviews in the most expensive tier (full review) grew from 59% in March to 65% in August, as engineers began submitting larger changes. Model switches made the biggest difference. In early August, the team moved all reviewers to Anthropic models because they performed better on this task in internal tests. The cost of a task rose from $1.38 to $2.03. The Codex internal standards reviewer ended up on Claude Opus 4.7, and its price per review jumped from $0.25 to $0.88, more than the coordinator itself.

Before optimization, costs broke down as follows: 23% output tokens, 43% cache writes, 34% cache reads. Most of the money went to context the model had already seen. The code quality reviewer made an average of 16.6 LLM calls per review, wrote 72 thousand tokens to the cache and read 1.08 million, because every call passes the entire conversation. The cache hit rate rose from 85.7% to 97%, but the number of tokens per review rose from 0.91 to 2.99 million, and the high hit rate did not offset that. Anthropic cache writes cost 1.25 times the input price and reads cost 0.1 times, and a cache entry lives for five minutes without hits.

A shared prefix and fewer calls

On September 14, the team began logging the tokens of the first call in each session and the hash of the first system block. It found that the first request hit a ready cache in only 14–26% of cases, even though 11–21 thousand tokens of tool definitions and agent prompt are identical across all repositories. The cause was in OpenCode v1: it assembled a single block from the agent prompt and the environment section (working directory, date) and placed a single cache breakpoint at the end. The shared part was never cached separately.

On September 16, the team added a marker at the end of the prompt, and a plugin split the block in two, placing the cache breakpoint after the shared part. Everything repository-specific was moved to the end, and the skills list was disabled. The same day, the Codex standards index was embedded directly in the prompt. Previously, the first three turns of a session went to reading those files; now a run takes 9.6 calls instead of 15.9, and its cost fell from $1.12 to $0.72. Together, these changes cut the price of a review from $2.47 to $2.02.

The next changes, on September 21 and 23, took about $0.20 off each review:

• They hid the final-comment publishing tool from the sub-reviewers. In 57–76% of sessions, they tried to call it, got rejected by the server and wasted a call. This saves about 2.9 thousand tokens of definitions per request.
• Parallel file reads: in 64% of turns, the code quality reviewer made exactly one tool call. Now the shared context and all patches, up to 150 KB, are read in the first response.
• Skipping reviewers on repeat reviews: roughly two-thirds of jobs are repeats. On full repeat reviews, AGENTS.md checks are skipped in 56% of cases, performance checks in 23%, and documentation checks in 13%.
• Stopping after the review is published: OpenCode was running one more turn to produce an invisible summary, costing about $0.07 per job.
• A slow reviewer's timeout is no longer counted as a provider failure; security reviewer timeouts fell from 1.8% of runs to almost zero.
• Cancelling cancelled jobs: of 446 jobs cancelled in GitLab, 358 kept running. Now the job checks its status every 15 seconds.

The hardest change was the shared prefix for the three reviewers (code quality, security, performance): identical tools, the rules file, and a merge request with all patches. One reviewer writes the cache and the other two read it. Because the cache entry only becomes available once the response starts streaming, the other two wait up to 20 seconds. This slows them slightly but saves about nine cents per reviewer.

Models, effort and quality

Of the $1.67 reduction, $0.65 came from code changes and $1.06 from changing models and effort. The comparison used weekday hours before and after the changes, so it is not a rigorous experiment. The coordinator was left with a single configuration: at medium, full-tier jobs finished 20% faster. Opus 5.5 at medium showed no measurable difference in outcomes or critical findings compared with Opus 5, and high cost more without a meaningful gain in findings. Token price accounts for only about $0.20 of the drop. The rest came from lower volumes: cache reads per review fell by 82%, writes by 54%, and output by 67%.

On October 3, the Sonnet-based reviewers were split 50/50 between Sonnet 5 and 5.5. Two and a half days later, Sonnet 5.5 was cheaper by 62% for code quality, 58% for performance and 47% for security. The token price is the same, so all of the savings come from using fewer tokens. On 5.5 at medium, code quality makes 1.7 calls instead of 6.2, and more than half of runs finish in a single call. At high, it makes 3.4 calls, with a 61% increase in run cost (about two cents per review) and 58% more critical and warning findings, so code quality was moved to high.

The share of reviews taking longer than five minutes fell from 37.9% to 0.7%, and the 99th percentile is now faster than three-quarters of reviews were in April. The median for the full tier went from 5m16s to 1m54s, for lite from 2m58s to 1m14s, and for trivial from 77 to 30 seconds. In parallel, the reviewer moved to OpenCode v2: in shadow mode, approval decisions matched in 98% of merge requests, and full reviews on v2 finish about 13% faster. The team is also trying to run the entire pipeline on Durable Objects with pi-durable.

The key question is whether reviews have become more superficial. Code quality produces 40% fewer critical and warning findings than at the end of August, security 56% fewer, and performance 71% fewer. But authors now act on serious code quality findings in 59% of cases, against 34% before, with a background rate of incidental fixes of about 15%. The reviewer is less noisy, and the share of findings that lead to a fix has grown.

The practical takeaway for anyone building agents: first measure what your bill consists of (at Cloudflare, 77% went to cache), then check whether the first request of a session hits a shared prefix, remove tools the agent is not allowed to call, and only then compare models and effort on real data. A new generation of models can cut the number of calls several times over without losing useful findings.