← databricks-cost-leak-hunter

Databricks pack · how it works

One detection run, end to end

Vertical is time. Five participants, eleven messages, one branch where a detector declines to report — the part of the pipeline that decides whether a number reaches the CFO at all.

One detection run of the Databricks cost-leak hunter, as a sequence A sequence diagram with five lifelines read left to right in first-appearance order: Operator, Cost Leak Hunter skill, Databricks system tables, the Databricks control plane reached through the workspace MCP, and the report. The operator asks why the bill is high. The skill probes system.billing.usage for the metastore grant chain and gets SUCCEEDED back. It then runs the priced CTE, joining usage to list_prices, which returns thirty-day dollars per usage row — the step where DBUs become dollars. It calls clusters_get on the control plane, which returns an auto-termination setting of zero, so the idle-cluster detector fires with a Confirmed tag. An alternative fragment then splits the overprovisioning detector in two: when node_timeline returns utilization rows the estimated overprovision figure goes to the report labelled Estimated; when node_timeline is empty the skill loops back on itself and holds the finding back, shown in orange, so it is never reported as zero dollars. Finally the deterministic ranker orders whatever survived by dollars per month, and the report returns a split headline to the operator that keeps confirmed and pending-review dollars apart. alt fragment — the overprovisioning detector branches on whether system.compute.node_timeline returned utilization rows for the cluster WHY IS MY BILL HIGH GRANT PROBE SYSTEM.BILLING.USAGE SUCCEEDED PRICED CTE USAGE × LIST_PRICES 30-DAY USD PER ROW CLUSTERS_GET WORKSPACE MCP AUTOTERM = 0 CONFIRMED ALT [NODE_TIMELINE HAS ROWS] EST. OVERPROVISION ESTIMATED [NODE_TIMELINE EMPTY] HELD BACK NOT REPORTED AS $0 RANK BY $/MONTH DETERMINISTIC RANKER SPLIT HEADLINE CONFIRMED VS PENDING Operator — the person asking why the Databricks bill is high Operator HUMAN ASK Cost Leak Hunter — the databricks-cost-leak-hunter skill, version 2.27.0 Cost Leak Hunter SKILL 2.27.0 System tables — system.billing.usage and list_prices for dollars, system.compute.clusters and node_timeline for configuration and utilization, all governed by Unity Catalog EXT System tables BILLING · COMPUTE Control plane — the live Databricks clusters and pipelines REST API, reached through the databricks-workspace-mcp server EXT Control plane WORKSPACE MCP Report — the ranked, confidence-stamped markdown report written to the working directory Report COST-LEAK-REPORT LEGEND CALL RETURN HELD BACK EXT = DATABRICKS-SIDE

You are looking at a single run, read top to bottom as elapsed time, with each vertical line a participant and each arrow one message between them. The skill probes the metastore grant chain before anything else so a missing permission fails immediately rather than halfway through, then runs the priced CTE — joining system.billing.usage to system.billing.list_prices on SKU and usage unit inside the price-effective window — which is the step where DBUs stop being units and become dollars. The idle-cluster detector fires just below that, corroborated against the live clusters_get config and tagged Confirmed, because auto-termination set to zero is money already billed rather than money modelled.

The branch in the box is the part worth pausing on. Overprovisioning is a modelled figure, not a billed one, and when system.compute.node_timeline returns no utilization rows for a cluster the skill holds the finding back entirely instead of reporting it as zero dollars — an absent number instead of a confidently wrong one. Whatever survives goes to a deterministic ranker that orders the leaks by monthly dollar impact and splits the headline so confirmed and pending-review dollars are never summed under one verb.

Drawn from databricks-cost-leak-hunter SKILL.md v2.27.0, steps 1–7 — one of five skills in the Databricks pack.
Message order follows the skill’s documented pipeline, not an observed customer trace. No dollar figures appear here by design.

← Back to the databricks-cost-leak-hunter demo