Version 1.14.0 tracks limits across 20 provider paths
AI Usage Bar gathers plan limits, balances, reset times, and stale-data warnings from 20 built-in provider paths listed in its authentication table. The result can appear as a Waybar item, an Omarchy Quattro panel, a tabbed terminal interface, or a native desktop surface. One command also emits structured JSON for scripts and other frontends. This is most useful when Claude, Codex, Copilot, and a metered API all compete for the same workday.
The repository is larger than the small status-widget idea suggests. Our checkout contained 338 files, about 87,397 lines of source, and 12 MB before installation. That code covers atomic caches, file locks for multi-monitor setups, 60-second TUI refreshes, and a 5-minute pause after a provider returns HTTP 429. A failed refresh leaves the last good value visible and marks it stale, which is the behavior a quota display needs during a short provider outage.
The 20-provider list depends on several unstable contracts
Of the 20 built-in provider paths, many do not use a public, versioned usage API. The project's endpoint guide calls the Claude and Codex routes undocumented, Copilot's route private, and Z.AI's integration the most fragile because it was reverse engineered from another plugin. Cursor, Kimi, Kiro, and Command Code have similar warnings. The parsers check response fields and the repository supplies opt-in live tests, but upstream vendors still control whether those fields remain available.
That risk matters more than the dependency count, although 255 installed packages is not tiny for a desktop meter. When a route moves, AI Usage Bar may show stale data or an error instead of a quota. That is acceptable for deciding which coding assistant to open next. It is a poor basis for finance, chargeback, or compliance records. The provider's billing page remains the source to use when a number has to settle money or policy.
What happened when we ran it
Our sandbox installed AI Usage Bar in 37 seconds and added 255 packages. The Rust build completed successfully in 79 seconds. We used commit 44418b3 in an unprivileged Debian container with 3 CPUs, 12 GB of RAM, and no secrets. The repository offered 2 CI workflow files and a tests directory, while no Dockerfile was present. Those facts fit a user-level desktop utility better than a service meant to be deployed as a container.
Cargo test finished in 129 seconds with 3,124 passed and 0 failed out of 3,124. That is unusually broad automated coverage for a project created in 2026, and it gives the many credential, parser, cache, and UI paths more credibility than a successful compile alone. Our harness did not log in to 20 outside services or test their live quota responses. The result proves the checked-out code passed its suite, not that every vendor endpoint answered on September 10.
Existing logins reduce typing but widen the trust boundary
The 20-provider authentication table mixes official CLI credentials, API keys, local databases, keychains, and local services. Claude and Codex reuse files written by their own CLIs. Copilot obtains a token through the fixed gh auth token command. Cursor and Kiro read existing local stores, while Antigravity can consult its saved Google session. That saves duplicate sign-ins, but it also means the program receives credentials powerful enough to query each account's usage surface.
AI Usage Bar says its config file is written with mode 600, and environment variables take priority over inline keys. Caches are split by credential fingerprints so one account does not inherit another account's snapshot. Those are sensible choices, yet every team should review the read paths before approving the tool on a managed workstation. Our 3-CPU sandbox had no secrets, so the 3,124 passing tests did not constitute a live credential-security assessment.
Version 1.14.0 custom providers accept static GET requests only
Version 1.14.0 can map a JSON endpoint into meters and text rows through JSON Pointers. It stores the projected fields instead of the full response, rejects ordinary HTTP unless explicitly allowed, and scrubs the selected key variable from child processes. The extension point is narrow: one static token, GET requests, and no scripting. Custom entries appear in the TUI and JSON report, but not in direct Waybar vendor selection, the primary-provider setting, or the settings overlays.
A separate edge case affects Antigravity detection. Open issue 169 says the detector looks for a running local product and misses a saved session when the app is closed, even though the fetch path can use that session. Once the provider enters the known cache, ordinary detection skips it. Running detection again with --all while Antigravity is open, or enabling the provider by hand, is the documented practical escape. The bug affects discovery, not the underlying closed-app fetch.
September activity and 3,124 passing tests support a trial
GitHub showed 455 stars and 6 combined issues and pull requests on September 10, 2026. The last push was also September 10, two days after release v1.14.0. That release added local provider detection, custom JSON providers, a Windows tray popover, and rate-limit backoff. The small queue includes both fixes and new-provider work, so the activity looks current. The repository is also MIT licensed and publishes checksum files for release assets.
The best fit is one developer with several subscriptions and a willingness to treat the display as advisory. Our run's 37-second install and 3,124 passing tests make a trial inexpensive, while the platform guides explain the credential tradeoffs in more detail than most desktop utilities. Pick claudebar for a Claude-only Waybar setup, or a native Mac alternative if menu bar polish matters more than Linux coverage. Keep official billing pages in the loop whenever a quota number has financial consequences.