Trace a Claude usage spike to a background memory plugin and patch it

Rifat Hossain used Claude Code to find why his Max meter read 2% on a quiet morning, traced it to the claude-mem plugin replaying a backlog, and fixed the bug in a PR the maintainer merged.

Done withClaude Code· Oct 23, 2026

What they did

Hossain saw his Claude Max weekly meter at 2% a few hours after the reset, though he had barely worked. He did the investigation with Claude Code. It summed the token usage recorded in every local session transcript since the reset, checked the Claude Desktop usage history file to confirm the meter was real, then turned to the one background process he ran: the claude-mem memory plugin, whose observer runs without writing transcripts. They queried the plugin's status endpoint, read its logs to rebuild the overnight timeline, and inspected why each observer turn was so large. Claude Code then helped him write the fix, replay it against stored Edit results, and get the tests passing.

How it went

His own sessions explained about 0.26% of the limit. The plugin had paused near the old week's cap, buffered over 3,000 tool calls, and replayed them after the reset: 677 observer turns in one hour, with a queue of 2,080 still waiting. A trim that strips whole files out of Edit results had silently stopped working after a Claude Code update added two boolean fields. The patch took tests from 4 of 6 passing to 6 of 6 and raised trimmed results on 639 real samples from 29 to 168. The maintainer merged it about 15 hours after the issue was opened. He then uninstalled the plugin anyway.

Worth knowing

Any background tool that runs on a subscription spends the limit while you are away, and work paused near a cap is still billed later. The gap between the meter and your own transcripts is the clue: look for whatever is not writing logs. Other users reported far larger usage from the same plugin, which he did not verify.

Try it

With Claude Code· 6 parts to fill in

My [AI plan or API account] usage shows [amount] since [reset time], which is far more than I remember using. Investigate where it went. First add up the token usage in my own session logs at [log location] and compare it with the meter's history at [usage history file]. Then list every background process, plugin or scheduled job that could call the model, such as [plugins I run], and for each one check its logs, status endpoint and queue. Build a timeline of what ran and how many tokens each call cost. If you find a bug causing it, explain the root cause and propose a minimal fix with tests, and replay the fix against real stored data. Show me the findings and the diff and stop before filing an issue, opening a PR or uninstalling anything.

Square brackets are the parts to fill in. The prompt is ours; the story is theirs.

Where they said it

Related