Mole enforces a research-agent budget with 0% overshoot, and that changes what agents owe you

The most interesting claim in Mole’s Show HN post is not that it does deep research in your terminal. It is the number at the top: measured budget overshoot of 0%. Not “we estimate.” Not “we try hard.” Zero, measured across a test corpus, because every model call is reserved against a ledger before it is made and settled after, with non-negative constraints enforced in the SQLite schema itself.

That is a different engineering posture from the rest of the agent ecosystem. Most agent frameworks treat cost as a soft meter you glance at mid-run. Mole treats it as a database invariant. The ceiling you set with --usd 0.50 is the ceiling the run hits, because the database will not let a call be made without a reservation, and will not let the ledger go negative. This is the kind of design decision that sounds like a detail and is actually the whole argument.

The budget is the trust mechanism

The agent economy has a confidence problem. Tools like OpenAI’s deep research and Anthropic’s Claude can produce excellent syntheses, but they can also burn $40 on a question you thought would cost $2, and they will do it while sounding perfectly assured. The Show HN post names this directly: agents “jumble the sources, and don’t even give you the best possible answer, just sound confident.”

Mole’s answer is structural. The budget is not a prompt instruction (“please be economical”) but a constraint in the data layer. Every call reserves funds before it executes, and settles after. Dollar mode prices search calls; token mode bounds models whose rates mole does not know, like a localhost model priced at zero but still counted in tokens. The two modes are mutually exclusive, which is an honest design choice: it refuses to pretend it can price what it cannot.

The 0% overshoot figure is the kind of number a skeptic should interrogate. It is self-reported, and the repo says mole grades its own runs via mole eval. But the mechanism is verifiable by anyone who runs it, and the architecture makes the claim plausible rather than magical. A ledger with non-negative constraints is not a heuristic; it is a hard stop.

Verified quotes, not vibes

The second pillar is claim verification. Mole extracts claims from sources, and a claim whose quote does not appear verbatim in the page it was mined from is discarded at extraction, before it can reach an answer. That is a strong filter. Citation accuracy is reported at 100%: every quote found in the source it cites.

The more honest number is the grounding rate: 80% of claims re-read against their source were confirmed. That means one in five claims, when checked against the original text, did not hold up. Mole marks those as unsupported in the report rather than dropping them quietly. That is a meaningful cultural shift. Most research tools present a polished answer and bury the uncertainty. Mole surfaces it as a first-class output.

Contradiction precision is the weakest number: 70% with a confirm pass, 51% without. That is worth sitting with. Half the time, when mole flags two claims as contradictory, it is wrong about the contradiction. The tool is honest enough to print that number, and that honesty is itself the product. An agent that tells you its precision on a task is more useful than one that pretends it is 100% at everything.

Local data that actually stays local

The third pillar is the privacy boundary, and it is the most architecturally interesting. Point mole at a CSV or a folder, and it analyzes the data without the contents leaving the machine. The mechanism matters: the model never sees a row and never writes SQL. It picks a hypothesis template and column names, mole renders the statement, and only aggregates are allowed back: counts, means, test results, buckets covering at least five records.

This is a clever inversion. Most local-data tools either ship your data to a model or run a small model on your machine. Mole does neither. It runs deterministic SQL locally and sends only aggregates to the model. The mole crossings command shows you exactly what left the machine. For anyone working with sensitive spreadsheets, patient data, or internal sales figures, this is the difference between “trust us” and “here is the audit trail.”

The five-record minimum on buckets is a thoughtful touch. It prevents the classic de-anonymization attack where a model infers an individual from a tiny aggregate group. That is the kind of detail that suggests the author has thought about real adversarial cases, not just demo scenarios.

Toolkit mode is the quiet strategic play

The most forward-looking feature is toolkit mode. In normal mode, mole owns the model: it plans, mines, and writes with your API key. In toolkit mode, the arrangement inverts. The coding agent’s model does the reasoning, and mole supplies the deterministic half: quote checking, pair retrieval, merging, SQL rendering.

This matters because it decouples the valuable parts of research from the model vendor. If you are inside Claude Code or Qwen Code on a subscription, your model tokens are already paid for. Toolkit mode lets mole ride on that subscription, contributing fourteen tools named mole.<tool> alongside the research tools. The deterministic half is the half worth having, and it does not care whose model is on the other side.

That is a bet on a future where agents are not monolithic but composed of a reasoning model plus a set of verified, deterministic utilities. Mole is positioning itself as the utility layer: the part that checks quotes, enforces budgets, and renders SQL, regardless of which model is doing the thinking. It is a sensible position in a market where model capabilities are commoditizing and trust is the differentiator.

What this means for AI builders

The takeaway for builders is not “install mole.” It is that the agent trust problem is solvable with engineering, not vibes. The three failures the Show HN post names, budget blowouts, jumbled sources, and confident wrongness, are each addressed with a mechanism: a ledger constraint, a verbatim quote check, and a contradiction adjudicator. None of these require a better model. They require better systems.

The honest numbers are the real signal. 80% grounding, 51% raw contradiction precision, 0% overshoot. A tool that publishes its failure rates is a tool you can plan around. A tool that claims perfection is a tool that has not measured.

The open question is whether the rest of the agent ecosystem follows. Most agent products are sold on capability: how much they can do. Mole is sold on constraint: what it will not do, and what it will not spend. As agent bills grow and enterprises start auditing what their AI assistants actually produce, the constrained agent may be the one that survives contact with procurement. The ledger is the product.