What it costs

The check adds about 30 milliseconds to a tool call, everything included. Starting the process, loading the contracts, reading the state, evaluating the rules, writing the receipt.

That figure is the whole invocation, which is the number you actually pay. It is not the cost of evaluating the rules, which is a tiny fraction of it. Most of the 30 milliseconds is the Python interpreter starting, and that is a floor rather than something Coco spends.

In proportion

A tool call itself usually takes hundreds of milliseconds to several seconds. A shell command, a file write, a network fetch. The check is a small fraction of the action it governs, and it is paid once per call rather than per token.

A block costs no more than an allow. There is no slow path for a refusal, because the same checks run either way and the verdict is what falls out of them.

The gate itself makes no network call and no model call while deciding. That is what keeps the number steady rather than merely small, and it is why the same call costs the same on a busy day as on a quiet one. On the SDK road your round trip to the gate sits on top, and the next section is about exactly that.

Over HTTP

On the SDK road your network round trip to the gate is on top, and it is a different number. A caller in the same region as the gate adds a few milliseconds, and a caller on another continent adds more. Measure your own with one request.

curl -s -o /dev/null -w '%{time_total}\n' "$GATE/health"

Gate decision time and total round trip are different figures, and they stay separated every time we quote either.

Measure it yourself

The repository ships the benchmark that produced these figures, and it takes under a minute to run on the machine you care about.

python3 tests/bench_gate.py

The number it gives you is worth more than the number here, because it is yours. More contracts means more rules to evaluate, and the benchmark prints how many it loaded so the figure stays honest.