by ooples
Measure token savings per AI coding agent, optimize context, and share a live local knowledge graph across 16 CLI clients.
# Add to your Claude Code skills
git clone https://github.com/ooples/token-optimizer-mcpGuides for using ai agents skills like token-optimizer-mcp.
Last scanned: 5/23/2026
{
"issues": [
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-05-23T06:35:17.165Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}token-optimizer-mcp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by ooples. Measure token savings per AI coding agent, optimize context, and share a live local knowledge graph across 16 CLI clients. It has 505 GitHub stars.
token-optimizer-mcp returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/ooples/token-optimizer-mcp" and add it to your Claude Code skills directory (see the Installation section above).
token-optimizer-mcp is primarily written in JavaScript. It is open-source under ooples on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh token-optimizer-mcp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Your agent burns most of its context on work it already did: re-reading files that have not changed, dumping a whole file to see three lines, running unbounded searches, and re-deriving conclusions it reached last session and then forgot.
Token Optimizer attacks that on four fronts.
1. It makes the expensive call impossible. Install the plugin and a built-in
Read of a 200 KB file is denied, with the refusal naming the cached,
diffed replacement. Same for Grep, Glob, Edit, Write, and cat /
head / grep -r through the shell. Re-reading a file you already read this
session returns only a diff — usually the single biggest win, and one that
size-based rules structurally cannot catch. There is no setting to turn on.
2. It remembers what your agent worked out. A per-project knowledge graph accumulates findings, decisions and dead ends as a side effect of working, then feeds them back the moment the agent touches the relevant file. A finding costs ~150 tokens to carry. Re-deriving it costs 5k–50k.
3. It measures itself, in public, and tells you when it is losing. A materialized before/actual-return measurement for MCP progressive disclosure, with later expansions debited from the same net. Modeled graph substitutions and the randomized control arm for downstream graph effects remain separate. Every number is measured, visibly collecting, excluded, or absent.
4. It attributes the traffic. Returned context, optional cost equivalents, and net transport avoided are grouped by operation and MCP handshake identity. Codex, Claude Code, Gemini, and any other connected client get separate rows. Old records without identity remain explicitly unattributed instead of being assigned to whichever agent happens to be open now.
No account, no telemetry, no hosted service. MIT, so it is usable at work.
The screenshots in this README come from the shipped server reading persisted local data, not a design mockup. In the capture above it reports:
Collecting.The dashboard now reads native CLI usage receipts and prices uncached input, cache reads, cache writes, and output with the exact captured provider, model, route, request-time tier, and versioned official source. Ambiguous model ids stay Not priced instead of receiving a blended guess. API/list-price equivalents are kept separate from provider-reported charges and are never labeled as a subscription invoice. See the token accounting contract.
Claude Code — install the plugin, not the bare MCP server. The plugin is what enforces; adding the server alone just gives the model tools it can ignore.
/plugin marketplace add ooples/token-optimizer-mcp
/plugin install token-optimizer@token-optimizer
/reload-plugins
That is the entire installation. All sixteen clients →
Then, whenever you want to know what to do next:
token_audit
One ranked queue: what is costing the most per session, with an optional monthly cost equivalent only after you configure your own effective rate. Each line names how to fix it. Not a dashboard, not six reports — a queue.
Every agent session ends the same way: the reasoning evaporates. The next session re-derives it, at full price, forever.
This builds a living per-project graph — nodes for files, symbols, tasks and
findings; edges for derived_from, contains, supersedes, contradicts,
related — and it fills itself in from real work. No ingestion job, no
embedding model, no rebuild step, no query to formulate.
you touch src/auth.ts
│
├─ verify() compares exp against the LOCAL clock (finding, 0.9)
├─ per-host retry budgets; global was rejected — deadlock (decision)
├─ ! the skew fix was reverted once already (dead end)
└─ [git] 47 changes in 90d, last three: "fix token expiry",
"revert skew fix", "fix token expiry again"
None of that is in your repository. It exists only because an agent once burned tokens finding it out — and every other tool throws it away at the end of the session.
What a default install actually produces. The structural graph — files,
symbols, tasks, and the edges between them — is captured from ordinary tool
traffic with no configuration at all. Findings are produced two ways. At session
end, derive reads evidence already on disk (command outcomes and exit codes,
red-to-green transitions, corrections, re-read churn) and writes findings from
it: no model call, no credential, nothing sent anywhere. And the active model
records durable conclusions itself through wiki_write.
The model-based semantic harvest is the third path, and the only one that
needs something you do not already have. It is not opt-in —
TOKEN_OPTIMIZER_HARVEST=0 turns it off — but its real gate is a credential:
with none it reports off:no-key, which is the state on CI, corporate machines,
and subscription-only logins. Point TOKEN_OPTIMIZER_HARVEST_ENDPOINT at a
local model and it runs free and private, with nothing leaving the machine.
npx token-optimizer-doctor states which of these is live.
| Classic RAG | This |
|---|---|
| Retrieves evidence; the model re-derives meaning each time | Retrieves verdicts — the reasoning already happened |
| Index built by a batch ingestion job | Accretes from real agent traffic — coverage follows attention |
| Similarity search | Traversal — this symbol and its callers |
| Model must formulate a query | Fires when the model reaches for a file |
| Staleness invisible; serves rotted chunks confidently | Staleness computed from content hashes, served with the invalidating diff |
| Returns only what is in the documents | Returns dead ends, which exist nowhere in your source tree |
Traversal plus lexical search: deterministic, instant, explainable, and it works offline.
A plain deny costs a full turn: the model calls Read, is refused, re-plans,
calls smart_read. But at refusal time we already hold the file and the
snapshot the graph stored — so the refusal carries the answer inside it.
Nothing to re-plan, no second call. Turn cost drops from one to zero.
And when the graph already holds the verdict a tool output would support, the output never enters context at all. Not compressed. Absent.
npm install
npm run build
npm run dashboard # http://localhost:3100