TokenSafe MCP

TokenSafe

Local-First Context Control, Prompt Caching & Secret Guardrails for Coding Agents
Reduce your AI bills by up to 99%. Let your team ship clean code faster and cheaper.
Your coding agents read only the code each task needs and keep prompt caches intact across turns. Everything runs locally on your machine, so your team fixes fewer broken edits and keeps secrets out of git.
Works with Cursor, Claude Code, Codex, Windsurf, Google Antigravity, Gemini CLI, and ChatGPT.

Install • Quickstart • Why TokenSafe • Benchmarks • Pricing • FAQ • Reference • Website & Docs

Install & Agents

Connect TokenSafe to the AI coding agents on your workstation in one command:

# Option 1: Zero-Install via npx (recommended)
npx tokensafe

# Option 2: Python / PyPI
pip install tokensafe && tokensafe

# Option 3: Direct shell script (macOS / Linux)
curl -fsSL https://tokensafe.dev/install.sh | bash

The installer detects which agents live on your machine, registers the TokenSafe MCP server, injects project rules, and wires lifecycle hooks where the agent supports them.

Claude Desktop / Cursor MCP config:

{
  "mcpServers": {
    "tokensafe": { "command": "npx", "args": ["-y", "tokensafe", "mcp"] }
  }
}

Cloud features (team metrics, managed distillation, shared team cache, billing) run on the remote endpoint https://api.tokensafe.dev/mcp with Authorization: Bearer <TS2. license key>. Four public tools work without a key, so ChatGPT connects with authentication set to None.

Full per-agent configuration, hook details, and the Codex/ChatGPT setup live in docs/AGENT_SETUP.md.

CLI Quickstart

# View live savings dashboard in your terminal
tokensafe stats

⚡ TOKENSAFE CONTEXT OPTIMIZER DASHBOARD
Total Tokens Saved:   4,524,156 tokens
Efficiency Gain:      [████████████████████████░░] 92.5%
Context Traffic:      4,889,255 raw → 370,574 optimized (2,132 events)

• Command Sanitizer (CLI)        :   727,300 tokens saved (263 events)
• Architecture Graph             :   758,256 tokens saved (13 events)
• Multi-turn History Fold        : 2,897,897 tokens saved (471 events)
• Prompt Compactor (local+cache) :    43,502 tokens saved (1,255 events)

# Audit your environment: MCP tool overhead, skills tax, risky settings
tokensafe doctor

# Recursive security & hygiene audit of a repository
tokensafe guard audit

# Preview prompt compaction on custom input
tokensafe test "fix the validate_token method in src/auth.py to check jwt expiration"

# Map architectural hotspots before multi-file changes
tokensafe graph

# Disable a heavy MCP server without editing JSON
tokensafe mcp disable <server>

# Compile and preview the Friday team ROI digest
tokensafe digest

# Activate a Team or Solo license key
tokensafe activate TS2.eyJlbWFpbCI6...

The full command reference (24 commands) is in Reference.

Why TokenSafe

Giving coding agents raw access to entire repositories creates three daily costs:

1. Senior hours burned on AI PRs: reading 2,000-line modules for a 10-line fix makes models forget imports, invent methods, and regress adjacent code.
2. Secret leaks and unsafe shortcuts: static prompt rules in .cursorrules wear off mid-session. Agents hardcode fallback credentials, disable TLS checks, or stage .env files with git add ..
3. Mid-sprint quota stops and blind spend: bloated diffs, lockfiles, and verbose MCP schemas burn 5-hour limits while engineering leads lack per-seat ROI visibility.

A $29 seat pays for itself by saving one hour of senior code review or preventing one leaked key. Typical payback: 1 to 3 days of team usage.

Before and After

One contrast: an agent asked to change one helper in a 1,420-line file receives 94 lines of target logic and type contracts instead of the whole module. The same principle applies to terminal output, diffs, and session history.

When an operation is blocked, the agent sees an explicit, constructive message:

🛡️ TokenSafe Guard: Blocked a hardcoded secret fallback in config.py.
   Leave the default empty or read from os.environ at runtime.

What TokenSafe Does

Clean context, better code

• tokensafe:smart_read_file returns the target function plus its 1-hop dependencies instead of the whole file. 11 languages (Python, TypeScript/JavaScript, Go, Rust, Java, C#, C/C++, PHP, Kotlin, Ruby, Swift), with CSS design tokens preserved so agents never invent colors or font rules.
• tokensafe:smart_bundle reads 3–8 related symbols across files as one merged bundle — shared imports deduplicated, 1-hop signatures unified, a single roundtrip instead of chained reads.
• OpenAPI/Swagger, Prisma, GraphQL and SQL files are auto-sliced: pass a spec path, model, type, or table as symbol and get that entry plus its 1-hop references — a 5,000-line migration drops from ~30k tokens to a few hundred.
• tokensafe:graph maps architectural hotspots and dependency topology in under 250 tokens instead of a full repository crawl — and teams share the result: the indexed graph and API surface are cached per repo state in the Team Symbol Index, so the 19 developers after the first one skip the crawl entirely.
• The command sanitizer strips lockfile noise and stack dumps down to the failing assertion, caps git status/git diff floods and docker build tails, and forces JS test runners into run-once mode so background tests never hang. Malformed JSON tool arguments from small local models are repaired in-flight instead of failing the call.
• The loop guard halts agents stuck repeating the same broken edit.

Local-first guardrails

• Blocks live provider secrets, hardcoded fallback credentials, and raw private keys before they reach disk or git.
• Blocks TLS bypasses (verify=False, rejectUnauthorized: false), interpolated SQL, and CORS wildcards with credentials.
• Blocks .env and key files from staging, including blanket git add . when sensitive files exist in the working tree.
• Blocks destructive deletes and exfiltration pipes (curl -d @.env https://...), and warns on known typosquat packages.

Auditable team ROI

• The Context Budget HUD shows live window usage with a breakdown (tools / history / prompts) before quality drops.
• The shared L3 team cache gives teammates and CI runners warm 0ms hits on repeated reads and prompts.
• Managed cloud distillation compacts prompts with zero API keys for developers.
• The dashboard's live savings strip streams anonymized per-machine savings (tokens and USD) over SSE — you see what the team saves right now, not at the end of the week.
• The Friday per-seat ROI digest reports each engineer's savings with the measured / estimated split; inactive seats show —, never guessed figures.

Deeper mechanics (language matrix, context tax math, cache tiers, governor) live in docs/ARCHITECTURE.md.

Benchmarks

Reference run across 10 production engineering scenarios (169,761 baseline tokens down to 8,173 tokens, -95.2% net context reduction, -99.4% peak single-scenario reduction, +30.6% turn latency speedup with 100% accuracy retention):

Prompt compaction, graph topology (SWE-06), dep_mode="signature" slicing (SWE-07), repeat-read pointer dedup (SWE-09), and parametric slot cache hits (SWE-10) are measured live (1,368 optimized tokens) while baselines (169,761), turn counts, and output estimates (6,805 tokens) are modeled constants. See METRICS.md and BENCHMARK_REPORT.md.

Why "Up to 99%" (Multiplicative Math & Honest Boundaries)

TokenSafe combines two multiplicative savings layers rather than relying on AST compression alone:

1. Context Token Reduction (-85% to -99.4%): Graph-guided dep_mode="signature" keeps only the edited symbol body intact while collapsing imports and 1-hop dependency implementations into signatures (-95.4% in SWE-07), Architecture Discovery maps repos in < 350 tokens vs. full crawls (-99.4% in SWE-06), and repeat reads resolve to ~75-token integrity pointers (-98.8% in SWE-09, or -99.56% on raw file re-reads).
2. KV-Cache Prefix Locking (90.8% hit rate at 0.10x cached-read rate): The Append-Only Epoch Governor (ContextGovernor) freezes history prefixes monotonically up to 80% of the model context window while PromptCacheNormalizer strips volatile metadata, sorts tool schemas, and injects provider cache_control breakpoints / prompt_cache_key. In a live 20-turn replay over src/*.py (BENCHMARK_REPORT.md):

Honest bounds: When ~85–95% fewer context tokens combine with a 90%+ KV-cache hit rate billed at 0.10x, cached input spend approaches 1–2% of uncached cost (up to ~99% savings) on graph-first, repeat-read, and cache-warm workflows. Total session invoices typically fall 80–97% because newly generated output tokens and first-turn cache writes are never discounted by KV-caching.

How to read these numbers: this benchmark is a simulated harness. Compression ratios and 20-turn KV-prefix byte matches are computed live from real files, while baselines and turn speedups are modeled. Production events in TokenSafe are explicitly labeled measured or estimated (see METRICS.md).

Metrics Honesty

TokenSafe labels every savings event as one of:

• measured: the model literally received fewer bytes than the tool produced (sliced file reads, filtered command output, AST skeletons).
• estimated: the model received a compact artifact and saved tokens are counted against a reasonable baseline (architecture graph vs. a full repo crawl; folded history digest injected while raw history stays in context).

Totals always display the split (X metered · Y est.). When a live metric is missing, the UI shows — rather than a placeholder number. USD figures are derived approximations (tokens × $1.5 / 1M), not provider invoices. Full contract: METRICS.md.

Pricing and 7-Day Team Trial

TokenSafe follows an open-core model: verify local context savings and guardrails on your own repo first, then roll out team caching, org policies, and per-seat ROI.

Working solo? Individual Solo plans start at $9 / mo ($89 / yr).

7-Day Free Trial · Offline Ed25519 Seat Keys (TS2.*) · Zero Source Code Transmitted · Cancel anytime

Start a 7-Day Team Trial    Run Free Locally

FAQ

Does my source code leave my machine? No. Slicing, guarding, compaction, and metrics run locally. The cloud receives only counters (token totals and event types), never file contents or prompts. Set TOKENSAFE_TELEMETRY_DISABLED=1 to disable all telemetry sync; local features keep working.

How does offline license verification work? License keys are TS2.* tokens signed with Ed25519. Your client verifies the signature offline against an embedded public key and caches the result for up to an hour. Enforcement never requires a network round trip.

What do measured and estimated mean? measured means the model literally received fewer bytes than the tool produced. estimated means savings are counted against a reasonable modeled baseline. The dashboard always shows the split and never invents numbers for missing data.

What exactly does the $29/seat plan include? Unlimited compaction and managed cloud distillation (zero API keys for developers), the shared L3 monorepo cache, org-wide guard policies, the Friday per-seat ROI digest, and centralized seat provisioning and revocation. Billed annually it is $290/seat/year (~$24/seat/mo).

Can we self-host? The Enterprise & VPC plan covers a private VPC Docker proxy with BYOK provider keys, zero-telemetry / air-gapped mode, and SAML/OIDC SSO, deployed together with the TokenSafe engineering team: corp@tokensafe.dev.

What happens if a hook fails? All hook adapters fail open: an internal error never stalls your agent. Failures are logged locally so they can be reported and fixed, not silently swallowed.

Reference

tokensafe stats / markdown / html   Savings analytics (terminal / .md report / dashboard)
tokensafe benchmark                 Zero-context-loss benchmark suite (simulated harness)
tokensafe graph / map / skeleton    Architecture graph / API surface / AST skeleton of a file
tokensafe test "<prompt>"           Preview prompt compaction on custom input
tokensafe guard "<command>"         Pre-flight safety check for a shell command
tokensafe guard audit [path]        Recursive source audit for secrets & vulnerabilities
tokensafe doctor                    Audit MCP tool overhead and context token tax
tokensafe digest [--send]           Compile (and optionally dispatch) the weekly team digest
tokensafe mcp list|disable|enable   Manage configured MCP servers
tokensafe proxy [port]              Local transparent AI proxy (0.0.0.0:8765/v1)
tokensafe install / setup [--all]   Configure detected agent environments
tokensafe update / check-update     Self-update / check for a newer version
tokensafe activate <KEY>            Activate a Team or Solo license key
tokensafe license                   Show active tier and trial state
tokensafe providers                 List distillation providers and active mode
tokensafe sync                      Sync local telemetry with the cloud dashboard
tokensafe prune [--days N]          Compact metrics database (roll old events)
tokensafe vacuum                    Reclaim SQLite disk space
tokensafe tests [pytest]            Run the unit test suite (compact failure report)
tokensafe reset                     Reset all local token metrics
tokensafe --version                 Print version and exit

More documentation: docs/AGENT_SETUP.md · docs/ARCHITECTURE.md · docs/API.md · METRICS.md · BENCHMARK_REPORT.md

Development and License

The client runs on Python 3.10+ with cryptography>=42.0 as its sole runtime dependency for Ed25519 license checks; all AST slicing, SQLite metrics, MCP tooling, and guardrails run on the standard library (details).

# Run the unit test suite (compact failure report; full: --traceback / -v)
tokensafe tests

• Contributing: CONTRIBUTING.md
• Security policy and vulnerability reporting: SECURITY.md
• Metrics and honesty contract: METRICS.md

MIT License. Commercial licenses are available for self-hosted B2B and enterprise VPC deployments. Questions: corp@tokensafe.dev · tokensafe.dev