Token Optimizer MCP

by ooples• 564•• Scanned•Claim this listing•Request removal
Coding Agentsaicachingclaudecompressiongemini cli extension

Measure token savings per AI coding agent, optimize context, and share a live local knowledge graph across 16 CLI clients.

Token Optimizer MCP is an open-source mcp server by ooples, written mainly in JavaScript, with 564 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit 31ee445. Seen able to read environment and secrets, connect to databases. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at 31ee445 · Nov 5, 2026
Scanned Builds Boots No undeclared egress Reproducible
Static code scanwarn
Secrets scanfail
Dependency audit42 known vulnerabilitieswarn
Manifestserver.jsonpass
Buildpass
Boot & handshake19 toolspass
Network egresspass
Reproducible (×3)pass

Findings (64)

  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • medium
    brace-expansion@5.0.9: 3 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7
    package-lock.json
  • medium
    undici@6.28.0: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm +3 more
    package-lock.json
  • medium
    undici@7.29.0: 18 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +13 more
    package-lock.json
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    bench/tools/fixtures/insecure-handlers.ts:32
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    bench/tools/fixtures/insecure-handlers.ts:37
  • low
    In tests/examples/docs: Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    bench/tools/fixtures/insecure-handlers.ts:42
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/hooks/capture-results.test.mjs:57
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/hooks/injection.test.mjs:202
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/hooks/redact.test.mjs:23
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/hooks/version-stamp-is-publish-time-only.test.mjs:296
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/compress/structural-ranges-cache.test.ts:23
  • low
    Possible example credential in docs/tests: jwt
    tests/unit/compress/structural.test.ts:30
  • low
    Possible example credential in docs/tests: jwt
    tests/unit/telemetry/stamp-telemetry-key.test.ts:23
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/hooks/derive.test.mjs:301
  • low
    deepmerge@4.3.1: 1 known vulnerability
    GHSA-gcqx-w48m-w2h4
    package-lock.json
  • low
    glob@10.5.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    package-lock.json
  • low
    glob@13.0.6: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    package-lock.json
  • low
    ip-address@10.5.0: 5 known vulnerabilities
    GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5
    package-lock.json
  • low
    minimatch@10.2.5: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    minimatch@10.2.6: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    minimatch@9.0.9: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    package-lock.json
  • low
    postcss-selector-parser@7.1.4: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    package-lock.json
  • low
    qs@6.16.0: 1 known vulnerability
    GHSA-6pq8-jhm2-2vcw
    package-lock.json
  • low
    package.json has a postinstall script
    node scripts/postinstall.cjs
    package.json
  • low
    Reads environment variables not listed in the manifest
    ALT_A_MODULE, ALT_A_DIST, ALT_A_ENV_PREFIX, BENCH_KNOWN_ANSWER_ARMS, BENCH_PYTHON, TOKEN_OPTIMIZER_BENCH_CENSUS, BENCH_KA_MIRROR_DIR, TURNS, DRY, TEMPERATURE, MODEL, ANTHROPIC_API_KEY, REQUEST_TIMEOUT_MS, MAX_ATTEMPTS, BENCH_KNOWN_ANSWER_OURS

Network activity

During install
nodejs.orgregistry.npmjs.org
While running
No connections

Tools exposed (19)

  • token_audit

    The one thing to run. A single ranked queue of what is costing the most in this project -- waste detectors, prompt-cache invalidation attributed to a file and line, and model routing -- each priced per session and per month, each naming how to act on it. Reports what already-applied fixes actually s

  • install_doctor

    Check that this installation actually works. Runs the real hook binaries with synthetic payloads and asserts a large read is refused and a small one is not, that session-start emits the policy, and that the graph directory is writable and private -- rather than checking that config files exist, whic

  • fleet_audit

    Look across every project on this machine at once: which projects hold the cost (ranked with dollar figures), which fixes proven in one project apply to others containing the SAME FILE CONTENTS, and how enforcing clients compare with directive ones as a natural experiment (reported with its confound

  • wiki_write

    Record a durable finding in this project's knowledge graph so a later session retrieves it instead of re-deriving it. Use it the moment you conclude something that cost real work and is not obvious from the code: a dead end and why, a decision and its rejected alternatives, a command that finally wo

  • wiki_read

    Retrieve what this project's knowledge graph already records about the files you are about to work on, so you do not re-derive it. Call it BEFORE reading a file you have not seen: it returns prior conclusions anchored to that file — dead ends and why, decisions and what was rejected, commands that w

  • wiki_query

    Read the project's knowledge graph: fetch a finding by key, search findings by terms, inspect a node and its neighbours, or get the graph's audit, token balance and overall shape. Use it when the session index mentions a finding you want in full, or to find out what the graph holds at all. NOT for a

  • expand

    Retrieve the full output behind a preview reference, served from the local store rather than by re-running anything. Pass `section` to say which named part of the preview you needed -- that is what teaches the next preview to keep it. Pass `claim` and `anchor` to record what you learned, so the same

  • waste_audit

    Report behavioural token waste in this project, ranked by cost per session and compared against the previous week. Detectors are a shipped floor plus patterns derived from this project's own history, each carrying what it has actually saved. Use action="apply" to put the fixes we own into force (rev

  • cache_audit

    Report Anthropic prompt-cache economics for this project: measured cache-read input, cache-write input, hit rate, and warm prefix size read from a Claude Code transcript, plus likely invalidation sources. Cost equivalents are labeled Anthropic-specific, excluded from universal savings, and are not i

  • model_routing

    Which model tier this project's work actually goes better on, measured from episode outcomes in the client transcript rather than guessed from task size. Reports expected cost per tier including retries, and prices BOTH mistakes: what an overpowered model wastes and what an underpowered one costs in

  • optimize_text

    Compress and cache text to reduce token usage. Returns compressed version and saves to cache for future use.

  • get_cached

    Retrieve previously cached and optimized text. Returns the original text if found in cache.

  • optimize_session

    Analyzes operations in the current session from the session JSONL log, identifies large text blocks from file-based tools (Read, Write, Edit), compresses them, and stores them in the cache to reduce future token usage. Returns a summary of the optimization.

  • smart_read

    Read files with intelligent caching, diff-based updates, and syntax-aware optimization. Measured token reduction vs reading the file: -2% to 0% first read, 99-99.9% repeated on an unchanged file (bench/tools, 3 fixtures) -- a first read returns the file plus a one-field header, so it still costs a l

  • smart_write

    Write files with an unmeasured design target of 85% token reduction through verification, atomic operations, and change tracking

  • smart_edit

    Edit files with an unmeasured design target of 90% token reduction through line-based operations and diff-only output

  • smart_glob

    Search files with glob patterns and an unmeasured design target of 75% token reduction through path-only results and smart filtering

  • smart_grep

    Search file contents with an unmeasured design target of 80% token reduction through match-only output and smart filtering

  • get_optimization_report

    Get a provenance-gated token report. Verified savings require a materialized MCP payload before and after optimization; historical and tool-reported estimates are excluded. Direct API-price equivalents use each exact captured model and route; ambiguous operations remain unpriced.

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Token Optimizer MCP alternatives

View more →

Similar mcp servers in Coding Agents, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Token Optimizer MCP (this page)
ooples
564MITNov 1, 2026Scanned, no flagged issues
Context Mode
mksglu
33kNone foundNov 1, 2026Not scanned yet
Serena
oraios
31kNone foundOct 28, 2026Not scanned yet
Fastmcp
PrefectHQ
28kApache-2.0Nov 1, 2026Scanned, no flagged issues
Nuclear
nukeop
19kAGPL-3.0Nov 1, 2026Scanned, no flagged issues
MCP For Beginners
microsoft
18kMITOct 30, 2026Scanned, no flagged issues