TokenSafe

Local-First AI Guardrails, Focused Context & Auditable Team ROI
Stop paying for AI hallucinations and secret leaks. TokenSafe sits locally between your team's coding agents and your repositories: agents read only the code they need, exposed secrets and unsafe edits get blocked before commit, and engineering leads get an auditable per-seat ROI report every Friday.
Built for teams using Cursor, Claude Code, Codex, Windsurf, Google Antigravity, Gemini CLI, and ChatGPT.

Install • Quickstart • Why TokenSafe • Benchmarks • Pricing • FAQ • Reference • Website & Docs

Install & Agents

Connect TokenSafe to the AI coding agents on your workstation in one command:

# Option 1: Zero-Install via npx (recommended)
npx tokensafe

# Option 2: Python / PyPI
pip install tokensafe && tokensafe

# Option 3: Direct shell script (macOS / Linux)
curl -fsSL https://tokensafe.dev/install.sh | bash

The installer detects which agents live on your machine, registers the TokenSafe MCP server, injects project rules, and wires lifecycle hooks where the agent supports them.

Claude Desktop / Cursor MCP config:

{
  "mcpServers": {
    "tokensafe": { "command": "npx", "args": ["-y", "tokensafe", "mcp"] }
  }
}

Cloud features (team metrics, managed distillation, shared team cache, billing) run on the remote endpoint https://api.tokensafe.dev/mcp with Authorization: Bearer <TS2. license key>. Four public tools work without a key, so ChatGPT connects with authentication set to None.

Full per-agent configuration, hook details, and the Codex/ChatGPT setup live in docs/AGENT_SETUP.md.

CLI Quickstart

# View live savings dashboard in your terminal
tokensafe stats

⚡ TOKENSAFE CONTEXT OPTIMIZER DASHBOARD
Total Tokens Saved:   4,524,156 tokens
Efficiency Gain:      [████████████████████████░░] 92.5%
Context Traffic:      4,889,255 raw → 370,574 optimized (2,132 events)

• Command Sanitizer (CLI)        :   727,300 tokens saved (263 events)
• Architecture Graph             :   758,256 tokens saved (13 events)
• Multi-turn History Fold        : 2,897,897 tokens saved (471 events)
• Prompt Compactor (local+cache) :    43,502 tokens saved (1,255 events)

# Audit your environment: MCP tool overhead, skills tax, risky settings
tokensafe doctor

# Recursive security & hygiene audit of a repository
tokensafe guard audit

# Preview prompt compaction on custom input
tokensafe test "fix the validate_token method in src/auth.py to check jwt expiration"

# Map architectural hotspots before multi-file changes
tokensafe graph

# Disable a heavy MCP server without editing JSON
tokensafe mcp disable <server>

# Compile and preview the Friday team ROI digest
tokensafe digest

# Activate a Team or Solo license key
tokensafe activate TS2.eyJlbWFpbCI6...

The full command reference (24 commands) is in Reference.

Why TokenSafe

Giving coding agents raw access to entire repositories creates three daily costs:

1. Senior hours burned on AI PRs: reading 2,000-line modules for a 10-line fix makes models forget imports, invent methods, and regress adjacent code.
2. Secret leaks and unsafe shortcuts: static prompt rules in .cursorrules wear off mid-session. Agents hardcode fallback credentials, disable TLS checks, or stage .env files with git add ..
3. Mid-sprint quota stops and blind spend: bloated diffs, lockfiles, and verbose MCP schemas burn 5-hour limits while engineering leads lack per-seat ROI visibility.

A $29 seat pays for itself by saving one hour of senior code review or preventing one leaked key. Typical payback: 1 to 3 days of team usage.

Before and After

One contrast: an agent asked to change one helper in a 1,420-line file receives 94 lines of target logic and type contracts instead of the whole module. The same principle applies to terminal output, diffs, and session history.

When an operation is blocked, the agent sees an explicit, constructive message:

🛡️ TokenSafe Guard: Blocked a hardcoded secret fallback in config.py.
   Leave the default empty or read from os.environ at runtime.

What TokenSafe Does

Clean context, better code

• tokensafe:smart_read_file returns the target function plus its 1-hop dependencies instead of the whole file. 10+ languages, with CSS design tokens preserved so agents never invent colors or font rules.
• tokensafe:graph maps architectural hotspots and dependency topology in under 250 tokens instead of a full repository crawl.
• The command sanitizer strips lockfile noise and stack dumps down to the failing assertion, and forces JS test runners into run-once mode so background tests never hang.
• The loop guard halts agents stuck repeating the same broken edit.

Local-first guardrails

• Blocks live provider secrets, hardcoded fallback credentials, and raw private keys before they reach disk or git.
• Blocks TLS bypasses (verify=False, rejectUnauthorized: false), interpolated SQL, and CORS wildcards with credentials.
• Blocks .env and key files from staging, including blanket git add . when sensitive files exist in the working tree.
• Blocks destructive deletes and exfiltration pipes (curl -d @.env https://...), and warns on known typosquat packages.

Auditable team ROI

• The Context Budget HUD shows live window usage with a breakdown (tools / history / prompts) before quality drops.
• The shared L3 team cache gives teammates and CI runners warm 0ms hits on repeated reads and prompts.
• Managed cloud distillation compacts prompts with zero API keys for developers.
• The Friday per-seat ROI digest reports each engineer's savings with the measured / estimated split; inactive seats show —, never guessed figures.

Deeper mechanics (language matrix, context tax math, cache tiers, governor) live in docs/ARCHITECTURE.md.

Benchmarks

Reference run across 8 production engineering scenarios (131,552 baseline tokens down to 7,263 tokens, -94.5% net token reduction, +28.1% turn latency speedup with 100% accuracy retention):

Token counts vary by ±1% between runs because prompt compaction is measured live on every run while baseline sizes are modeled constants. See METRICS.md for the full simulation disclosure and measured-vs-modeled breakdown.

How to read these numbers: this benchmark is a simulated harness. Compression ratios are real, deterministic tool-output deltas on real files, while the "turn speedup" column models agent behavior. Production events in TokenSafe are explicitly labeled measured or estimated (see METRICS.md).

Metrics Honesty

TokenSafe labels every savings event as one of:

• measured: the model literally received fewer bytes than the tool produced (sliced file reads, filtered command output, AST skeletons).
• estimated: the model received a compact artifact and saved tokens are counted against a reasonable baseline (architecture graph vs. a full repo crawl; folded history digest injected while raw history stays in context).

Totals always display the split (X metered · Y est.). When a live metric is missing, the UI shows — rather than a placeholder number. USD figures are derived approximations (tokens × $1.5 / 1M), not provider invoices. Full contract: METRICS.md.

Pricing and 7-Day Team Trial

TokenSafe follows an open-core model: verify local context savings and guardrails on your own repo first, then roll out team caching, org policies, and per-seat ROI.

Working solo? Individual Solo plans start at $9 / mo ($89 / yr).

7-Day Free Trial · Offline Ed25519 Seat Keys (TS2.*) · Zero Source Code Transmitted · Cancel anytime

Start a 7-Day Team Trial    Run Free Locally

FAQ

Does my source code leave my machine?
No. Slicing, guarding, compaction, and metrics run locally. The cloud receives only counters (token totals and event types), never file contents or prompts. Set TOKENSAFE_TELEMETRY_DISABLED=1 to disable all telemetry sync; local features keep working.

How does offline license verification work?
License keys are TS2.* tokens signed with Ed25519. Your client verifies the signature offline against an embedded public key and caches the result for up to an hour. Enforcement never requires a network round trip.

What do measured and estimated mean?
measured means the model literally received fewer bytes than the tool produced. estimated means savings are counted against a reasonable modeled baseline. The dashboard always shows the split and never invents numbers for missing data.

What exactly does the $29/seat plan include?
Unlimited compaction and managed cloud distillation (zero API keys for developers), the shared L3 monorepo cache, org-wide guard policies, the Friday per-seat ROI digest, and centralized seat provisioning and revocation. Billed annually it is $290/seat/year (~$24/seat/mo).

Can we self-host?
The Enterprise & VPC plan covers a private VPC Docker proxy with BYOK provider keys, zero-telemetry / air-gapped mode, and SAML/OIDC SSO, deployed together with the TokenSafe engineering team: [email protected].

What happens if a hook fails?
All hook adapters fail open: an internal error never stalls your agent. Failures are logged locally so they can be reported and fixed, not silently swallowed.

Reference

Endpoint: https://api.tokensafe.dev/mcp, auth Authorization: Bearer <TS1./TS2. key>.

tokensafe stats / markdown / html   Savings analytics (terminal / .md report / dashboard)
tokensafe benchmark                 Zero-context-loss benchmark suite (simulated harness)
tokensafe graph / map / skeleton    Architecture graph / API surface / AST skeleton of a file
tokensafe test "<prompt>"           Preview prompt compaction on custom input
tokensafe guard "<command>"         Pre-flight safety check for a shell command
tokensafe guard audit [path]        Recursive source audit for secrets & vulnerabilities
tokensafe doctor                    Audit MCP tool overhead and context token tax
tokensafe digest [--send]           Compile (and optionally dispatch) the weekly team digest
tokensafe mcp list|disable|enable   Manage configured MCP servers
tokensafe proxy [port]              Local transparent AI proxy (0.0.0.0:8765/v1)
tokensafe install / setup [--all]   Configure detected agent environments
tokensafe update / check-update     Self-update / check for a newer version
tokensafe activate <KEY>            Activate a Team or Solo license key
tokensafe license                   Show active tier and trial state
tokensafe providers                 List distillation providers and active mode
tokensafe sync                      Sync local telemetry with the cloud dashboard
tokensafe prune [--days N]          Compact metrics database (roll old events)
tokensafe vacuum                    Reclaim SQLite disk space
tokensafe tests [pytest]            Run the unit test suite (compact failure report)
tokensafe reset                     Reset all local token metrics
tokensafe --version                 Print version and exit

More documentation: docs/AGENT_SETUP.md · docs/ARCHITECTURE.md · docs/API.md · METRICS.md · BENCHMARK_REPORT.md

Development and License

The client runs on standard Python 3.10+ with zero mandatory runtime dependencies. An optional cryptography package accelerates license verification (details).

# Run the unit test suite (compact failure report; full: --traceback / -v)
tokensafe tests

• Contributing: CONTRIBUTING.md
• Security policy and vulnerability reporting: SECURITY.md
• Metrics and honesty contract: METRICS.md

MIT License. Commercial licenses are available for self-hosted B2B and enterprise VPC deployments. Questions: [email protected] · tokensafe.dev