Tokenlens Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Tokenlens Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Token intelligence layer for AI editors — analyze conversations, estimate costs, detect waste, and generate optimized prompts.
npm install
cp .env.example .env # fill in your values
npm run build
npm start # HTTP server on port 3000
npm run stdio # stdio transport for Claude Desktop| Tool | Description |
|---|---|
analyze_conversation | Token count, cost estimate, waste detection |
improve_prompt | Rewrite vague prompts into precise ones (local, no API) |
smart_compress | Compress context by importance score |
estimate_cost | Pre-flight cost estimate across all models |
get_budget_status | Daily token budget and alert level |
weekly_summary | Weekly usage vs last week |
export_report | Markdown report saved to ~/.tokenlens/reports/ |
POST /analyze-direct Analyze a conversation (no auth)
POST /improve-prompt Local prompt improvement (no auth)
POST /improve-prompt-ai AI-powered prompt improvement (user API key)
POST /generate-prompt AI prompt generation (user API key)
GET /dashboard Web UI
GET /health Health checkCopy .env.example to .env and set:
PORT=3000
ADMIN_SECRET=<strong-random-secret>AI provider keys are not required on the server — the Chrome Extension passes the user's own key per-request. Server-side keys are only needed if you add server-managed AI features.
Your API keys are never stored on our servers. All keys are stored locally on your device only.
localStorage — they never leave your machine/generate-prompt and /improve-prompt-ai endpoints receive your key only for the duration of the API call and do not log or persist it~/.tokenlens/sessions.db) — no data is sent to external servicesADMIN_SECRET in your .env before exposing the server to any networkThe production server is available at:
https://tokenlens-mcp-production.up.railway.app| Endpoint | URL |
|---|---|
| Health | https://tokenlens-mcp-production.up.railway.app/health |
| SSE (MCP) | https://tokenlens-mcp-production.up.railway.app/sse |
| Dashboard | https://tokenlens-mcp-production.up.railway.app/dashboard |
| Chrome Extension default server URL | https://tokenlens-mcp-production.up.railway.app |
Option A — Hosted (recommended): connect via SSE to the production server.
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"tokenlens": {
"url": "https://tokenlens-mcp-production.up.railway.app/sse",
"headers": { "Authorization": "Bearer YOUR_TOKEN" }
}
}
}Option B — Local stdio: run the server on your own machine.
{
"mcpServers": {
"tokenlens": {
"command": "node",
"args": ["/path/to/TokenLens MCP/dist/stdio.js"]
}
}
}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.