
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@mbeato/contextscope
Advanced tools
Local dashboard auditing Claude Code's per-turn token context (skills, agents, commands, CLAUDE.md, MEMORY.md, hooks, MCP) with toggle-based disable and session analytics.
A CLI + local dashboard that audits the per-turn token context Claude Code loads on every conversation turn — and gives you toggle-based control to disable what you don't use.
/stats, /cost, and ccusage show aggregate spend. None of them break down what's inside the per-turn baseline or let you act on the audit. At 1M-context Opus, every unused skill, agent, command, or hook output that lives in the available-list block is paying full cache-read cost on every turn — for a heavy user, that's hundreds of millions of tokens per month.
npx @mbeato/contextscope
Prints a 30-day audit to stdout in ~3s. Per-turn baseline, 30-day burn + API-equivalent cost, top disable candidates, context overhead. No browser, no server.
npx @mbeato/contextscope ui
Picks a free port starting at 3939, opens your browser. Adds: toggle-to-disable buttons, per-session drilldown, daily burn graph, by-project breakdown, hook + MCP detail.
Or install globally so the contextscope command stays around:
npm install -g @mbeato/contextscope
contextscope # quick CLI summary
contextscope ui # dashboard
Flags (ui only):
--port <n> — pin a port--no-open — don't auto-open the browser--help — full usageAfter installing globally, run:
contextscope install-plugin
This copies a /usage slash command into ~/.claude/commands/usage.md. Restart Claude Code, then /usage in any session asks Claude to launch the dashboard in the background and report the URL. Remove with contextscope uninstall-plugin.
.disabled suffix — reversible)enabledPlugins[<plugin>@<marketplace>] in ~/.claude/settings.json)settings.json before every mutation (~/.claude/settings.json.usage-bak-<timestamp>, 5 most recent kept)Toggles take effect on the next Claude Code restart — CC reads skills, agents, commands, and
settings.jsonat startup. There's no hot-reload mechanism.
Plugin-bundled skills/agents (e.g. superpowers:brainstorming, gsd:plan-phase) cannot be individually disabled in Claude Code's current model — you can only toggle the whole plugin. The "By plugin" table handles this; individual plugin items in the main table show (plugin) as their toggle status.
Uses js-tiktoken with the cl100k_base encoder as a proxy for Anthropic's tokenizer (not publicly released). Expect ~5–10% absolute deviation; relative rankings should be accurate.
available skills / available agents wrapper blocks the harness adds around your descriptionsgit clone <repo> contextscope
cd contextscope
npm install
npm run dev # localhost:3000 — slow page loads from Next.js dev bundling
npm run prod # build + start in production mode — ~0.6s warm reload
Requires Node 18+. macOS/Linux paths; Windows untested but uses os.homedir() throughout.
lib/transcripts.ts — unified single-pass JSONL parser with per-file mtime cache; consumed by usage.ts + sessions.tslib/inventory.ts — scans skills, agents, commands; detects .disabled siblings; reads enabledPluginslib/usage.ts — invocation counts per skill/agent from transcriptslib/sessions.ts — per-session token aggregation + summary statslib/files.ts — CLAUDE.md + MEMORY.md scanner with denylist for dependency-bundled noiselib/hooks.ts — reads settings.json hooks, parallel dry-runs SessionStart + UserPromptSubmitlib/mcp.ts — reads .claude.json mcpServers, parses PTC's downstream config.yamlapp/actions.ts — server actions for toggles + bulk disable; backs up settings before writeapp/page.tsx — single server-rendered page; filesystem re-read on every load (cached internally)bin/cli.js — CLI entry: routes to summary.js (default) or launches the Next.js dashboard (ui subcommand)bin/summary.js — pure-JS CLI summary; mirrors the lib/* logic without Next.js for the fast first-impression printoutMIT
FAQs
Local dashboard auditing Claude Code's per-turn token context (skills, agents, commands, CLAUDE.md, MEMORY.md, hooks, MCP) with toggle-based disable and session analytics.
The npm package @mbeato/contextscope receives a total of 19 weekly downloads. As such, @mbeato/contextscope popularity was classified as not popular.
We found that @mbeato/contextscope demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.