
Security News
Frontier AI Is Now Critical Infrastructure
The Fable shutdown shows how quickly model access can become a business continuity risk for AI-dependent engineering teams.
@yixi/token-doctor
Advanced tools
Local-only Claude Code spend analyzer. Reads your session transcripts and surfaces token waste. No signup, no cloud, no telemetry.
Local Claude Code spend analyzer. Free standalone tool.
tokenlens reads your local Claude Code session transcripts and tells you where your tokens went. No signup. No cloud upload. No telemetry. Runs entirely on your machine against the JSONL files Claude Code already writes to ~/.claude/projects/.
It surfaces:
Read calls in a row usually means a missed parallel batch# global
npm install -g @yixi/token-doctor
# or without install
npx @yixi/token-doctor
# Most recent session
tokenlens
# Most recent 3 sessions
tokenlens --recent 3
# Filter by project name substring
tokenlens --project my-app
# All sessions everywhere
tokenlens --all
# A specific session file
tokenlens ~/.claude/projects/-root-money/00782c0b-*.jsonl
# Machine-readable JSON
tokenlens --json > report.json
# Exit code only, no output
tokenlens --quiet
TOKENLENS REPORT
====================
00782c0b 1h 12m claude-opus-4-7
283 assistant turns — cost $188.67
tool-use: 177, other: 60, chat-only: 46
[LOW] Detected 4 streaks of ≥5 consecutive same-tool calls
Evidence: often a sign of one-at-a-time tool use where parallel calls would have worked
Fix: See CLAUDE.md section on "parallel tool calls when independent" — many sequential reads/greps can usually batch.
Pricing snapshot: May 2026. Cross-check with https://www.anthropic.com/pricing
| Code | Meaning |
|---|---|
| 0 | No HIGH waste signals |
| 1 | HIGH waste signals present (use this for shell scripting / CI gates) |
tokenlens uses pricing from May 2026, per Anthropic's public pricing page:
| Model | Input | Cache read | Cache write | Output | (per 1M tokens) |
|---|---|---|---|---|---|
| Opus 4.7 | $15.00 | $1.50 | $18.75 | $75.00 | |
| Sonnet 4.6 | $3.00 | $0.30 | $3.75 | $15.00 | |
| Haiku 4.5 | $1.00 | $0.10 | $1.25 | $5.00 |
Update src/pricing.js if Anthropic changes prices. Cross-check totals against your actual Anthropic console billing — tokenlens is an estimate, not an invoice.
tokenlens runs entirely on your machine:
~/.claude/projects/ (or wherever you point it)usage blocks, model names, tool names, and timestampsIf you're paranoid, the source is ~400 lines of zero-dependency Node. Read it.
This is a free standalone tool from the same author as Claude Operator — a production-grade CLAUDE.md and skill pack for senior engineering teams using Claude Code.
If you're shipping AI features and want the rest of the agent-quality story (a CLAUDE.md that stops "done" lies, 18 skills including db-migration-checker and n+1-finder, a verifier subagent that can't be talked into a soft PASS, a /ship gauntlet, and a hooks config that blocks rm -rf / and force-push) — the pack is $27 with a 7-day refund.
MIT.
Part of a small family of zero-dependency static-analysis CLIs:
@yixi/token-doctor — this tool@yixi/env-doctor — .env drift + committed-secret detector@yixi/dockerfile-doctor — Dockerfile production-safety linter@yixi/token-doctor differs by surfacing waste signals with dollar estimates rather than only reporting totals.
usage blocks are what the Claude API returns; if the API undercounts (it shouldn't, but bugs happen), this tool undercounts too.tool_use > thinking > text. A turn with both text and thinking is chat-thinking; a turn with only text is chat-only.FAQs
Local-only Claude Code spend analyzer. Reads your session transcripts and surfaces token waste. No signup, no cloud, no telemetry.
We found that @yixi/token-doctor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Fable shutdown shows how quickly model access can become a business continuity risk for AI-dependent engineering teams.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.