
Security News
Socket Named a Supply Chain Innovator in Latio's 2026 Application Security Market Report
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.
Count LOC (lines of code) and LLM tokens — fast. This npm package is a thin wrapper around the Rust CLI that downloads a prebuilt binary and exposes the loctok command on your system.
npx loctok # run without installing
# or
npm i -g loctok # install globally
If you prefer to build from source (Rust required):
cargo install loctok
loctok scans a directory, respecting .gitignore, and reports:
o200k_base)It only reads UTF‑8 text files and skips non‑UTF‑8 files silently.
# Count tokens in the current directory
loctok
# Count tokens in a specific path
loctok path/to/dir
# Choose output format: table (default), tree, json
loctok --format tree
loctok --format json > counts.json
# Choose encoding
loctok --encoding cl100k_base
# Filter by file extensions (comma-separated, no dots)
loctok --ext rs,ts,md
# Include hidden files (dotfiles)
loctok --hidden
# Silence progress output in scripts
loctok --format json 2>/dev/null
# See all options
loctok --help
# Concatenate filtered files and copy to clipboard
loctok copy # from current directory
loctok copy path/to/dir # from a given path
# Copy with filters and also print the content
loctok --ext rs,md --hidden copy --show
Supported encodings: o200k_base (default), cl100k_base, p50k_base, p50k_edit, r50k_base.
Table (default):
> loctok
595.17ms (655.27 files/s)
╭────────────┬───────────────┬─────────────╮
│ Language │ lines of code │ token count │
├────────────┼───────────────┼─────────────┤
│ Rust │ 109,910 │ 894,106 │
│ Other │ 13,705 │ 174,612 │
│ ... │ ...│ ... │
│ SUM: │ 138,280 │ 1,262,285 │
╰────────────┴───────────────┴─────────────╯
Tree view:
> loctok --format tree
379.96ms (21.05 files/s)
Name LOC TOK
--------------------------------------------
┌── lib.rs 332 3,213
├── main.rs 573 4,707
┌── src/ 905 7,920
...
./ 1,989 20,289
JSON:
{
"path": ".",
"encoding": "o200k_base",
"token_number": 200000,
"models": ["GPT-4o", "GPT-4.1", "o1", "o3", "o4"],
"total": 20431,
"files": [
{ "path": "./Cargo.toml", "lines": 26, "tokens": 201 },
{ "path": "./src/main.rs", "lines": 573, "tokens": 4707 }
],
"by_language": [
{ "language": "Rust", "lines": 974, "tokens": 8710 },
{ "language": "Markdown", "lines": 120, "tokens": 1316 }
]
}
Notes:
token_number and models are informative mapping hints.pbcopyclipxclip or xselUse copy to bundle filtered files into a single, structured payload that is copied to your clipboard. Optionally print it with --show.
loctok copy [PATH] [--show] [--ext rs,md] [--hidden]
Format snippet:
├── src
│ ├── lib.rs
│ └── main.rs
└── README.md
/src/lib.rs:
--------------------------------------------------------------------------------
1 | use anyhow::{Context, Result};
2 | // ...
Prebuilt binaries are provided for:
x64, arm64x64, arm64x64If your platform isn’t covered, build from source with cargo install loctok.
npm install into an internal vendor/ folder and exposes a small JS shim at bin/loctok.js.LOCTOK_DOWNLOAD_BASE to a base URL that mirrors the GitHub Releases layout.cargo install loctok.MIT or Apache-2.0
FAQs
Count LOC (lines of code) & TOK (LLM tokens), fast
We found that loctok demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.

Research
/Security News
Malicious Packagist packages disguised as Laravel utilities install an encrypted PHP RAT via Composer dependencies, enabling remote access and C2 callbacks.