
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Measure the per-turn token tax your AI coding-agent instruction files (CLAUDE.md, AGENTS.md, Cursor/Copilot/Windsurf rules) add to every agent turn.
Coding agents re-send their instruction files with every turn. turntax measures that fixed per-turn cost for a repository, per tool and per model, and shows where to cut it.
npx turntax
It reads the files each agent actually loads (CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules, .github/copilot-instructions.md, Windsurf rules, skills) and applies each tool's documented loading rules: what is sent on every turn, what loads only when the agent works in a folder or touches a matching file, and what is ignored.
tool always o200k/turn on-demand model tokens/turn counted by 100 turns cached
Claude Code 4 272 53 Claude Sonnet 5.5 - needs --claude-api and ANTHROPIC_API_KEY - -
OpenAI Codex 1 63 0 GPT-6.1 Sol 63 estimate (o200k_base proxy) $0.01 $0.0006
Cursor 4 297 37 Claude Sonnet 5.5 - needs --claude-api and ANTHROPIC_API_KEY - -
GPT-6.1 Sol 297 estimate (o200k_base proxy) $0.06 $0.0030
Advice (savings are estimates in o200k tokens per turn)
HIGH duplicate CLAUDE.md, AGENTS.md [saves ~48 tokens/turn]
3 identical lines are loaded twice every turn by cursor. Keep them in one file.
HIGH contradiction AGENTS.md, CLAUDE.md [saves ~11 tokens/turn]
Conflicting package manager: "Always use npm ..." (AGENTS.md:3) vs "Always use pnpm ..." (CLAUDE.md:5).
MEDIUM scopable-section CLAUDE.md:11 [saves ~128 tokens/turn]
Section "API package" is mostly about packages/api/. Move it to packages/api/AGENTS.md ...
(Output for test/fixtures/mixed.)
| Model family | How tokens are counted | Label |
|---|---|---|
| OpenAI GPT-5.x, gpt-oss | Offline with o200k_base (the encoding OpenAI's tiktoken maps them to) | exact |
| OpenAI GPT-6.x | Offline with o200k_base; OpenAI has not published a newer encoding | estimate |
| Claude | Only Anthropic's count_tokens API, with your key and --claude-api | API count |
| Gemini | Only Google's countTokens API, with your key and --gemini-api | API count |
Claude's tokenizer is not public, and Anthropic's docs note that newer Claude models produce noticeably more tokens than older ones for the same text. turntax never shows an OpenAI count as a Claude or Gemini number: without a key those rows say "needs API key". The o200k column is a labelled reference count for every file.
Cost per N turns = tokens per turn × N × input price. The "cached" column assumes every turn reads the context from the prompt cache. Prices come from a dated table with a source link per model (turntax --list-models); pass --prices my-prices.json to use your own.
See docs/how-it-counts.md for the loading rules per tool and their sources.
All checks are deterministic. Each one shows an estimated saving in o200k tokens per turn.
applyTo)..md files in .cursor/rules or Windsurf rules without a trigger.npm run scripts that no longer exist.--english CLAUDE.md=CLAUDE.en.md) or, if you opt in, a Claude translation (--translate).turntax [path]
--tools claude-code,codex,gemini-cli,cursor,copilot,windsurf
--models <ids> see --list-models (default: claude-sonnet-5.5, gpt-6.1-sol, gemini-3.8-flash)
--turns <n> cost projection (default 100)
--json | --md | --badge output format (default: terminal table)
--out <file> write the output to a file
--max-tokens <n> exit 1 when any tool loads more than n o200k tokens per turn (CI gate)
--claude-api exact Claude counts (ANTHROPIC_API_KEY)
--gemini-api Gemini counts (GEMINI_API_KEY)
--english <file=en> measure a language multiplier against your English version
--translate opt-in Claude translation for that measurement (needs --claude-api)
--prices <file.json> your own price table
--section-tokens <n> threshold for oversized sections (default 600)
Offline by default: no network calls, no telemetry. File contents are sent only when you pass --claude-api, --gemini-api or --translate, and only to that vendor's API. Keys are read from environment variables and sent only in request headers.
web/ is a static page that runs the same engine in the browser with the offline tokenizer only. Drop a repository folder or paste files; nothing is uploaded.
Try it: https://torutdev.github.io/turntax/
npm run build:web
npx turntax --badge
The badge shows the largest always-loaded total among the tools found, counted with o200k_base.
~/.claude/CLAUDE.md, global rules, team rules in a dashboard) are not counted.Loading rules and prices go out of date. Corrections with a link to the vendor's page are the most useful contribution; see CONTRIBUTING.md.
MIT
FAQs
Measure the per-turn token cost of AI coding-agent instruction files (AGENTS.md, CLAUDE.md, Cursor, Copilot, Cline, Roo, Kiro, Windsurf and more) for every agent that reads them.
The npm package turntax receives a total of 453 weekly downloads. As such, turntax popularity was classified as not popular.
We found that turntax demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.