@tokenzero/mcp 0.0.0-stage → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +202 -0
- package/bin/tokenzero-mcp.mjs +624 -0
- package/package.json +11 -4
- package/README.md +0 -3
package/LICENSE
ADDED
|
@@ -0,0 +1,202 @@
|
|
|
1
|
+
|
|
2
|
+
Apache License
|
|
3
|
+
Version 2.0, January 2004
|
|
4
|
+
http://www.apache.org/licenses/
|
|
5
|
+
|
|
6
|
+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
7
|
+
|
|
8
|
+
1. Definitions.
|
|
9
|
+
|
|
10
|
+
"License" shall mean the terms and conditions for use, reproduction,
|
|
11
|
+
and distribution as defined by Sections 1 through 9 of this document.
|
|
12
|
+
|
|
13
|
+
"Licensor" shall mean the copyright owner or entity authorized by
|
|
14
|
+
the copyright owner that is granting the License.
|
|
15
|
+
|
|
16
|
+
"Legal Entity" shall mean the union of the acting entity and all
|
|
17
|
+
other entities that control, are controlled by, or are under common
|
|
18
|
+
control with that entity. For the purposes of this definition,
|
|
19
|
+
"control" means (i) the power, direct or indirect, to cause the
|
|
20
|
+
direction or management of such entity, whether by contract or
|
|
21
|
+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
22
|
+
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
23
|
+
|
|
24
|
+
"You" (or "Your") shall mean an individual or Legal Entity
|
|
25
|
+
exercising permissions granted by this License.
|
|
26
|
+
|
|
27
|
+
"Source" form shall mean the preferred form for making modifications,
|
|
28
|
+
including but not limited to software source code, documentation
|
|
29
|
+
source, and configuration files.
|
|
30
|
+
|
|
31
|
+
"Object" form shall mean any form resulting from mechanical
|
|
32
|
+
transformation or translation of a Source form, including but
|
|
33
|
+
not limited to compiled object code, generated documentation,
|
|
34
|
+
and conversions to other media types.
|
|
35
|
+
|
|
36
|
+
"Work" shall mean the work of authorship, whether in Source or
|
|
37
|
+
Object form, made available under the License, as indicated by a
|
|
38
|
+
copyright notice that is included in or attached to the work
|
|
39
|
+
(an example is provided in the Appendix below).
|
|
40
|
+
|
|
41
|
+
"Derivative Works" shall mean any work, whether in Source or Object
|
|
42
|
+
form, that is based on (or derived from) the Work and for which the
|
|
43
|
+
editorial revisions, annotations, elaborations, or other modifications
|
|
44
|
+
represent, as a whole, an original work of authorship. For the purposes
|
|
45
|
+
of this License, Derivative Works shall not include works that remain
|
|
46
|
+
separable from, or merely link (or bind by name) to the interfaces of,
|
|
47
|
+
the Work and Derivative Works thereof.
|
|
48
|
+
|
|
49
|
+
"Contribution" shall mean any work of authorship, including
|
|
50
|
+
the original version of the Work and any modifications or additions
|
|
51
|
+
to that Work or Derivative Works thereof, that is intentionally
|
|
52
|
+
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
53
|
+
or by an individual or Legal Entity authorized to submit on behalf of
|
|
54
|
+
the copyright owner. For the purposes of this definition, "submitted"
|
|
55
|
+
means any form of electronic, verbal, or written communication sent
|
|
56
|
+
to the Licensor or its representatives, including but not limited to
|
|
57
|
+
communication on electronic mailing lists, source code control systems,
|
|
58
|
+
and issue tracking systems that are managed by, or on behalf of, the
|
|
59
|
+
Licensor for the purpose of discussing and improving the Work, but
|
|
60
|
+
excluding communication that is conspicuously marked or otherwise
|
|
61
|
+
designated in writing by the copyright owner as "Not a Contribution."
|
|
62
|
+
|
|
63
|
+
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
64
|
+
on behalf of whom a Contribution has been received by Licensor and
|
|
65
|
+
subsequently incorporated within the Work.
|
|
66
|
+
|
|
67
|
+
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
68
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
69
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
70
|
+
copyright license to reproduce, prepare Derivative Works of,
|
|
71
|
+
publicly display, publicly perform, sublicense, and distribute the
|
|
72
|
+
Work and such Derivative Works in Source or Object form.
|
|
73
|
+
|
|
74
|
+
3. Grant of Patent License. Subject to the terms and conditions of
|
|
75
|
+
this License, each Contributor hereby grants to You a perpetual,
|
|
76
|
+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
77
|
+
(except as stated in this section) patent license to make, have made,
|
|
78
|
+
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
79
|
+
where such license applies only to those patent claims licensable
|
|
80
|
+
by such Contributor that are necessarily infringed by their
|
|
81
|
+
Contribution(s) alone or by combination of their Contribution(s)
|
|
82
|
+
with the Work to which such Contribution(s) was submitted. If You
|
|
83
|
+
institute patent litigation against any entity (including a
|
|
84
|
+
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
85
|
+
or a Contribution incorporated within the Work constitutes direct
|
|
86
|
+
or contributory patent infringement, then any patent licenses
|
|
87
|
+
granted to You under this License for that Work shall terminate
|
|
88
|
+
as of the date such litigation is filed.
|
|
89
|
+
|
|
90
|
+
4. Redistribution. You may reproduce and distribute copies of the
|
|
91
|
+
Work or Derivative Works thereof in any medium, with or without
|
|
92
|
+
modifications, and in Source or Object form, provided that You
|
|
93
|
+
meet the following conditions:
|
|
94
|
+
|
|
95
|
+
(a) You must give any other recipients of the Work or
|
|
96
|
+
Derivative Works a copy of this License; and
|
|
97
|
+
|
|
98
|
+
(b) You must cause any modified files to carry prominent notices
|
|
99
|
+
stating that You changed the files; and
|
|
100
|
+
|
|
101
|
+
(c) You must retain, in the Source form of any Derivative Works
|
|
102
|
+
that You distribute, all copyright, patent, trademark, and
|
|
103
|
+
attribution notices from the Source form of the Work,
|
|
104
|
+
excluding those notices that do not pertain to any part of
|
|
105
|
+
the Derivative Works; and
|
|
106
|
+
|
|
107
|
+
(d) If the Work includes a "NOTICE" text file as part of its
|
|
108
|
+
distribution, then any Derivative Works that You distribute must
|
|
109
|
+
include a readable copy of the attribution notices contained
|
|
110
|
+
within such NOTICE file, excluding those notices that do not
|
|
111
|
+
pertain to any part of the Derivative Works, in at least one
|
|
112
|
+
of the following places: within a NOTICE text file distributed
|
|
113
|
+
as part of the Derivative Works; within the Source form or
|
|
114
|
+
documentation, if provided along with the Derivative Works; or,
|
|
115
|
+
within a display generated by the Derivative Works, if and
|
|
116
|
+
wherever such third-party notices normally appear. The contents
|
|
117
|
+
of the NOTICE file are for informational purposes only and
|
|
118
|
+
do not modify the License. You may add Your own attribution
|
|
119
|
+
notices within Derivative Works that You distribute, alongside
|
|
120
|
+
or as an addendum to the NOTICE text from the Work, provided
|
|
121
|
+
that such additional attribution notices cannot be construed
|
|
122
|
+
as modifying the License.
|
|
123
|
+
|
|
124
|
+
You may add Your own copyright statement to Your modifications and
|
|
125
|
+
may provide additional or different license terms and conditions
|
|
126
|
+
for use, reproduction, or distribution of Your modifications, or
|
|
127
|
+
for any such Derivative Works as a whole, provided Your use,
|
|
128
|
+
reproduction, and distribution of the Work otherwise complies with
|
|
129
|
+
the conditions stated in this License.
|
|
130
|
+
|
|
131
|
+
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
132
|
+
any Contribution intentionally submitted for inclusion in the Work
|
|
133
|
+
by You to the Licensor shall be under the terms and conditions of
|
|
134
|
+
this License, without any additional terms or conditions.
|
|
135
|
+
Notwithstanding the above, nothing herein shall supersede or modify
|
|
136
|
+
the terms of any separate license agreement you may have executed
|
|
137
|
+
with Licensor regarding such Contributions.
|
|
138
|
+
|
|
139
|
+
6. Trademarks. This License does not grant permission to use the trade
|
|
140
|
+
names, trademarks, service marks, or product names of the Licensor,
|
|
141
|
+
except as required for reasonable and customary use in describing the
|
|
142
|
+
origin of the Work and reproducing the content of the NOTICE file.
|
|
143
|
+
|
|
144
|
+
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
145
|
+
agreed to in writing, Licensor provides the Work (and each
|
|
146
|
+
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
147
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
148
|
+
implied, including, without limitation, any warranties or conditions
|
|
149
|
+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
150
|
+
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
151
|
+
appropriateness of using or redistributing the Work and assume any
|
|
152
|
+
risks associated with Your exercise of permissions under this License.
|
|
153
|
+
|
|
154
|
+
8. Limitation of Liability. In no event and under no legal theory,
|
|
155
|
+
whether in tort (including negligence), contract, or otherwise,
|
|
156
|
+
unless required by applicable law (such as deliberate and grossly
|
|
157
|
+
negligent acts) or agreed to in writing, shall any Contributor be
|
|
158
|
+
liable to You for damages, including any direct, indirect, special,
|
|
159
|
+
incidental, or consequential damages of any character arising as a
|
|
160
|
+
result of this License or out of the use or inability to use the
|
|
161
|
+
Work (including but not limited to damages for loss of goodwill,
|
|
162
|
+
work stoppage, computer failure or malfunction, or any and all
|
|
163
|
+
other commercial damages or losses), even if such Contributor
|
|
164
|
+
has been advised of the possibility of such damages.
|
|
165
|
+
|
|
166
|
+
9. Accepting Warranty or Additional Liability. While redistributing
|
|
167
|
+
the Work or Derivative Works thereof, You may choose to offer,
|
|
168
|
+
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
169
|
+
or other liability obligations and/or rights consistent with this
|
|
170
|
+
License. However, in accepting such obligations, You may act only
|
|
171
|
+
on Your own behalf and on Your sole responsibility, not on behalf
|
|
172
|
+
of any other Contributor, and only if You agree to indemnify,
|
|
173
|
+
defend, and hold each Contributor harmless for any liability
|
|
174
|
+
incurred by, or claims asserted against, such Contributor by reason
|
|
175
|
+
of your accepting any such warranty or additional liability.
|
|
176
|
+
|
|
177
|
+
END OF TERMS AND CONDITIONS
|
|
178
|
+
|
|
179
|
+
APPENDIX: How to apply the Apache License to your work.
|
|
180
|
+
|
|
181
|
+
To apply the Apache License to your work, attach the following
|
|
182
|
+
boilerplate notice, with the fields enclosed by brackets "[]"
|
|
183
|
+
replaced with your own identifying information. (Don't include
|
|
184
|
+
the brackets!) The text should be enclosed in the appropriate
|
|
185
|
+
comment syntax for the file format. We also recommend that a
|
|
186
|
+
file or class name and description of purpose be included on the
|
|
187
|
+
same "printed page" as the copyright notice for easier
|
|
188
|
+
identification within third-party archives.
|
|
189
|
+
|
|
190
|
+
Copyright [yyyy] [name of copyright owner]
|
|
191
|
+
|
|
192
|
+
Licensed under the Apache License, Version 2.0 (the "License");
|
|
193
|
+
you may not use this file except in compliance with the License.
|
|
194
|
+
You may obtain a copy of the License at
|
|
195
|
+
|
|
196
|
+
http://www.apache.org/licenses/LICENSE-2.0
|
|
197
|
+
|
|
198
|
+
Unless required by applicable law or agreed to in writing, software
|
|
199
|
+
distributed under the License is distributed on an "AS IS" BASIS,
|
|
200
|
+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
201
|
+
See the License for the specific language governing permissions and
|
|
202
|
+
limitations under the License.
|
|
@@ -0,0 +1,624 @@
|
|
|
1
|
+
#!/usr/bin/env node
|
|
2
|
+
// TokenZero MCP server (generated by mcp/build.mjs; do not edit)
|
|
3
|
+
|
|
4
|
+
// mcp/src/main.ts
|
|
5
|
+
import path2 from "node:path";
|
|
6
|
+
import readline from "node:readline";
|
|
7
|
+
|
|
8
|
+
// src/audit-core.ts
|
|
9
|
+
import crypto from "node:crypto";
|
|
10
|
+
|
|
11
|
+
// src/pricing.ts
|
|
12
|
+
var PRICING_VERSION = "2026-10-25";
|
|
13
|
+
var P = (provider, tier, input, output, cachedInput, cacheWrite, extra = {}) => ({ provider, tier, input, output, cachedInput, cacheWrite, ...extra });
|
|
14
|
+
var PRICES = {
|
|
15
|
+
// ---- OpenAI (standard tier, ≤272K; cache write = 30m TTL rate) ----
|
|
16
|
+
"gpt-6-astra": P("openai", "frontier", 10, 50, 1, 12.5, { longCtxAt: 272e3, longCtx: { input: 20, output: 75, cachedInput: 2, cacheWrite: 25 }, minCacheTokens: 1024 }),
|
|
17
|
+
"gpt-6.1-sol": P("openai", "mid", 2, 10, 0.1, 2.5, { longCtxAt: 272e3, longCtx: { input: 4, output: 15, cachedInput: 0.2, cacheWrite: 5 }, minCacheTokens: 1024 }),
|
|
18
|
+
"gpt-6-sol": P("openai", "mid", 2, 10, 0.2, 2.5, { longCtxAt: 272e3, longCtx: { input: 4, output: 15, cachedInput: 0.4, cacheWrite: 5 }, minCacheTokens: 1024 }),
|
|
19
|
+
"gpt-6-luna": P("openai", "fast", 0.1, 0.5, 0.01, 0.125, { longCtxAt: 272e3, longCtx: { input: 0.2, output: 0.75, cachedInput: 0.02, cacheWrite: 0.25 }, minCacheTokens: 1024 }),
|
|
20
|
+
"gpt-5.6-sol": P("openai", "frontier", 4, 20, 0.4, 5, { longCtxAt: 272e3, longCtx: { input: 8, output: 30, cachedInput: 0.8, cacheWrite: 10 }, minCacheTokens: 1024 }),
|
|
21
|
+
"gpt-5.6-terra": P("openai", "mid", 2, 12, 0.2, 2.5, { longCtxAt: 272e3, longCtx: { input: 4, output: 18, cachedInput: 0.4, cacheWrite: 5 }, minCacheTokens: 1024 }),
|
|
22
|
+
"gpt-5.6-luna": P("openai", "fast", 0.2, 1.2, 0.02, 0.25, { longCtxAt: 272e3, longCtx: { input: 0.4, output: 1.8, cachedInput: 0.04, cacheWrite: 0.5 }, minCacheTokens: 1024 }),
|
|
23
|
+
"gpt-5.5": P("openai", "frontier", 5, 30, 0.5, void 0, { longCtxAt: 272e3, longCtx: { input: 10, output: 45, cachedInput: 1 }, minCacheTokens: 1024 }),
|
|
24
|
+
"gpt-5.5-pro": P("openai", "frontier", 30, 180),
|
|
25
|
+
"gpt-5.4": P("openai", "frontier", 2.5, 15, 0.25, void 0, { longCtxAt: 272e3, longCtx: { input: 5, output: 22.5, cachedInput: 0.5 }, minCacheTokens: 1024 }),
|
|
26
|
+
"gpt-5.4-pro": P("openai", "frontier", 30, 180),
|
|
27
|
+
"gpt-5.4-mini": P("openai", "fast", 0.75, 4.5, 0.075, void 0, { minCacheTokens: 1024 }),
|
|
28
|
+
"gpt-5.4-nano": P("openai", "fast", 0.2, 1.25, 0.02, void 0, { minCacheTokens: 1024 }),
|
|
29
|
+
"gpt-5.2": P("openai", "frontier", 1.75, 14, 0.175, void 0, { minCacheTokens: 1024 }),
|
|
30
|
+
"gpt-5.2-pro": P("openai", "frontier", 21, 168),
|
|
31
|
+
"gpt-5.1": P("openai", "mid", 1.25, 10, 0.125, void 0, { minCacheTokens: 1024 }),
|
|
32
|
+
"gpt-5": P("openai", "mid", 1.25, 10, 0.125, void 0, { minCacheTokens: 1024 }),
|
|
33
|
+
"gpt-5-mini": P("openai", "fast", 0.25, 2, 0.025, void 0, { minCacheTokens: 1024 }),
|
|
34
|
+
"gpt-5-nano": P("openai", "fast", 0.05, 0.4, 5e-3, void 0, { minCacheTokens: 1024 }),
|
|
35
|
+
"gpt-5-pro": P("openai", "frontier", 15, 120),
|
|
36
|
+
"o3": P("openai", "mid", 2, 8, 0.5, void 0, { minCacheTokens: 1024 }),
|
|
37
|
+
"o3-pro": P("openai", "frontier", 20, 80),
|
|
38
|
+
"o3-mini": P("openai", "fast", 1.1, 4.4, 0.55, void 0, { minCacheTokens: 1024 }),
|
|
39
|
+
"o4-mini": P("openai", "fast", 1.1, 4.4, 0.275, void 0, { minCacheTokens: 1024 }),
|
|
40
|
+
"o1": P("openai", "frontier", 15, 60, 7.5),
|
|
41
|
+
"gpt-4.1": P("openai", "mid", 2, 8, 0.5, void 0, { minCacheTokens: 1024 }),
|
|
42
|
+
"gpt-4.1-mini": P("openai", "fast", 0.4, 1.6, 0.1, void 0, { minCacheTokens: 1024 }),
|
|
43
|
+
"gpt-4.1-nano": P("openai", "fast", 0.1, 0.4, 0.025, void 0, { minCacheTokens: 1024 }),
|
|
44
|
+
"gpt-4o": P("openai", "mid", 2.5, 10, 1.25, void 0, { minCacheTokens: 1024 }),
|
|
45
|
+
"gpt-4o-mini": P("openai", "fast", 0.15, 0.6, 0.075, void 0, { minCacheTokens: 1024 }),
|
|
46
|
+
// ---- Anthropic (cache write = 5-minute TTL, 1.25x; 1h TTL is 2x) ----
|
|
47
|
+
"claude-fable-5-1": P("anthropic", "frontier", 10, 50, 0.25, 12.5, { minCacheTokens: 512 }),
|
|
48
|
+
"claude-fable-5": P("anthropic", "frontier", 10, 50, 1, 12.5, { minCacheTokens: 512 }),
|
|
49
|
+
"claude-opus-5-5": P("anthropic", "frontier", 4, 20, 0.2, 5, { minCacheTokens: 512 }),
|
|
50
|
+
"claude-opus-5": P("anthropic", "frontier", 5, 25, 0.5, 6.25, { minCacheTokens: 512 }),
|
|
51
|
+
"claude-opus-4-8": P("anthropic", "frontier", 5, 25, 0.5, 6.25, { minCacheTokens: 1024 }),
|
|
52
|
+
"claude-opus-4-7": P("anthropic", "frontier", 5, 25, 0.5, 6.25, { minCacheTokens: 2048 }),
|
|
53
|
+
"claude-opus-4-6": P("anthropic", "frontier", 5, 25, 0.5, 6.25, { minCacheTokens: 4096 }),
|
|
54
|
+
"claude-opus-4-5": P("anthropic", "frontier", 5, 25, 0.5, 6.25, { minCacheTokens: 4096 }),
|
|
55
|
+
"claude-sonnet-5-5": P("anthropic", "mid", 2, 10, 0.2, 2.5, { minCacheTokens: 512 }),
|
|
56
|
+
"claude-sonnet-5": P("anthropic", "mid", 2, 10, 0.2, 2.5, { minCacheTokens: 1024 }),
|
|
57
|
+
"claude-sonnet-4-6": P("anthropic", "mid", 3, 15, 0.3, 3.75, { minCacheTokens: 1024 }),
|
|
58
|
+
"claude-sonnet-4-5": P("anthropic", "mid", 3, 15, 0.3, 3.75, { minCacheTokens: 1024 }),
|
|
59
|
+
"claude-haiku-5-5": P("anthropic", "fast", 0.1, 0.5, 0.01, 0.125, { minCacheTokens: 512, longCtxAt: 1e5, longCtx: { input: 0.5, output: 2.5, cachedInput: 0.05, cacheWrite: 0.625 } }),
|
|
60
|
+
"claude-haiku-4-5": P("anthropic", "fast", 1, 5, 0.1, 1.25, { minCacheTokens: 4096 }),
|
|
61
|
+
// ---- Google Gemini (paid tier; prices scheduled to rise Dec 2026/Jan 2027 — re-verify) ----
|
|
62
|
+
"gemini-4-argon": P("gemini", "frontier", 2, 10, 0.1),
|
|
63
|
+
"gemini-3.8-flash": P("gemini", "fast", 0.75, 3.75, 0.075),
|
|
64
|
+
"gemini-3.6-flash": P("gemini", "fast", 0.75, 3.75, 0.075),
|
|
65
|
+
"gemini-3.5-flash-lite": P("gemini", "fast", 0.3, 2.5, 0.03),
|
|
66
|
+
"gemini-3.1-pro": P("gemini", "frontier", 2, 12, 0.2, void 0, { longCtxAt: 2e5, longCtx: { input: 4, output: 18, cachedInput: 0.4 } }),
|
|
67
|
+
"gemini-3.1-flash-lite": P("gemini", "fast", 0.25, 1.5, 0.025),
|
|
68
|
+
"gemini-3-flash": P("gemini", "fast", 0.5, 3, 0.05),
|
|
69
|
+
"gemini-2.5-pro": P("gemini", "frontier", 1.25, 10, 0.125, void 0, { longCtxAt: 2e5, longCtx: { input: 2.5, output: 15, cachedInput: 0.25 } }),
|
|
70
|
+
"gemini-2.5-flash": P("gemini", "fast", 0.3, 2.5, 0.03),
|
|
71
|
+
"gemini-2.5-flash-lite": P("gemini", "fast", 0.1, 0.4, 0.01)
|
|
72
|
+
};
|
|
73
|
+
var CASCADE_TARGET = {
|
|
74
|
+
"gpt-6-astra": "gpt-6.1-sol",
|
|
75
|
+
"gpt-6.1-sol": "gpt-6-luna",
|
|
76
|
+
"gpt-6-sol": "gpt-6-luna",
|
|
77
|
+
"gpt-5.6-sol": "gpt-5.6-terra",
|
|
78
|
+
"gpt-5.6-terra": "gpt-5.6-luna",
|
|
79
|
+
"gpt-5.5": "gpt-5.4-mini",
|
|
80
|
+
"gpt-5.4": "gpt-5.4-mini",
|
|
81
|
+
"gpt-5.2": "gpt-5-mini",
|
|
82
|
+
"gpt-5.1": "gpt-5-mini",
|
|
83
|
+
"gpt-5": "gpt-5-mini",
|
|
84
|
+
"gpt-4.1": "gpt-4.1-mini",
|
|
85
|
+
"gpt-4o": "gpt-4o-mini",
|
|
86
|
+
"o3": "o4-mini",
|
|
87
|
+
"claude-fable-5-1": "claude-opus-5-5",
|
|
88
|
+
"claude-fable-5": "claude-opus-5-5",
|
|
89
|
+
"claude-opus-5-5": "claude-sonnet-5-5",
|
|
90
|
+
"claude-opus-5": "claude-sonnet-5-5",
|
|
91
|
+
"claude-opus-4-8": "claude-sonnet-5-5",
|
|
92
|
+
"claude-opus-4-7": "claude-sonnet-5-5",
|
|
93
|
+
"claude-opus-4-6": "claude-sonnet-4-6",
|
|
94
|
+
"claude-sonnet-5-5": "claude-haiku-5-5",
|
|
95
|
+
"claude-sonnet-5": "claude-haiku-5-5",
|
|
96
|
+
"claude-sonnet-4-6": "claude-haiku-4-5",
|
|
97
|
+
"claude-sonnet-4-5": "claude-haiku-4-5",
|
|
98
|
+
"gemini-4-argon": "gemini-3.8-flash",
|
|
99
|
+
"gemini-3.1-pro": "gemini-3.8-flash",
|
|
100
|
+
"gemini-3.8-flash": "gemini-3.5-flash-lite",
|
|
101
|
+
"gemini-2.5-pro": "gemini-2.5-flash",
|
|
102
|
+
"gemini-2.5-flash": "gemini-2.5-flash-lite"
|
|
103
|
+
};
|
|
104
|
+
var KEYS_BY_LENGTH = Object.keys(PRICES).sort((a, b) => b.length - a.length);
|
|
105
|
+
function normalizeModel(model) {
|
|
106
|
+
if (typeof model !== "string" || !model) return null;
|
|
107
|
+
let m = model.toLowerCase().trim();
|
|
108
|
+
m = m.replace(/^(openai|anthropic|google|models|vertex_ai)\//, "");
|
|
109
|
+
m = m.replace(/@\d{8}$/, "");
|
|
110
|
+
m = m.replace(/-(\d{8}|\d{4}-\d{2}-\d{2})$/, "");
|
|
111
|
+
m = m.replace(/-(latest|preview|customtools|thinking)$/, "");
|
|
112
|
+
if (PRICES[m]) return m;
|
|
113
|
+
for (const k of KEYS_BY_LENGTH) if (m.startsWith(k + "-") || m === k) return k;
|
|
114
|
+
return null;
|
|
115
|
+
}
|
|
116
|
+
function priceFor(model) {
|
|
117
|
+
const key = normalizeModel(model);
|
|
118
|
+
return key ? { key, ...PRICES[key] } : null;
|
|
119
|
+
}
|
|
120
|
+
function costOf(model, u) {
|
|
121
|
+
const p = priceFor(model);
|
|
122
|
+
if (!p) return null;
|
|
123
|
+
const tier = p.longCtx && p.longCtxAt && u.input > p.longCtxAt ? { ...p, ...p.longCtx } : p;
|
|
124
|
+
const cached = u.cachedInput ?? 0;
|
|
125
|
+
const written = u.cacheWrite ?? 0;
|
|
126
|
+
const fresh = Math.max(0, u.input - cached - written);
|
|
127
|
+
const M = 1e6;
|
|
128
|
+
return fresh * tier.input / M + cached * (tier.cachedInput ?? tier.input) / M + written * (tier.cacheWrite ?? tier.input) / M + u.output * tier.output / M;
|
|
129
|
+
}
|
|
130
|
+
|
|
131
|
+
// cli/src/tokens-lite.ts
|
|
132
|
+
function countTokens(text, _provider = "openai") {
|
|
133
|
+
if (!text) return 0;
|
|
134
|
+
const symbols = (text.match(/[{}[\]<>=;:(),"'`]/g) ?? []).length;
|
|
135
|
+
const cpt = symbols / text.length > 0.04 ? 3.2 : 4;
|
|
136
|
+
return Math.ceil(text.length / cpt);
|
|
137
|
+
}
|
|
138
|
+
|
|
139
|
+
// src/audit-core.ts
|
|
140
|
+
var MODEL_RE = /["'`](?:openai\/|anthropic\/|google\/|models\/)?((?:gpt-[\w.-]+|o[134](?:-mini|-pro)?(?:-[\w-]+)?|claude-[\w.-]+|gemini-[\w.-]+))["'`]/g;
|
|
141
|
+
var CALL_RE = [
|
|
142
|
+
[/\.chat\.completions\.(create|parse)\s*\(/, "openai-chat"],
|
|
143
|
+
[/\.responses\.(create|parse|stream)\s*\(/, "openai-responses"],
|
|
144
|
+
[/\.messages\.(create|stream|parse)\s*\(/, "anthropic-messages"],
|
|
145
|
+
[/\b(generateText|streamText|generateObject|streamObject)\s*\(/, "vercel-ai"],
|
|
146
|
+
[/\b(ChatOpenAI|AzureChatOpenAI)\s*\(/, "langchain-openai"],
|
|
147
|
+
[/\bChatAnthropic\s*\(/, "langchain-anthropic"],
|
|
148
|
+
[/\bChatGoogleGenerativeAI\s*\(/, "langchain-gemini"],
|
|
149
|
+
[/\binit_chat_model\s*\(/, "langchain"],
|
|
150
|
+
[/\.generate_content\s*\(|\.generateContent\s*\(/, "gemini-sdk"],
|
|
151
|
+
[/\blitellm\.(a?completion)\s*\(/, "litellm"]
|
|
152
|
+
];
|
|
153
|
+
var SOURCE_EXT = /\.(py|ts|tsx|js|jsx|mjs|cjs|rb|go|java|kt|rs|cs|php)$/i;
|
|
154
|
+
var SKIP_PATH = /(^|\/)(node_modules|dist|build|\.next|vendor|venv|\.venv|__pycache__|target|coverage|\.git)(\/|$)|\.min\.js$|\.lock$|\.d\.ts$|(^|\/)(test|tests|__tests__|spec)(\/|$)|[._-](test|spec)\.[a-z]+$|(^|\/)(public|static|assets)\/.*\.m?js$|(^|\/)(workbox|sw|service-worker)[\w.-]*\.js$|[.-][a-f0-9]{8,}\.m?js$|\.bundle\.m?js$/i;
|
|
155
|
+
var EXAMPLE_PATH = /(^|\/)(examples?|docs?|cookbooks?|samples?|demos?|notebooks?|benchmarks?|scripts)(\/|$)/i;
|
|
156
|
+
var MANIFEST_FILES = ["package.json", "pyproject.toml", "setup.py", "setup.cfg"];
|
|
157
|
+
var TRIPLE_DQ = '"'.repeat(3);
|
|
158
|
+
var TRIPLE_SQ = "'".repeat(3);
|
|
159
|
+
function lex(src, path3) {
|
|
160
|
+
const py = /\.py$/i.test(path3), hashComments = py || /\.(rb|php)$/i.test(path3);
|
|
161
|
+
const backtick = /\.(js|jsx|ts|tsx|mjs|cjs|go)$/i.test(path3);
|
|
162
|
+
const out = src.split("");
|
|
163
|
+
const literals = [];
|
|
164
|
+
let i = 0, line = 1;
|
|
165
|
+
const blank = (a, b) => {
|
|
166
|
+
for (let k = a; k < b; k++) if (out[k] !== "\n") out[k] = " ";
|
|
167
|
+
};
|
|
168
|
+
const advance = (a, b) => {
|
|
169
|
+
for (let k = a; k < b; k++) if (src[k] === "\n") line++;
|
|
170
|
+
};
|
|
171
|
+
while (i < src.length) {
|
|
172
|
+
const c = src[i], two = src.slice(i, i + 2), three = src.slice(i, i + 3);
|
|
173
|
+
if (hashComments && c === "#" || !py && two === "//") {
|
|
174
|
+
let j = src.indexOf("\n", i);
|
|
175
|
+
if (j < 0) j = src.length;
|
|
176
|
+
blank(i, j);
|
|
177
|
+
i = j;
|
|
178
|
+
continue;
|
|
179
|
+
}
|
|
180
|
+
if (!py && two === "/*") {
|
|
181
|
+
let j = src.indexOf("*/", i + 2);
|
|
182
|
+
j = j < 0 ? src.length : j + 2;
|
|
183
|
+
blank(i, j);
|
|
184
|
+
advance(i, j);
|
|
185
|
+
i = j;
|
|
186
|
+
continue;
|
|
187
|
+
}
|
|
188
|
+
if (py && (three === TRIPLE_DQ || three === TRIPLE_SQ)) {
|
|
189
|
+
let j = src.indexOf(three, i + 3);
|
|
190
|
+
j = j < 0 ? src.length : j + 3;
|
|
191
|
+
literals.push({ text: src.slice(i + 3, Math.max(i + 3, j - 3)), line });
|
|
192
|
+
blank(i + 3, Math.max(i + 3, j - 3));
|
|
193
|
+
advance(i, j);
|
|
194
|
+
i = j;
|
|
195
|
+
continue;
|
|
196
|
+
}
|
|
197
|
+
if (c === '"' || c === "'" || backtick && c === "`") {
|
|
198
|
+
let j = i + 1;
|
|
199
|
+
while (j < src.length && src[j] !== c) {
|
|
200
|
+
if (src[j] === "\\") j++;
|
|
201
|
+
else if (src[j] === "\n" && c !== "`") break;
|
|
202
|
+
j++;
|
|
203
|
+
}
|
|
204
|
+
const end = Math.min(j, src.length);
|
|
205
|
+
literals.push({ text: src.slice(i + 1, end), line });
|
|
206
|
+
blank(i + 1, end);
|
|
207
|
+
advance(i, end + 1);
|
|
208
|
+
i = end + 1;
|
|
209
|
+
continue;
|
|
210
|
+
}
|
|
211
|
+
if (c === "\n") line++;
|
|
212
|
+
i++;
|
|
213
|
+
}
|
|
214
|
+
return { masked: out.join("").split("\n"), literals };
|
|
215
|
+
}
|
|
216
|
+
function promptLike(t) {
|
|
217
|
+
if (t.length < 200) return false;
|
|
218
|
+
const tags = (t.match(/<\/?[a-z][\w-]*[^>]*>/gi) ?? []).length;
|
|
219
|
+
const cssRules = (t.match(/[{;]\s*[a-z-]+\s*:\s*[^;{}]+;/gi) ?? []).length;
|
|
220
|
+
const codeChars = (t.match(/[{}();=<>]/g) ?? []).length;
|
|
221
|
+
const words = (t.match(/[A-Za-z]{2,}/g) ?? []).length;
|
|
222
|
+
return tags < 4 && cssRules < 3 && codeChars / t.length < 0.03 && words / (t.length / 6) > 0.5;
|
|
223
|
+
}
|
|
224
|
+
var SIMPLE_TASK = /\b(classify|classification|categori[sz]e|sentiment|extract (the|all|every|any)|return (only |just )?(valid |a )?json|respond (only )?(with|in) (valid )?json|output (only )?(valid )?json|translate (this|the following|into)|summari[sz]e (this|the following|in \d+)|label (this|the|each)|is (this|it) spam|yes or no|true or false)\b/i;
|
|
225
|
+
var LLM_LIB_EXACT = /* @__PURE__ */ new Set(["openai", "anthropic", "@anthropic-ai/sdk", "ai", "litellm", "openai-agents", "@openai/agents", "instructor", "dspy", "dspy-ai", "guidance", "semantic-kernel", "haystack-ai", "autogen", "pyautogen", "autogen-agentchat", "crewai", "google-genai", "@google/genai", "mistralai", "@mistralai/mistralai", "cohere", "cohere-ai", "llama-index", "llama_index", "llamaindex", "langchain", "langgraph", "@langchain/core", "groq-sdk", "together-ai", "ollama"]);
|
|
226
|
+
var LLM_LIB_FAMILY = /^(@langchain\/[\w-]+|langchain[-_][\w-]+|langgraph[-_][\w-]+|llama[-_]index[-_][\w-]+|@ai-sdk\/[\w-]+|openai[-_]agents[-_][\w-]+)$/i;
|
|
227
|
+
var isLlmLib = (name) => LLM_LIB_EXACT.has(name.toLowerCase()) || LLM_LIB_FAMILY.test(name);
|
|
228
|
+
var APP_DEPS = ["next", "react-dom", "express", "fastify", "hono", "@remix-run/react", "nuxt", "svelte", "@sveltejs/kit", "electron"];
|
|
229
|
+
function detectRepoKind(manifests2, files) {
|
|
230
|
+
const get = (n) => manifests2.find((m) => m.path === n)?.content ?? "";
|
|
231
|
+
const pkgRaw = get("package.json");
|
|
232
|
+
if (pkgRaw) {
|
|
233
|
+
try {
|
|
234
|
+
const pkg = JSON.parse(pkgRaw);
|
|
235
|
+
if (pkg.name && isLlmLib(pkg.name)) return { kind: "library", reason: `package "${pkg.name}" is an LLM SDK/framework` };
|
|
236
|
+
const deps = { ...pkg.dependencies };
|
|
237
|
+
const appDep = APP_DEPS.some((d) => d in deps);
|
|
238
|
+
const publishable = !pkg.private && (pkg.exports || pkg.main || pkg.module || pkg.types) && (pkg.files || pkg.publishConfig);
|
|
239
|
+
if (publishable && !appDep) return { kind: "library", reason: "publishable npm package layout (exports/main + files, not private)" };
|
|
240
|
+
if (pkg.private || appDep) return { kind: "app", reason: "private package or app framework dependency" };
|
|
241
|
+
} catch {
|
|
242
|
+
}
|
|
243
|
+
}
|
|
244
|
+
const pyproject = get("pyproject.toml"), setup = get("setup.py") + get("setup.cfg");
|
|
245
|
+
const pyName = /^\s*name\s*=\s*["']([^"']+)["']/m.exec(pyproject)?.[1] ?? /name\s*=\s*["']([^"']+)["']/.exec(setup)?.[1];
|
|
246
|
+
if (pyName && isLlmLib(pyName)) return { kind: "library", reason: `Python package "${pyName}" is an LLM SDK/framework` };
|
|
247
|
+
const webApp = files.some((f) => /(^|\/)app\/(layout|page)\.[jt]sx?$|(^|\/)pages\/(_app|index)\.[jt]sx?$|(^|\/)src\/routes\/\+page\.svelte$/.test(f.path));
|
|
248
|
+
const hasAppEntry = files.some((f) => /^(app|main|server|manage|streamlit_app|bot)\.py$/i.test(f.path) || /^(app|api|server)\//i.test(f.path) && /\b(FastAPI|Flask|Django|streamlit|gradio)\b/.test(f.content));
|
|
249
|
+
const installable = pyproject.includes("[build-system]") && /^\s*\[project\]/m.test(pyproject) || /\bsetup\(/.test(setup);
|
|
250
|
+
if (webApp) return { kind: "app", reason: "web app routes found (Next.js / SvelteKit)" };
|
|
251
|
+
if (installable && files.some((f) => /^src\/[\w-]+\//.test(f.path)) && !hasAppEntry) return { kind: "library", reason: "installable Python package with src/ layout and no app entry point" };
|
|
252
|
+
if (hasAppEntry) return { kind: "app", reason: "app entry point found" };
|
|
253
|
+
return { kind: "unknown", reason: "no manifest signal" };
|
|
254
|
+
}
|
|
255
|
+
var DOWN = { high: "medium", medium: "low", low: "info", info: "info" };
|
|
256
|
+
function analyzeFiles(files, repo = null, manifests2 = []) {
|
|
257
|
+
const findings = [];
|
|
258
|
+
const callSites = [];
|
|
259
|
+
const siteFindings = [];
|
|
260
|
+
const models = {};
|
|
261
|
+
const unknownModels = /* @__PURE__ */ new Set();
|
|
262
|
+
const notes = [];
|
|
263
|
+
const sources = files.filter((f) => SOURCE_EXT.test(f.path) && !SKIP_PATH.test(f.path) && f.content.length <= 4e5);
|
|
264
|
+
const { kind, reason } = detectRepoKind(manifests2, sources);
|
|
265
|
+
if (kind === "library") notes.push(`Library/SDK layout detected (${reason}): call sites are most likely pass-through wrappers where the caller chooses the model and prompt, so findings are downgraded one level and the estimate is discounted.`);
|
|
266
|
+
const promptLibrary = [];
|
|
267
|
+
const repoCaches = sources.some((f) => /cache_control|cacheControl|prompt_cache_key|promptCacheKey|cachedContent|cached_content/.test(f.content));
|
|
268
|
+
const PROMPT_FILE = /(^|\/)[^/]*(prompt|instruction|template|persona)s?[^/]*\.[a-z]+$|(^|\/)prompts?\//i;
|
|
269
|
+
const PROMPT_NAME = /\b[\w.]*(prompt|system|instruction|template|persona)\w*\s*(:\s*[\w[\]|. ]+)?\s*[:=]\s*(f|r|rf|fr|b)?$/i;
|
|
270
|
+
for (const f of sources) {
|
|
271
|
+
const src = f.content, lines = src.split("\n");
|
|
272
|
+
const { masked, literals } = lex(src, f.path);
|
|
273
|
+
for (const l of literals) {
|
|
274
|
+
if (!promptLike(l.text)) continue;
|
|
275
|
+
const tokens = countTokens(l.text);
|
|
276
|
+
if (tokens < 300) continue;
|
|
277
|
+
const lead = (masked[l.line - 1] ?? "").slice(0, Math.max(0, (masked[l.line - 1] ?? "").search(/["'`]|$/))).trimEnd();
|
|
278
|
+
if (PROMPT_FILE.test(f.path) || PROMPT_NAME.test(lead) || PROMPT_NAME.test((masked[l.line - 2] ?? "").trimEnd())) promptLibrary.push({ file: f.path, line: l.line, tokens });
|
|
279
|
+
}
|
|
280
|
+
const hasCacheControl = /cache_control|cacheControl|prompt_cache_key|promptCacheKey|cachedContent|cached_content/.test(src);
|
|
281
|
+
const illustrative = EXAMPLE_PATH.test(f.path);
|
|
282
|
+
let repeatFlagged = false;
|
|
283
|
+
masked.forEach((code, i) => {
|
|
284
|
+
const sdk = CALL_RE.find(([re]) => re.test(code))?.[1];
|
|
285
|
+
if (!sdk) return;
|
|
286
|
+
const local = [];
|
|
287
|
+
const push = (fd) => {
|
|
288
|
+
let sev = fd.severity;
|
|
289
|
+
if (kind === "library") sev = DOWN[sev];
|
|
290
|
+
if (illustrative) sev = DOWN[sev];
|
|
291
|
+
local.push({ ...fd, severity: sev });
|
|
292
|
+
};
|
|
293
|
+
const window = lines.slice(i, Math.min(lines.length, i + 30)).join("\n");
|
|
294
|
+
const model = [...window.matchAll(MODEL_RE)].map((m) => m[1])[0] ?? null;
|
|
295
|
+
callSites.push({ file: f.path, line: i + 1, model, sdk });
|
|
296
|
+
if (model) models[model] = (models[model] ?? 0) + 1;
|
|
297
|
+
const key = normalizeModel(model);
|
|
298
|
+
const price = key ? priceFor(key) : null;
|
|
299
|
+
const near = literals.filter((l) => l.line >= i + 1 - 40 && l.line <= i + 1 + 40);
|
|
300
|
+
const prompts = near.filter((l) => promptLike(l.text));
|
|
301
|
+
const codeCtx = masked.slice(Math.max(0, i - 25), i + 25).join("\n");
|
|
302
|
+
const simpleTask = near.some((l) => SIMPLE_TASK.test(l.text));
|
|
303
|
+
const isAnthropic = sdk.includes("anthropic") || (model?.startsWith("claude") ?? false);
|
|
304
|
+
const bigTok = prompts.reduce((a, l) => a + countTokens(l.text), 0);
|
|
305
|
+
if (bigTok >= 300 && !hasCacheControl) {
|
|
306
|
+
const readRate = price?.cachedInput != null && price.input ? Math.round((1 - price.cachedInput / price.input) * 100) : 90;
|
|
307
|
+
const min = price?.minCacheTokens ?? 1024;
|
|
308
|
+
const cacheable = bigTok >= min || isAnthropic && bigTok >= 512;
|
|
309
|
+
push({
|
|
310
|
+
severity: isAnthropic ? bigTok >= 1500 ? "high" : cacheable ? "medium" : "low" : cacheable ? "medium" : "low",
|
|
311
|
+
file: f.path,
|
|
312
|
+
line: prompts[0].line,
|
|
313
|
+
title: `~${bigTok.toLocaleString()} static prompt tokens re-billed at full price on every call`,
|
|
314
|
+
detail: isAnthropic ? `This call sends a large fixed prompt but never marks a cache breakpoint, so Anthropic bills all ${bigTok} tokens at the full input rate each time instead of the cache-read rate (${readRate}% cheaper).` : `A fixed prefix of ~${bigTok} tokens is sent on every call. Prefix caching applies only to stable prefixes of at least ${min} tokens on this model; keep the static part first and nothing volatile (timestamps, ids) interpolated into it.`,
|
|
315
|
+
fix: isAnthropic ? 'Route through TokenZero (breakpoints are injected automatically) or add `cache_control: {type: "ephemeral"}` to the last system block and the last tool.' : "Route through TokenZero to get a stable `prompt_cache_key`, or move dynamic content below the static prefix and set `prompt_cache_key` yourself.",
|
|
316
|
+
// OpenAI/Gemini already cache stable prefixes automatically; the recoverable part
|
|
317
|
+
// is prefix hygiene and cache routing, not the whole cache discount.
|
|
318
|
+
est_savings_pct: !cacheable ? 0 : isAnthropic ? Math.min(85, Math.round(bigTok / (bigTok + 400) * readRate)) : 15
|
|
319
|
+
});
|
|
320
|
+
}
|
|
321
|
+
if (key && price?.tier === "frontier" && CASCADE_TARGET[key] && simpleTask) {
|
|
322
|
+
const to = CASCADE_TARGET[key];
|
|
323
|
+
const a = costOf(key, { input: 1500, output: 200 }), b = costOf(to, { input: 1500, output: 200 });
|
|
324
|
+
push({
|
|
325
|
+
severity: "high",
|
|
326
|
+
file: f.path,
|
|
327
|
+
line: i + 1,
|
|
328
|
+
title: `${key} used for a task whose prompt reads like extraction/classification`,
|
|
329
|
+
detail: `Frontier pricing ($${price.input}/M in, $${price.output}/M out) on a constrained task. ${to} costs ~${Math.round((1 - b / a) * 100)}% less per call at this shape.`,
|
|
330
|
+
fix: `Opt into TokenZero cascade routing (\`X-TokenZero-Cascade: auto\`) so this call is routed to ${to} only when the classifier is confident, with parity reported in the ledger, or switch the model here behind an eval.`,
|
|
331
|
+
est_savings_pct: Math.round((1 - b / a) * 100)
|
|
332
|
+
});
|
|
333
|
+
}
|
|
334
|
+
const above = masked.slice(Math.max(0, i - 6), i).join("\n");
|
|
335
|
+
if (/^\s*(for|while)\b|\.map\(|\.forEach\(|asyncio\.gather|Promise\.all/m.test(above) && !/batch/i.test(codeCtx)) {
|
|
336
|
+
push({
|
|
337
|
+
severity: "medium",
|
|
338
|
+
file: f.path,
|
|
339
|
+
line: i + 1,
|
|
340
|
+
title: "LLM call inside a loop",
|
|
341
|
+
detail: "Per-item calls repeat the full prompt prefix for every element. If items are independent and latency-tolerant, the provider Batch API is 50% cheaper; if the prefix is shared, caching pays off immediately.",
|
|
342
|
+
fix: "Batch where possible; otherwise keep the shared prefix cache-formatted (TokenZero does this automatically).",
|
|
343
|
+
est_savings_pct: 25
|
|
344
|
+
});
|
|
345
|
+
}
|
|
346
|
+
if (simpleTask && !repeatFlagged && !/seed\s*[:=]|temperature\s*[:=]\s*0\b/.test(codeCtx)) {
|
|
347
|
+
repeatFlagged = true;
|
|
348
|
+
push({
|
|
349
|
+
severity: "info",
|
|
350
|
+
file: f.path,
|
|
351
|
+
line: i + 1,
|
|
352
|
+
title: "Repeat-prone task with no response-cache opt-in",
|
|
353
|
+
detail: "Classification and extraction calls often see identical inputs. Without a determinism signal no proxy can safely serve repeats from cache.",
|
|
354
|
+
fix: "If identical inputs should get identical answers, send `X-TokenZero-Cache: always` on these calls (or `temperature: 0` / a `seed` on models that still accept them). Repeats are then served in <10 ms at $0.",
|
|
355
|
+
est_savings_pct: 10
|
|
356
|
+
});
|
|
357
|
+
}
|
|
358
|
+
if (isAnthropic && /\btools\s*[:=]/.test(masked.slice(i, i + 30).join("\n")) && !hasCacheControl) {
|
|
359
|
+
push({
|
|
360
|
+
severity: "low",
|
|
361
|
+
file: f.path,
|
|
362
|
+
line: i + 1,
|
|
363
|
+
title: "Tool definitions sent without a cache breakpoint",
|
|
364
|
+
detail: "Tool schemas render before the system prompt in the cached prefix. Without a breakpoint on the last tool they are billed in full on every call.",
|
|
365
|
+
fix: "TokenZero marks the last tool automatically; manually, add `cache_control` to the last tool definition.",
|
|
366
|
+
est_savings_pct: 8
|
|
367
|
+
});
|
|
368
|
+
}
|
|
369
|
+
if (model && !key && !unknownModels.has(model)) {
|
|
370
|
+
unknownModels.add(model);
|
|
371
|
+
push({ severity: "info", file: f.path, line: i + 1, title: `Unrecognised model id "${model}"`, detail: "Not in the current pricing table: it may be retired or renamed. Retired models return errors or are silently remapped by some providers.", fix: "Check the provider model list; TokenZero flags unpriced models in `X-TokenZero-Warning`.", est_savings_pct: 0 });
|
|
372
|
+
}
|
|
373
|
+
findings.push(...local);
|
|
374
|
+
siteFindings.push(local);
|
|
375
|
+
});
|
|
376
|
+
}
|
|
377
|
+
const libTokens = promptLibrary.reduce((a, p) => a + p.tokens, 0);
|
|
378
|
+
if (callSites.length && !repoCaches && libTokens >= 1024 && !findings.some((f) => /static prompt tokens/.test(f.title))) {
|
|
379
|
+
const anth = callSites.filter((c) => c.sdk.includes("anthropic") || c.model?.startsWith("claude")).length;
|
|
380
|
+
const anthropicHeavy = anth * 2 >= callSites.length;
|
|
381
|
+
const top = promptLibrary.slice().sort((a, b) => b.tokens - a.tokens)[0];
|
|
382
|
+
const sev = anthropicHeavy ? libTokens >= 3e3 ? "high" : "medium" : "medium";
|
|
383
|
+
const fd = {
|
|
384
|
+
severity: kind === "library" ? DOWN[sev] : sev,
|
|
385
|
+
file: top.file,
|
|
386
|
+
line: top.line,
|
|
387
|
+
title: `${promptLibrary.length} static prompt template(s), ~${libTokens.toLocaleString()} tokens, and no caching directive anywhere in the repo`,
|
|
388
|
+
detail: anthropicHeavy ? "Most call sites use Anthropic, which only discounts cached input when the request marks a cache breakpoint. None of these prompts can be served from cache as written, so every call pays the full input rate for them." : "Most call sites use providers with automatic prefix caching, which only pays off when these templates are sent as a byte-identical prefix: static template first, nothing volatile (dates, ids, user data) interpolated into it.",
|
|
389
|
+
fix: anthropicHeavy ? 'Route through TokenZero (breakpoints are injected on tools and system automatically) or add `cache_control: {type: "ephemeral"}` after each static template.' : "Keep templates first and static; TokenZero adds a stable `prompt_cache_key` so related requests land on the same cache.",
|
|
390
|
+
est_savings_pct: anthropicHeavy ? Math.min(70, Math.round(libTokens / (libTokens + 2e3) * 85)) : 12
|
|
391
|
+
};
|
|
392
|
+
findings.push(fd);
|
|
393
|
+
for (const site of siteFindings) site.push(fd);
|
|
394
|
+
}
|
|
395
|
+
const weight = { high: 1, medium: 0.6, low: 0.3, info: 0 };
|
|
396
|
+
const perSite = siteFindings.map((fs2) => 1 - fs2.reduce((rem, f) => rem * (1 - f.est_savings_pct / 100 * weight[f.severity]), 1));
|
|
397
|
+
let waste = perSite.length ? perSite.reduce((a, b) => a + b, 0) / perSite.length : 0;
|
|
398
|
+
if (kind === "library") waste *= 0.3;
|
|
399
|
+
const wastePct = Math.round(Math.min(0.7, waste) * 100);
|
|
400
|
+
if (!callSites.length) notes.push("No recognised LLM call sites (OpenAI, Anthropic, Gemini, Vercel AI SDK, LangChain, LiteLLM). Calls behind custom wrappers are not detected.");
|
|
401
|
+
const topModel = Object.entries(models).sort((a, b) => b[1] - a[1]).map(([m]) => normalizeModel(m)).find(Boolean) ?? null;
|
|
402
|
+
let cost = null;
|
|
403
|
+
if (topModel && PRICES[topModel]) {
|
|
404
|
+
const assumed = 2e3;
|
|
405
|
+
const before = costOf(topModel, { input: assumed, output: 300 }) * 1e4;
|
|
406
|
+
cost = { model: topModel, assumed_prompt_tokens: assumed, before_usd: Math.round(before * 100) / 100, after_usd: Math.round(before * (1 - wastePct / 100) * 100) / 100 };
|
|
407
|
+
}
|
|
408
|
+
const order = { high: 0, medium: 1, low: 2, info: 3 };
|
|
409
|
+
findings.sort((a, b) => order[a.severity] - order[b.severity] || b.est_savings_pct - a.est_savings_pct);
|
|
410
|
+
const id = "aud_" + crypto.randomBytes(16).toString("base64url");
|
|
411
|
+
return { id, repo, method: "static heuristics", repo_kind: kind, notes, scanned_files: sources.length, call_sites: callSites, models, findings, estimated_waste_pct: wastePct, cost_per_10k_runs: cost, badge_url: null, generated_at: (/* @__PURE__ */ new Date()).toISOString() };
|
|
412
|
+
}
|
|
413
|
+
function filesFromDiff(diff) {
|
|
414
|
+
const files = [];
|
|
415
|
+
let cur = null;
|
|
416
|
+
for (const line of diff.split("\n")) {
|
|
417
|
+
const m = /^\+\+\+ b\/(.+)$/.exec(line);
|
|
418
|
+
if (m) {
|
|
419
|
+
cur = { path: m[1], content: "" };
|
|
420
|
+
files.push(cur);
|
|
421
|
+
continue;
|
|
422
|
+
}
|
|
423
|
+
if (!cur) continue;
|
|
424
|
+
if (line.startsWith("+") && !line.startsWith("+++")) cur.content += line.slice(1) + "\n";
|
|
425
|
+
else if (line.startsWith(" ")) cur.content += line.slice(1) + "\n";
|
|
426
|
+
else if (line.startsWith("@@")) cur.content += "\n";
|
|
427
|
+
}
|
|
428
|
+
return files;
|
|
429
|
+
}
|
|
430
|
+
|
|
431
|
+
// src/github-fetch.ts
|
|
432
|
+
var GH = "https://api.github.com";
|
|
433
|
+
var UA = "TokenZero-Audit/0.1 (+https://tokenzero.sh)";
|
|
434
|
+
var ghHeaders = (token) => ({ "user-agent": UA, accept: "application/vnd.github+json", ...token ? { authorization: `Bearer ${token}` } : {} });
|
|
435
|
+
async function fetchRepoFiles(repo, opts = {}) {
|
|
436
|
+
const maxFiles = opts.maxFiles ?? 120;
|
|
437
|
+
if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error("repo must look like owner/name");
|
|
438
|
+
const meta = await fetch(`${GH}/repos/${repo}`, { headers: ghHeaders(opts.token) });
|
|
439
|
+
if (meta.status === 404) throw new Error("repository not found (private repos are not supported)");
|
|
440
|
+
if (!meta.ok) throw new Error(`GitHub API ${meta.status}: ${(await meta.text()).slice(0, 200)}`);
|
|
441
|
+
const branch = (await meta.json()).default_branch;
|
|
442
|
+
const tree = await fetch(`${GH}/repos/${repo}/git/trees/${encodeURIComponent(branch)}?recursive=1`, { headers: ghHeaders(opts.token) });
|
|
443
|
+
if (!tree.ok) throw new Error(`GitHub tree ${tree.status}`);
|
|
444
|
+
const treeAll = (await tree.json()).tree;
|
|
445
|
+
const allPaths = treeAll.map((e) => e.path);
|
|
446
|
+
const entries = treeAll.filter((e) => e.type === "blob" && SOURCE_EXT.test(e.path) && !SKIP_PATH.test(e.path) && (e.size ?? 0) < 2e5);
|
|
447
|
+
const score = (p) => /openai|anthropic|claude|gemini|llm|prompt|complet|respons|inference|generat/i.test(p) ? 0 : /\bai\b|agent|chat|model|rag|embed|assistant/i.test(p) ? 1 : 2;
|
|
448
|
+
entries.sort((a, b) => score(a.path) - score(b.path) || b.size - a.size);
|
|
449
|
+
const picked = [];
|
|
450
|
+
let bytes = 0;
|
|
451
|
+
for (const e of entries) {
|
|
452
|
+
if (picked.length >= maxFiles || bytes + e.size > 4e6) break;
|
|
453
|
+
picked.push(e);
|
|
454
|
+
bytes += e.size;
|
|
455
|
+
}
|
|
456
|
+
const files = await Promise.all(picked.map(async (e) => {
|
|
457
|
+
const r = await fetch(`https://raw.githubusercontent.com/${repo}/${branch}/${e.path}`, { headers: { "user-agent": UA } });
|
|
458
|
+
return { path: e.path, content: r.ok ? await r.text() : "" };
|
|
459
|
+
}));
|
|
460
|
+
const tree0 = new Set(allPaths);
|
|
461
|
+
const manifests2 = (await Promise.all(MANIFEST_FILES.filter((n) => tree0.has(n)).map(async (n) => {
|
|
462
|
+
const r = await fetch(`https://raw.githubusercontent.com/${repo}/${branch}/${n}`, { headers: { "user-agent": UA } });
|
|
463
|
+
return r.ok ? { path: n, content: await r.text() } : null;
|
|
464
|
+
}))).filter((m) => !!m);
|
|
465
|
+
return { files, manifests: manifests2, branch, total_candidates: entries.length };
|
|
466
|
+
}
|
|
467
|
+
|
|
468
|
+
// src/arbitrage.ts
|
|
469
|
+
function modelArbitrage(args) {
|
|
470
|
+
const key = normalizeModel(args.model);
|
|
471
|
+
if (!key) throw new Error(`unknown model ${args.model}; known: ${Object.keys(PRICES).join(", ")}`);
|
|
472
|
+
const n = args.requests_per_month ?? 1e4, inp = args.input_tokens, out = args.output_tokens, st = Math.min(inp, args.static_tokens ?? 0);
|
|
473
|
+
const rowFor = (m) => {
|
|
474
|
+
const p = priceFor(m);
|
|
475
|
+
const base = costOf(m, { input: inp, output: out });
|
|
476
|
+
const cached = p.cachedInput != null && st >= (p.minCacheTokens ?? 1024) ? costOf(m, { input: inp, output: out, cachedInput: st }) : base;
|
|
477
|
+
return { model: m, tier: p.tier, per_request_usd: base, per_request_cached_usd: cached, monthly_usd: base * n, monthly_cached_usd: cached * n };
|
|
478
|
+
};
|
|
479
|
+
const models = [key, ...CASCADE_TARGET[key] ? [CASCADE_TARGET[key]] : [], ...(args.compare_to ?? []).map(normalizeModel).filter(Boolean)];
|
|
480
|
+
const rows = [...new Set(models)].map(rowFor);
|
|
481
|
+
return {
|
|
482
|
+
pricing_version: PRICING_VERSION,
|
|
483
|
+
requested: rows[0],
|
|
484
|
+
alternatives: rows.slice(1).map((r) => ({ ...r, savings_pct_vs_requested: Math.round((1 - r.per_request_usd / rows[0].per_request_usd) * 1e3) / 10 })),
|
|
485
|
+
caveat: "List prices. Cheaper models need an eval before swapping; TokenZero cascade routing is opt-in and reports observed parity."
|
|
486
|
+
};
|
|
487
|
+
}
|
|
488
|
+
|
|
489
|
+
// cli/src/scan.ts
|
|
490
|
+
import fs from "node:fs";
|
|
491
|
+
import path from "node:path";
|
|
492
|
+
function walk(root, limit = 5e3) {
|
|
493
|
+
const files = [];
|
|
494
|
+
const stack = [root];
|
|
495
|
+
while (stack.length && files.length < limit) {
|
|
496
|
+
const dir = stack.pop();
|
|
497
|
+
let entries;
|
|
498
|
+
try {
|
|
499
|
+
entries = fs.readdirSync(dir, { withFileTypes: true });
|
|
500
|
+
} catch {
|
|
501
|
+
continue;
|
|
502
|
+
}
|
|
503
|
+
for (const e of entries) {
|
|
504
|
+
const full = path.join(dir, e.name);
|
|
505
|
+
const rel = path.relative(root, full).split(path.sep).join("/");
|
|
506
|
+
if (e.name.startsWith(".") && e.name !== ".github") continue;
|
|
507
|
+
if (SKIP_PATH.test(rel + (e.isDirectory() ? "/" : ""))) continue;
|
|
508
|
+
if (e.isDirectory()) stack.push(full);
|
|
509
|
+
else if (e.isFile() && SOURCE_EXT.test(e.name)) {
|
|
510
|
+
try {
|
|
511
|
+
const st = fs.statSync(full);
|
|
512
|
+
if (st.size < 4e5) files.push({ path: rel, content: fs.readFileSync(full, "utf8") });
|
|
513
|
+
} catch {
|
|
514
|
+
}
|
|
515
|
+
}
|
|
516
|
+
}
|
|
517
|
+
}
|
|
518
|
+
return files;
|
|
519
|
+
}
|
|
520
|
+
function manifests(root) {
|
|
521
|
+
return MANIFEST_FILES.flatMap((n) => {
|
|
522
|
+
try {
|
|
523
|
+
return [{ path: n, content: fs.readFileSync(path.join(root, n), "utf8") }];
|
|
524
|
+
} catch {
|
|
525
|
+
return [];
|
|
526
|
+
}
|
|
527
|
+
});
|
|
528
|
+
}
|
|
529
|
+
|
|
530
|
+
// mcp/src/main.ts
|
|
531
|
+
var VERSION = "0.1.0";
|
|
532
|
+
var BAKED_URL = typeof __TOKENZERO_BAKED__ === "string" ? __TOKENZERO_BAKED__ : "__TOKENZERO_DEFAULT_URL__";
|
|
533
|
+
var SUPPORTED = ["2025-11-25", "2025-06-18", "2025-03-26"];
|
|
534
|
+
var serviceUrl = () => (process.env.TOKENZERO_URL || (BAKED_URL.startsWith("http") ? BAKED_URL : "")).replace(/\/+$/, "");
|
|
535
|
+
var TOOLS = [
|
|
536
|
+
{
|
|
537
|
+
name: "audit_repo_token_waste",
|
|
538
|
+
description: "Static audit for LLM token waste: uncached static prompts and prompt templates, frontier models on extraction/classification prompts, calls in loops, unpriced models. Give `path` for a local directory (scanned on this machine, nothing uploaded; defaults to the working directory), `repo` (owner/name) for a public GitHub repo, or `diff` for a unified diff. Results are static heuristics, not measurements.",
|
|
539
|
+
inputSchema: { type: "object", properties: { path: { type: "string", description: "local directory; defaults to the current working directory" }, repo: { type: "string", description: "public GitHub owner/name" }, diff: { type: "string", description: "unified diff text, e.g. from git diff" } }, additionalProperties: false }
|
|
540
|
+
},
|
|
541
|
+
{
|
|
542
|
+
name: "calculate_model_arbitrage",
|
|
543
|
+
description: `Price a workload at list prices (table ${PRICING_VERSION}) for the requested model, its cheaper sibling and any extra models, with and without prompt caching. Runs locally.`,
|
|
544
|
+
inputSchema: { type: "object", properties: { model: { type: "string" }, input_tokens: { type: "number" }, output_tokens: { type: "number" }, requests_per_month: { type: "number" }, static_tokens: { type: "number", description: "portion of input_tokens that is a fixed prefix (system + tools)" }, compare_to: { type: "array", items: { type: "string" } } }, required: ["model", "input_tokens", "output_tokens"], additionalProperties: false }
|
|
545
|
+
},
|
|
546
|
+
{
|
|
547
|
+
name: "optimize_prompt_payload",
|
|
548
|
+
description: "Rewrite an OpenAI Chat/Responses or Anthropic Messages request body so its static prefix is provider-cacheable, and project the saving. Sends the body you pass to the TokenZero service (set TOKENZERO_URL); do not pass secrets in it.",
|
|
549
|
+
inputSchema: { type: "object", properties: { body: { type: "object" }, endpoint: { type: "string", enum: ["/v1/chat/completions", "/v1/responses", "/v1/messages"] }, strategy: { type: "string", enum: ["static", "conversation"] } }, required: ["body"], additionalProperties: false }
|
|
550
|
+
}
|
|
551
|
+
];
|
|
552
|
+
async function callTool(name, args) {
|
|
553
|
+
switch (name) {
|
|
554
|
+
case "audit_repo_token_waste": {
|
|
555
|
+
if (args?.diff) return analyzeFiles(filesFromDiff(String(args.diff)), null);
|
|
556
|
+
if (args?.repo) {
|
|
557
|
+
const repo = String(args.repo).replace(/^https?:\/\/github\.com\//, "").replace(/\.git$/, "").replace(/\/$/, "");
|
|
558
|
+
const { files, manifests: m } = await fetchRepoFiles(repo, { token: process.env.GITHUB_TOKEN });
|
|
559
|
+
return analyzeFiles(files, repo, m);
|
|
560
|
+
}
|
|
561
|
+
const root = path2.resolve(args?.path ?? process.cwd());
|
|
562
|
+
return analyzeFiles(walk(root), null, manifests(root));
|
|
563
|
+
}
|
|
564
|
+
case "calculate_model_arbitrage":
|
|
565
|
+
return modelArbitrage(args);
|
|
566
|
+
case "optimize_prompt_payload": {
|
|
567
|
+
const base = serviceUrl();
|
|
568
|
+
if (!base) throw new Error("set TOKENZERO_URL to use this tool (the cache formatter runs in the TokenZero service)");
|
|
569
|
+
const r = await fetch(base + "/mcp", { method: "POST", redirect: "manual", headers: { "content-type": "application/json", "user-agent": `tokenzero-mcp/${VERSION}` }, body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } }) });
|
|
570
|
+
if (r.status >= 300 && r.status < 400) throw new Error(`${base} is not publicly reachable yet (redirected)`);
|
|
571
|
+
const j = await r.json();
|
|
572
|
+
if (j.error) throw new Error(j.error.message);
|
|
573
|
+
if (j.result?.isError) throw new Error(j.result.content?.[0]?.text ?? "remote tool error");
|
|
574
|
+
return j.result?.structuredContent ?? j.result;
|
|
575
|
+
}
|
|
576
|
+
default:
|
|
577
|
+
throw new Error(`unknown tool ${name}`);
|
|
578
|
+
}
|
|
579
|
+
}
|
|
580
|
+
var send = (msg) => process.stdout.write(JSON.stringify(msg) + "\n");
|
|
581
|
+
async function handle(m) {
|
|
582
|
+
const isRequest = m && m.id !== void 0 && m.id !== null && typeof m.method === "string";
|
|
583
|
+
const reply = (result) => isRequest && send({ jsonrpc: "2.0", id: m.id, result });
|
|
584
|
+
const fail = (code, message) => isRequest && send({ jsonrpc: "2.0", id: m.id, error: { code, message } });
|
|
585
|
+
try {
|
|
586
|
+
switch (m?.method) {
|
|
587
|
+
case "initialize": {
|
|
588
|
+
const want = m.params?.protocolVersion;
|
|
589
|
+
return reply({ protocolVersion: SUPPORTED.includes(want) ? want : SUPPORTED[0], capabilities: { tools: { listChanged: false } }, serverInfo: { name: "tokenzero", version: VERSION }, instructions: "Use audit_repo_token_waste to find LLM cost waste in the current project (local, nothing uploaded), calculate_model_arbitrage to price model alternatives, optimize_prompt_payload to make a request body cache-friendly." });
|
|
590
|
+
}
|
|
591
|
+
case "ping":
|
|
592
|
+
return reply({});
|
|
593
|
+
case "tools/list":
|
|
594
|
+
return reply({ tools: TOOLS });
|
|
595
|
+
case "tools/call":
|
|
596
|
+
try {
|
|
597
|
+
const r = await callTool(m.params?.name, m.params?.arguments ?? {});
|
|
598
|
+
return reply({ content: [{ type: "text", text: JSON.stringify(r, null, 2) }], structuredContent: r, isError: false });
|
|
599
|
+
} catch (e) {
|
|
600
|
+
return reply({ content: [{ type: "text", text: `error: ${e?.message ?? e}` }], isError: true });
|
|
601
|
+
}
|
|
602
|
+
default:
|
|
603
|
+
if (typeof m?.method === "string" && m.method.startsWith("notifications/")) return;
|
|
604
|
+
return fail(-32601, `method not found: ${m?.method}`);
|
|
605
|
+
}
|
|
606
|
+
} catch (e) {
|
|
607
|
+
fail(-32603, e?.message ?? "internal error");
|
|
608
|
+
}
|
|
609
|
+
}
|
|
610
|
+
var rl = readline.createInterface({ input: process.stdin, terminal: false });
|
|
611
|
+
rl.on("line", (line) => {
|
|
612
|
+
const t = line.trim();
|
|
613
|
+
if (!t) return;
|
|
614
|
+
let msg;
|
|
615
|
+
try {
|
|
616
|
+
msg = JSON.parse(t);
|
|
617
|
+
} catch {
|
|
618
|
+
send({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } });
|
|
619
|
+
return;
|
|
620
|
+
}
|
|
621
|
+
for (const m of Array.isArray(msg) ? msg : [msg]) void handle(m);
|
|
622
|
+
});
|
|
623
|
+
process.stderr.write(`tokenzero-mcp ${VERSION} ready (stdio)
|
|
624
|
+
`);
|
package/package.json
CHANGED
|
@@ -1,6 +1,13 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@tokenzero/mcp",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"
|
|
5
|
-
"
|
|
6
|
-
|
|
3
|
+
"version": "0.1.0",
|
|
4
|
+
"description": "TokenZero MCP server (stdio): audit LLM token waste in your project locally, price model alternatives, and make prompts cache-friendly from Claude Code, Cursor, Windsurf or Cline.",
|
|
5
|
+
"type": "module",
|
|
6
|
+
"license": "Apache-2.0",
|
|
7
|
+
"author": "TokenZero Contributors <support@tokenzero.sh>",
|
|
8
|
+
"homepage": "https://tokenzero.sh",
|
|
9
|
+
"bin": { "tokenzero-mcp": "bin/tokenzero-mcp.mjs" },
|
|
10
|
+
"files": ["bin/tokenzero-mcp.mjs"],
|
|
11
|
+
"engines": { "node": ">=18" },
|
|
12
|
+
"keywords": ["mcp", "model-context-protocol", "llm", "cost", "finops", "prompt-caching", "claude-code", "cursor"]
|
|
13
|
+
}
|
package/README.md
DELETED