tokenmiser · your agent works from what your code means. Nothing leaves your machine.

Setup

One command. Then it disappears.

tokenmiser isn't a tool you use. It's a thing your agents use. init indexes the repo (TypeScript, Python, Java, Markdown), wires itself into your agent host, and seals the profile — from then on the host spawns it, calls its tools, and reads the projection instead of raw files.

Step 1

Initialize the repo

One command does all of it: builds the model, registers the MCP server, denies the native file tools, installs the Bash read-guard, and wires a live savings meter into your Claude Code statusline (yours is kept if you have one). --gemini wires Gemini too; --codex is advisory-only — codex can't disable its native tools.

$ tokenmiser init
Indexed 1,142 modules (1.6M tokens of raw context) in 38s.
Merged .mcp.json — plain claude auto-discovers the server.
Merged .claude/settings.json (deny list; Bash read-guard hook).
Wired the live savings statusline into the session bar.
Enforcement is on by default — --unenforce strips it.

Step 2 · only if you want out

Dial it back, pause it, or leave

--unenforce keeps the broker but hands back the native file tools. off goes dormant without losing the index; on rewires it, no re-index. uninstall reverses every file init touched.

$ tokenmiser init --unenforce
Removed enforcement from .claude/settings.json
(your own settings are untouched).
$ tokenmiser off   # dormant, state kept
$ tokenmiser on    # rewires; no re-index

There is no step three. Your agent does the rest.

get_context · the code, right-sized search · repo grep glob · file listing edit · targeted, safe replace write · rewrite or create refactor · rename / move / codemod, repo-wide verify · typecheck + tests stats · live savings

The complete tool surface your agent sees. Everything else is the repo it already had.

Both directions

Reads shrink. Writes shrink too.

Half your bill is input tokens spent re-reading files; the other half is output tokens spent rewriting whole files to change three lines. tokenmiser routes both through the model. Sessions sharpen too: the agent holds meaning, not noise.

Reads: what it needs, not what's there

Every read is served from the projection, integrity-checked against your disk on every call.

→The agent gets what it needs to understand the code: typically ~90% smaller than the raw source
→When it's about to edit, it gets the exact bytes it's changing — nothing more
→Docs and markdown work the same way: what's relevant to the task, not the whole file
→Nothing is served twice: re-reading an unchanged file costs almost nothing

Writes: the change, not the file

Writes go through the projection too: the agent emits only the change, tokenmiser lands it safely.

→Checked against disk before it lands: a conflicting outside edit wins, never silently overwritten
→Disk stays the source of truth: your editor and toolchain keep working normally, and tokenmiser keeps up
→verify runs your typecheck and tests and returns pass/fail: no file bytes, no read bypass
→Never a git command: tokenmiser writes your working tree and nothing else

Security posture

Architecturally incapable of leaking your code.

Not a policy promise, a design property. The license server reads exactly three fields (key, machine hash, counters) and discards everything else, so it cannot store source code, repo names, or paths even by accident. Here is the complete list of everything that ever leaves your machine. Today, in beta, there is no license call wired at all — the binary makes zero network calls.

What leaves your machine

One daily heartbeat once licensing is live. Human-readable, this is all of it:

{
  "key": "tm_live_…",
  "machine_hash": "a91f…",  // salted + hashed locally
  "counters": {
    "raw_equiv_tokens": 41200000,
    "served_tokens": 3400000,
    "sessions": 212
  }
}

✓Aggregate counters only: your meter and your bill, fully transparent
✓Same numbers the stats tool shows you locally

What never does

Verifiable in the binary and your own network tab.

✕Your source code
✕File paths or repo names
✕Prompts, context, or anything an agent saw
✕Git operations: writes go to your working tree through a safeguarded, integrity-checked path; git stays yours
✕Silent self-updates: no auto-updater; upgrades are explicit and signature-verified

Signed + notarized binaries Bash read-guard: no cat/sed bypass of the deny list uninstall reverses everything init wrote

For the CISO losing sleep over LLM leakage: there are no secrets to manage, no egress to architect, no IAM roles to design. The binary sits next to the code, serves context to a process you already trust, applies that process's edits under a safeguarded write path, and phones home a counter. That's the whole threat model.

Savings reporting

A number your CFO will actually believe.

Conservative by construction. The headline is a discounted floor (default haircut 0.6), printed beside the gross. We apply the haircut so finance doesn't have to.
Measured, not estimated. tokenmiser knows exactly what raw context each read replaced, and what full-file rewrite each edit replaced, priced at the rate in force when each run happened. Reads and writes are broken out per tool.
Tamper-evident, verifiably. The local ledger is hash-chained and monthly summaries are digest-sealed. tokenmiser verify-ledger re-checks every month's chain on your machine.
No cloud, including ours. tokenmiser report emits HTML and CSV locally. Team rollups merge the sealed summaries each machine commits (report --merge) through the repo you already share.
On the glass, not just on paper. The Claude Code statusline shows the live raw→served tally as your agent works.

tokenmiser-report-2026-06 conservative floor · haircut 0.6

$1,412

floor savings, June 2026 (gross: $2,353)

reads: raw → served41.2M → 3.4M

writes: rewrite → change2.6M → 0.5M

read reduction91.7%

spend without tokenmiser$2,562

machines in rollup3

tokenmiser cost $87 (3 × $29) · floor savings $1,412 · 16.2×

ledger chain 9f3a1c…e77b04 · price table v2026.06 · methodology printed in full on page 1

Pricing

Priced on value delivered, capped on principle.

Tiers step on raw-equivalent tokens served: the value you got, not a punishment for using the thing. Crossing a ceiling triggers a suggestion, never a charge, with 30 days of grace at full function.

Trial

7 days · no card

Full product, nothing held back
Email → key, that's the signup
audit stays free forever

Get a key

Pro

$29/mo per machine

or $290/yr · 2 months free

Up to 50M raw-equiv tokens/mo
CFO-grade monthly reports
Team rollup via your repo

Start free trial

Heavy

$59/mo per machine

or $590/yr · 2 months free

50M–500M raw-equiv/mo
Everything in Pro
Observability export: OTLP and Prometheus into the stack you already run

Start free trial

Max

$99/mo per machine

monthly · hard cap

Unlimited tokens served
Everything in Heavy
There is no tier above this

Start free trial

Your bill can never exceed $99 per machine. That's the whole point of the name.

A running agent session is never killed, throttled, or interrupted by licensing. State changes apply at next spawn, and offline machines keep working on the last signed validation.

Your coding agent reads ten times more than it needs. Stop paying for it.

Python backend, TypeScript frontend, one session.

One command. Then it disappears.

Initialize the repo

Dial it back, pause it, or leave

Reads shrink. Writes shrink too.

Reads: what it needs, not what's there

Writes: the change, not the file

Architecturally incapable of leaking your code.

What leaves your machine

What never does

A number your CFO will actually believe.

Priced on value delivered, capped on principle.

Email in, key out. Saving by lunch.