repo-forensics
Offline security scanner for AI-agent repos, skills, plugins, and MCP servers.
Find the ghost tokens. Fix them. Survive compaction. Avoid context quality decay.
> /plugin marketplace add alexgreensh/token-optimizer> /plugin install token-optimizer@alexgreensh-token-optimizer
Repo: alexgreensh/token-optimizer
What's inside
Token Optimizer cuts the tokens your AI coding assistant wastes, keeps your work alive across sessions and compactions, and shows you where every dollar went on a live dashboard. Most of it runs automatically. You install it, run the audit once, and the hooks do the rest.
Why not just use Headroom or RTK? They compress command output, which covers 15-25% of your context. Token Optimizer covers that plus the other 75%: bloated configs, unused skills, stale memory, compaction loss, model misrouting, behavioral waste. Every saving is cache-safe and measured. The dashboard updates after every session, automatically.
Works on Claude Code (CLI and VS Code), OpenCode, OpenClaw, Codex, Hermes, GitHub Copilot, Cursor, Google Antigravity (beta), and Grok Build (beta). Windsurf is next on the roadmap.
Claude Code (recommended):
/plugin marketplace add alexgreensh/token-optimizer
/plugin install token-optimizer@alexgreensh-token-optimizer
Then in Claude Code: /token-optimizer
Enable auto-update after installing. Claude Code ships third-party marketplaces with auto-update off by default.
/plugin→ Marketplaces tab → selectalexgreensh-token-optimizer→ Enable auto-update. One-time, 10 seconds.After install, run
/token-optimizeronce to set up hooks. From there, everything runs automatically: compression, checkpoints, quality scoring, dashboard updates. You don't need to run any command again unless you want an audit.
Claude Code cloud sessions (claude.ai/code). A cloud session runs in a fresh container and never reads the plugins installed on your machine, so the two commands above are not enough there (
/pluginitself is not available in cloud sessions). Either enable Token Optimizer for your claude.ai account (Desktop app → Customize → plugins), or commit this to the repo's.claude/settings.jsonso every cloud session on that repo installs it at start:{ "extraKnownMarketplaces": { "alexgreensh-token-optimizer": { "source": { "source": "github", "repo": "alexgreensh/token-optimizer" } } }, "enabledPlugins": { "token-optimizer@alexgreensh-token-optimizer": true } }Hooks, compression and redaction behave the same inside the container. Each cloud session starts with an empty state directory, so the dashboard and audit history there cover that session only.
Codex:
codex plugin marketplace add alexgreensh/token-optimizer
Then in the Codex TUI: /plugins and install Token Optimizer. See docs/codex.md.
OpenCode: add token-optimizer-opencode to the plugin array in your opencode.json:
{ "$schema": "https://opencode.ai/config.json", "plugin": ["token-optimizer-opencode"] }
See opencode/README.md.
OpenClaw:
openclaw plugins install github:alexgreensh/token-optimizer
See openclaw/README.md.
Hermes:
git clone https://github.com/alexgreensh/token-optimizer.git
token-optimizer/install.sh --hermes
See hermes/README.md.
GitHub Copilot:
git clone --depth 1 https://github.com/alexgreensh/token-optimizer.git
cd token-optimizer
bash install.sh --copilot
See docs/copilot.md.
Cursor:
git clone --depth 1 https://github.com/alexgreensh/token-optimizer.git
cd token-optimizer
bash install.sh --cursor
See docs/cursor.md.
Google Antigravity:
git clone --depth 1 https://github.com/alexgreensh/token-optimizer.git
cd token-optimizer
bash install.sh --antigravity
See docs/antigravity.md.
Grok Build (beta, contract-only):
git clone --depth 1 https://github.com/alexgreensh/token-optimizer.git
cd token-optimizer
bash install.sh --grok
See docs/grok.md.
macOS/Linux script install (alternative to plugin):
tmp="$(mktemp -d)"
release_json="$(curl -fsSL https://api.github.com/repos/alexgreensh/token-optimizer/releases/latest)"
tag="$(python3 -c 'import json,sys; print(json.load(sys.stdin)["tag_name"])' <<<"$release_json")"
git clone --branch "$tag" --depth 1 https://github.com/alexgreensh/token-optimizer.git ~/.claude/token-optimizer
bash ~/.claude/token-optimizer/install.sh
rm -rf "$tmp"
Windows users: Use the plugin install only. Do not run install.sh on Windows. If you hit EBUSY errors, close all Claude Code and Git Bash windows, kill lingering git.exe processes, delete C:\Users\<you>\.claude\token-optimizer and C:\Users\<you>\.claude\plugins\marketplaces\alexgreensh-token-optimizer, then retry.
If install.sh fails with $'\r': command not found (a clone made before LF line endings were enforced converted the script to CRLF), strip the carriage returns once and re-run — the repo now ships a .gitattributes that prevents this on fresh clones:
sed -i 's/\r$//' ~/.claude/token-optimizer/install.sh
# already have the repo? re-normalize line endings in place:
git -C ~/.claude/token-optimizer add --renormalize . && git -C ~/.claude/token-optimizer checkout -- .
Token Optimizer is additive and reversible. Every runtime has a clean uninstall that removes only what we installed, leaving your own hooks, config, and session data intact. Full per-runtime steps live in docs/uninstall.md.
Quickest path (Claude Code plugin install):
/plugin uninstall token-optimizer@alexgreensh-token-optimizer
Runs automatically, every session, you do nothing:
Offline security scanner for AI-agent repos, skills, plugins, and MCP servers.
FAQ
token-optimizer is a Claude Code plugin with 5 hand-picked skills for development work, indexed on Flowy. Install it with the command on its page. It includes fleet-auditor, resume-checkpoint, token-coach. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it