Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.Digital-Threads/token-pilot

NPM · TOKEN-PILOT · SCANNED AUG 3

Save up to 80% tokens when AI reads code via AST-aware structural reading

Available components

+34 this week 59 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security83
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree.Partial
  • Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
  • Only part of the dependency tree could be resolved (111 of 115), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability28
  • AI-judged instruction clarity (poor).Fail
  • Context-footprint check failed: tool/resource definitions use about 4453 tokens (~178/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · token-pilot

# add to Claude Code
claude mcp add digital-threads-token-pilot -- npx -y token-pilot
# add to Codex CLI
codex mcp add digital-threads-token-pilot -- npx -y token-pilot
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "digital-threads-token-pilot": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "token-pilot"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add digital-threads-token-pilot --command npx --arg -y --arg token-pilot
# ~/.hermes/config.yaml
mcp_servers:
  digital-threads-token-pilot:
    command: "npx"
    args: ["-y", "token-pilot"]
// mcp.json
{
  "mcpServers": {
    "digital-threads-token-pilot": {
      "command": "npx",
      "args": [
        "-y",
        "token-pilot"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +4
    • Stability: unverified → 0.27 functional
  • 2 Aug 26 +31
    • Provenance: unverified → fail security
    • Known CVEs: unverified → partial security
    • Install scripts: unverified → partial security
    • Malware scan: unverified → pass security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • The scripts that run when this package is installed changed: postinstall security
    • Security disclosure: fail → unverified functional
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: unverified → poor functional
    • Maintenance: unverified → pass functional
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Licence: MIT functional
  • 1 Aug 26 −8
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 +24
    • Provenance: unverified → fail security
    • Install scripts: unverified → partial security
    • The scripts that run when this package is installed changed: postinstall security
    • Security disclosure: unverified → fail functional
    • Dependency health: partial → unverified functional
    • License: unverified → pass functional
    • Maintenance: unverified → pass functional
    • Tool coverage: unverified → 100 functional
    • Licence: MIT functional
  • 29 Jul 26 −17
    • Tool coverage: 100 → unverified functional
    • Security disclosure: fail → unverified functional
    • Dependency health: unverified → partial functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 25

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Install scripts 1 script
Hook Tier Command
postinstall unreviewed node scripts/postinstall.mjs
Dependencies 111 packages

111 packages in the resolved dependency tree · 97 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 25 exposed · ~3,662 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
call_tree ~98

Recursive depth-N call hierarchy for a function. Shows who calls who transitively — complements find_usages (flat one-level refs) by revealing full chains from leaf helpers to entry points. Use for debugging, refactor impact, and verifying reachability.

NameTypeReqDescription
depthnumberWalk-up depth. Default 3, max 6.
symbolstringyesFunction / method name, unqualified (e.g. `fetchUser`).

No output schema declared.

No examples provided.

code_audit ~207

Find code quality issues: TODO/FIXME comments, deprecated symbols, structural code patterns (bare except:, print() calls). Use for project-wide audits.

NameTypeReqDescription
checkstringyesWhat to check: "pattern" (structural search via ast-grep, e.g. "except:", "print($$$ARGS)"), "todo" (TODO/FIXME comments), "deprecated" (deprecated symbols), "annotations" (find by decorator name), "…
langstringLanguage filter for check="pattern" (e.g., "python", "typescript")
limitnumberMax results (default: 50)
namestringDecorator/annotation name for check="annotations". Example: "Deprecated", "Controller"
patternstringCode pattern for check="pattern". ast-grep syntax: "except:" finds bare excepts, "print($$$ARGS)" finds print calls.

No output schema declared.

No examples provided.

explore ~167

One-shot ranked context + call/inheritance graph blast-radius for a query. Returns ranked symbols, the source heads of the top-ranked files, graph neighbours (callers + subclasses — the blast radius), and related test files in a single compact block. Use INSTEAD OF separate find_usages + read_symbol + call_tree when you need to understand an area fast — cheaper than chaining those three.

NameTypeReqDescription
graphbooleanInclude call/inheritance graph neighbours (blast radius). Default: true. Set false to skip the graph walk.
max_filesnumberCap on the number of source file heads returned (default: binary's own limit)
querystringyesSearch terms (the binary splits the string into terms itself), e.g. "AstIndexClient buildIndex"

No output schema declared.

No examples provided.

explore_area ~158

One-call exploration of a directory: outline (all symbols), imports (external deps + who imports this area), tests (matching test files), recent git changes. Use INSTEAD OF separate outline + related_files + git log calls. Default since v0.30.0 returns only outline+changes — telemetry showed the all-4 default producing negative token reduction for small areas. Opt into imports/tests explicitly via `include` when you need them.

NameTypeReqDescription
includearraySections to include. Default: ["outline","changes"]. Add "imports" for dep graph, "tests" to map test files — both can be heavy on large areas.
pathstringyesDirectory path (or file path — will use its parent directory)

No output schema declared.

No examples provided.

find_unused ~80

Find dead code — functions, classes, and variables with no references across the project. Use for cleanup and refactoring.

NameTypeReqDescription
export_onlybooleanOnly check exported (capitalized) symbols
limitnumberMax results (default: 30)
modulestringFilter by module path (e.g., "src/services/")

No output schema declared.

No examples provided.

find_usages ~261

Use INSTEAD OF Grep for finding symbol references. Semantic search — groups by: definitions, imports, usages. Supports scope, kind, limit, lang filters. Use context_lines to include surrounding code. HINT: for very short / generic symbols (≤4 chars like `id`, `err`, `Cmd`, `db`) Grep is usually cheaper than find_usages — the semantic grouping doesn't pay off when the symbol resolves ambiguously across thousands of files.

NameTypeReqDescription
context_linesnumberLines of source context around each match (0-10). When set, shows surrounding code — saves follow-up read_symbol calls.
kindstringShow only specific section (default: "all")
langstringFilter by language/extension (e.g., "php", "typescript")
limitnumberMax results per category (default: 50, max: 500)
modestringOutput mode: full (with context, default), list (file:line only, 5-10x smaller for initial discovery)
scopestringFilter results by path prefix (e.g., "src/Domain/")
symbolstringyesSymbol name to find usages of

No output schema declared.

No examples provided.

module_info ~106

Analyze module dependencies, dependents, public API, and unused deps. Use for architecture understanding and dependency cleanup.

NameTypeReqDescription
checkstringWhat to check: "deps" (dependencies), "dependents" (who depends on this), "api" (public symbols), "unused-deps" (dead dependencies), "all" (everything). Default: "all"
modulestringyesModule name or path pattern (e.g., "auth", "src/Domain/")

No output schema declared.

No examples provided.

module_route ~231

Show the transitive dependency path(s) between two modules — how module A reaches module B through the import graph. Use to answer 'how does X depend on Y?', trace coupling, or generate a dependency diagram. format='mermaid'/'dot' emits a diagram; default text lists the hops.

NameTypeReqDescription
allbooleanShow all simple paths instead of just the shortest (default: false)
formatstringOutput format: "text" (default, hop listing), "json", "mermaid" or "dot" (dependency diagram)
fromstringyesSource module — the one whose dependencies are followed (name or path, e.g. "auth", "apps/api")
maxDepthnumberCap on path length in hops (default: 20, max: 50)
maxPathsnumberCap on number of paths returned (default: 50, max: 200)
tostringyesTarget module to reach
viaKindstringRestrict traversal to a dependency kind (default: "all")

No output schema declared.

No examples provided.

outline ~96

Use INSTEAD OF listing dir + reading each file. One call returns all symbols (classes, functions, methods, routes) for every code file in a directory. Supports recursive with max_depth.

NameTypeReqDescription
max_depthnumberMax recursion depth when recursive=true (default: 2, max: 5)
pathstringyesDirectory path
recursivebooleanRecursively outline subdirectories (default: false)

No output schema declared.

No examples provided.

project_overview ~72

START HERE for unfamiliar codebases. Shows project type, architecture, framework detection, quality tools, CI, directory map. Use include filter for specific sections.

NameTypeReqDescription
includearraySections to include (default: all). Use ["stack"] for quick type check, ["quality","ci"] for tooling overview.

No output schema declared.

No examples provided.

read_diff ~71

Use INSTEAD OF re-reading whole file after edits. Shows only changed hunks. REQUIRES: call smart_read or read_for_edit BEFORE editing to create baseline snapshot.

NameTypeReqDescription
context_linesnumberLines of context around changes (default: 3)
pathstringyesFile path

No output schema declared.

No examples provided.

read_for_edit ~286

Use INSTEAD OF Read when preparing an EDIT. Returns exact RAW code around a symbol or line — copy directly as old_string for Edit tool. Supports batch: pass "symbols" array to get multiple edit contexts in one call. Unlike read_symbols (for reading/understanding), this returns unformatted code optimized for copy-paste into Edit. Optional: include_callers, include_tests, include_changes for enriched context.

NameTypeReqDescription
contextnumberLines of context around target (default: 5)
include_callersbooleanShow top callers of this symbol (saves a separate find_usages call)
include_changesbooleanShow recent git changes in the target region
include_testsbooleanShow related test file and test names
linenumberLine number to edit (alternative to symbol)
pathstringyesFile path
sectionstringSection to edit: heading (Markdown), top-level key (YAML/JSON), or "rows:1-50" (CSV). Returns raw section content for Edit old_string.
symbolstringSymbol name to edit (e.g. "UserService.updateUser")
symbolsarrayArray of symbol names for batch edit context (max 10). Alternative to single "symbol" — returns all symbols in one call.

No output schema declared.

No examples provided.

read_range ~109

Read a specific line range from a file. Use when you know exact lines — lighter than reading the whole file.

NameTypeReqDescription
end_linenumberyesEnd line (1-indexed, inclusive)
forcebooleanBypass dedup (see smart_read.force).
pathstringyesFile path
session_idstringOptional Claude Code session_id for cross-restart dedup (see smart_read).
start_linenumberyesStart line (1-indexed)

No output schema declared.

No examples provided.

read_section ~160

Read a specific section from Markdown, YAML, JSON, or CSV files. Markdown: by heading name. YAML/JSON: by top-level key. CSV: by row range (rows:1-50). Much cheaper than reading the whole file. DOCS/DATA ONLY — `heading` is required; this does NOT read code by line/symbol. For source files use read_range (line range) or read_symbol (one symbol).

NameTypeReqDescription
headingstringyesSection heading (Markdown), top-level key (YAML/JSON), or row range "rows:1-50" (CSV). Case-insensitive.
pathstringyesPath to .md, .yaml, .yml, .json, or .csv file

No output schema declared.

No examples provided.

read_symbol ~205

Read source code of ONE specific function/method/class — INSTEAD OF reading the whole file. Supports Class.method syntax.

NameTypeReqDescription
context_afternumberLines of context after (default: 0)
context_beforenumberLines of context before (default: 2)
forcebooleanBypass dedup (see smart_read.force).
include_edit_contextbooleanAppend raw code block for Edit old_string (saves a read_for_edit call)
pathstringyesFile path
session_idstringOptional Claude Code session_id for cross-restart dedup (see smart_read).
showstringDisplay mode: full (all lines), head (first 50), tail (last 30), outline (head + methods + tail). Default: auto (full ≤300 lines, outline >300)
symbolstringyesSymbol name, e.g. "UserService.updateUser"

No output schema declared.

No examples provided.

read_symbols ~194

Batch read MULTIPLE symbols from ONE file — saves N-1 round-trips vs calling read_symbol N times. BEST FIT: 3–8 symbols in one file when you need their bodies. For 1–2 symbols use read_symbol (simpler). If you'd request ≥70% of the file's symbols, the handler refuses and points you to smart_read — that's cheaper than a large batch. For edit preparation use read_for_edit.

NameTypeReqDescription
context_afternumberLines of context after each symbol (default: 0)
context_beforenumberLines of context before each symbol (default: 2)
pathstringyesFile path
showstringDisplay mode for each symbol (default: auto)
symbolsarrayyesArray of symbol names (max 10), e.g. ["UserService.create", "UserService.update", "UserService.delete"]

No output schema declared.

No examples provided.

related_files ~65

Show ranked import graph for a file: imports, importers, and tests scored by relevance (test adjacency, import closeness, recent changes, path proximity). Files ranked into HIGH VALUE / MEDIUM / LOW to prioritize reading.

NameTypeReqDescription
pathstringyesFile path to analyze

No output schema declared.

No examples provided.

session_analytics ~72

Show token savings report: calls, tokens saved, per-tool breakdown, top files, cache hits. Use verbose=true for full breakdown (per-intent, decision insights, savings by category).

NameTypeReqDescription
verbosebooleanShow detailed breakdown: per-intent, savings by category, decision insights (default: false)

No output schema declared.

No examples provided.

session_budget ~101

META / info-only: reports Read-hook pressure for this session (suppressed tokens, reference budget, burn fraction, effective denyThreshold). Does NOT save tokens itself — this is diagnostic, use to decide when to tighten before a big read. NOTE: burnFraction measures hook activity, not actual context-window occupancy.

NameTypeReqDescription
sessionIdstringyesClaude Code session_id (same id that appears in hook-events.jsonl). Pass "" to read with no session filter.

No output schema declared.

No examples provided.

session_snapshot ~136

Capture current session state as a compact markdown block (<200 tokens). Call before compaction, when switching direction, or periodically in long sessions. Model provides the facts, tool formats them.

NameTypeReqDescription
blockedstringCurrent blocker or obstacle
confirmedarrayEstablished facts (what has been verified)
decisionsarrayKey decisions made and why (e.g., "removed sysfee step — caused double counting"). Prevents revisiting rejected approaches.
filesarrayRelevant file paths
goalstringyesSession goal — what and why
nextstringNext step to take

No output schema declared.

No examples provided.

smart_diff ~104

Use INSTEAD OF raw git diff. Shows changed files with AST symbol mapping — which functions/classes were modified/added/removed. Small diffs include hunks, large diffs show summary.

NameTypeReqDescription
pathstringFilter to specific file or directory
refstringGit ref — required for scope="commit" (commit hash) or scope="branch" (branch name)
scopestringDiff scope (default: "unstaged")

No output schema declared.

No examples provided.

smart_log ~167

Use INSTEAD OF raw git log. Structured commit history with category detection (feat/fix/refactor/docs), file stats, author breakdown. Filters by path and ref. HEADS UP: two verification runs measured this tool at ~39% token reduction (borderline — vs 95-99% for outline/smart_diff). Cumulative data being gathered — tool may be dropped or redesigned in v0.30.0 if numbers don't improve. Prefer scoping with `path` or `count` to tighten savings.

NameTypeReqDescription
countnumberNumber of commits (default: 10, max: 50)
pathstringFilter to specific file or directory
refstringGit ref — branch, tag, or commit (default: HEAD)

No output schema declared.

No examples provided.

smart_read ~280

Use INSTEAD OF Read/cat for code files. Returns code structure (classes, functions, methods with signatures and line ranges) — 60-80% fewer tokens than raw content. Use read_symbol() to drill into specific code.

NameTypeReqDescription
depthnumberMax depth for nested symbols (default: 2)
forcebooleanBypass dedup — return full content even if the same path was already loaded earlier in this session. Use when the prior result was compacted out of context.
max_tokensnumberToken budget. If output exceeds this, auto-downgrades: full → outline → compact. Use for context-constrained sessions.
pathstringyesFile path (absolute or relative to project root)
scopestringOutput scope: full (default, all details), nav (names + lines only, 2-3x smaller), exports (public API only)
session_idstringOptional Claude Code session_id. When provided, dedup state (already-loaded files) persists across MCP server restarts and /clear, tied to that session. Omit to use ephemeral process-scoped dedup.
show_docsbooleanInclude doc comments (default: true)
show_importsbooleanInclude import details (default: true)

No output schema declared.

No examples provided.

smart_read_many ~116

Batch smart_read for multiple files at once — INSTEAD OF calling Read on each file. Returns structure for each file. Max 20 files.

NameTypeReqDescription
forcebooleanBypass dedup (see smart_read.force).
max_tokensnumberToken budget per file. If a file exceeds this, auto-downgrades to compact outline.
pathsarrayyesArray of file paths
session_idstringOptional Claude Code session_id for cross-restart dedup (see smart_read).

No output schema declared.

No examples provided.

test_summary ~120

Run tests and return structured summary: total/passed/failed/skipped + failure details. 200 lines of raw output → 10-15 lines. Supports vitest, jest, pytest, phpunit, go test, cargo test.

NameTypeReqDescription
commandstringyesTest command to run (e.g., "npm test", "pytest", "go test ./...")
runnerstringForce specific parser (auto-detected if omitted)
timeoutnumberTimeout in ms (default: 60000, max: 300000)

No output schema declared.

No examples provided.