registry / tokmax / 0.9.12

tokmax@0.9.12

⚠ Under review

Scan your local Codex + Claude Code logs, aggregate per-model token usage, and publish the API-equivalent $ to the tokenmax leaderboard (tokmax.vibecoding.tech). Prices: LiteLLM, counting: ccusage. Aggregates only — never your prompts, files, or keys.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked CLI that scans local AI-tool usage logs, computes aggregate token/cost metrics, and optionally publishes them to the tokmax service.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs tokmax, tokmax login, tokmax publish, or tokmax daily on.

Impact

Publishes aggregate model/date/token/cost metrics and local plan labels; no prompt/code/key exfiltration or install-time execution found.

Mechanism

Local log aggregation with optional authenticated publish and optional scheduled re-run.

Rationale

Static inspection shows suspicious primitives are aligned with the declared CLI functionality: user-invoked scanning of local AI usage logs, explicit publish/login calls, and optional daily scheduling. I found no lifecycle execution, hidden payload, credential harvesting/exfiltration, destructive behavior, or AI-agent control-surface mutation.

Evidence

package.jsonbin/tokmax.mjssrc/adapters/codex.mjssrc/adapters/claude-code.mjssrc/publish.mjssrc/secrets.mjssrc/auth.mjssrc/daily.mjssrc/plan.mjs~/.codex/sessions/**/*.jsonl~/.codex/archived_sessions/*.jsonl~/.claude*/projects/**/*.jsonl~/.claude.json~/.codex/auth.json~/.config/tokenmax/*.json

tokmax@0.9.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code