This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+3 more
Summary
AI summaryDetection improvements add lazy/nested imports, re-export handling, factory function support and new audio/image call types; variable resolution gains multi‑pass constant propagation with env‑var fallbacks; performance sees a 50x speedup on large codebases.
Full changelog
What's New in v0.3.0
Dramatically improved real-world detection coverage -- tokentoll now catches LLM calls in complex codebases like aider, AutoGPT, ChatDev, instructor, and gpt-engineer.
Detection Improvements
- Lazy/nested imports -- detects
from openai import OpenAIinside functions, not just at module level - Re-exported modules -- handles
from myapp.llm import litellmproxy patterns - Factory function clients -- matches call chains like
get_client().chat.completions.create()without needing to trackclient = OpenAI() - Source text fallback --
can_handlechecks source for call patterns even when no SDK import is found - New call types -- audio transcription, speech, image generation
Performance
- 50x speedup on large codebases -- quick-reject string pre-filter skips irrelevant files before AST parsing
- 0.8s to scan Django (2903 files), down from 41s
- Zero false positives verified against Django, Flask, FastAPI
Variable Resolution
- Multi-pass constant propagation with fixed-point iteration
- Resolves
os.getenv("MODEL", "gpt-4o"),os.environ.get(...)fallback defaults - Function parameter defaults, kwargs splatting, class attributes, constructor arg propagation
posonlyargsfix for Python 3.8+ compatibility
Stats
- 51 tests, all passing
- 5 SDK detectors: OpenAI, Anthropic, Google GenAI, LiteLLM, LangChain
- Zero runtime dependencies
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Tokentoll
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]