Skip to content

Tokentoll

v0.3.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 1mo Model Serving & MLOps
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

anthropic cost-optimization devtools github-action llm mlops
+3 more
openai python static-analysis

Summary

AI summary

Detection improvements add lazy/nested imports, re-export handling, factory function support and new audio/image call types; variable resolution gains multi‑pass constant propagation with env‑var fallbacks; performance sees a 50x speedup on large codebases.

Full changelog

What's New in v0.3.0

Dramatically improved real-world detection coverage -- tokentoll now catches LLM calls in complex codebases like aider, AutoGPT, ChatDev, instructor, and gpt-engineer.

Detection Improvements

  • Lazy/nested imports -- detects from openai import OpenAI inside functions, not just at module level
  • Re-exported modules -- handles from myapp.llm import litellm proxy patterns
  • Factory function clients -- matches call chains like get_client().chat.completions.create() without needing to track client = OpenAI()
  • Source text fallback -- can_handle checks source for call patterns even when no SDK import is found
  • New call types -- audio transcription, speech, image generation

Performance

  • 50x speedup on large codebases -- quick-reject string pre-filter skips irrelevant files before AST parsing
  • 0.8s to scan Django (2903 files), down from 41s
  • Zero false positives verified against Django, Flask, FastAPI

Variable Resolution

  • Multi-pass constant propagation with fixed-point iteration
  • Resolves os.getenv("MODEL", "gpt-4o"), os.environ.get(...) fallback defaults
  • Function parameter defaults, kwargs splatting, class attributes, constructor arg propagation
  • posonlyargs fix for Python 3.8+ compatibility

Stats

  • 51 tests, all passing
  • 5 SDK detectors: OpenAI, Anthropic, Google GenAI, LiteLLM, LangChain
  • Zero runtime dependencies

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Tokentoll

Get notified when new releases ship.

Sign up free

About Tokentoll

All releases →

Related context

Beta — feedback welcome: [email protected]