cryptosaras/tokenward

Tokenwarden is a TypeScript tool that plugs into Claude Code (Anthropic's AI coding assistant) and enforces spending limits rather than just reporting them. The README positions it as complementary to existing cost-tracking tools: those tools tell you what you already spent, while tokenwarden blocks or interrupts activity before you spend more than you intended. It works by registering handlers for events that Claude Code fires at various points in a session: when a user submits a prompt, before a tool call executes, before the context is compacted, and at the start and end of sessions. By hooking into these events, the tool can cancel or hold calls for confirmation before they happen. The main features are: hard dollar caps per session, per day, per project, or per model, which block further activity once a limit is reached, an escalation system that asks for human confirmation before expensive operations like spawning a subagent on a costly model, argument-bloat prevention that caps how many lines a file read can return and requires Grep and Glob calls to include path constraints, and a compaction coach that reminds users to compress the conversation context when it is nearly full, reducing the cost of subsequent calls. For users on flat-rate subscription plans where individual API costs are not billed per call, tokenwarden tracks usage against Anthropic's rolling five-hour and weekly usage windows instead. The README is clear that these window ceilings are estimates because Anthropic does not publish exact numbers, and that the tool only sees activity on the machine where it is installed. Installation adds entries to Claude Code's settings file that point at the tokenwarden binary. It starts in observe mode by default, logging what it would have blocked without actually blocking anything, so users can review its behavior across a full session before switching to enforcement mode. Enforcement mode is opted into by editing a local JSON configuration file. The tool is designed to fail open, meaning if it encounters an internal error it does nothing rather than blocking the user's work.