Security & privacy
Exactly what leaves your machine when you wrap an agent — and what doesn't.
tokenolo is built to sit in front of your coding agent while seeing as little as possible. This page is the precise account of what happens to your data.
Where your requests go
tokenolo wrap starts a proxy on 127.0.0.1 — your own machine — and points
your agent at it. Each request is forwarded directly to the model provider
(e.g. api.anthropic.com) using your own API key. Nothing routes through a
tokenolo server.
What tokenolo changes
Exactly one thing: it removes redundant filler from your own (user) messages
— leading and trailing politeness like "please", "could you", "thanks". The edit
is deterministic and removal-only, so the text that leaves is always a
subsequence of what you wrote. No paraphrase, no summarization, no reordering.
It fails open: if anything about a request is unexpected, your original message passes straight through, untouched.
What tokenolo never touches
Everything else is forwarded to the model verbatim:
- Your system prompt and tools
- Tool calls and tool results
- Assistant turns and prior history
- Files, images, and documents
What tokenolo stores
Nothing. tokenolo does not store your prompt text, your code, your tool output, or your conversation history. It counts usage against your plan's quota — that's it.
Your credentials
The CLI only uses the API key you hand to tokenolo login (or login --key). It
does not read a key from your environment automatically. Keep tk_live_… keys
in a secret store, and rotate from the dashboard if one leaks.
Reversing it
tokenolo is not sticky. Stop launching through wrap and your agent uses its
normal configuration again; uninstall entirely with npm uninstall -g tokenolo.
The one server-side exception: tokenolo paraphrase
There is a separate, opt-in command — tokenolo paraphrase — that sends a
single prompt to a server-side model to rewrite it more aggressively for fewer
tokens. This is not part of wrap and never runs unless you invoke it
explicitly. If you use it, that one prompt does leave your machine for that
rewrite; wrap does not.
Questions
See the FAQ, or book a demo to talk it through.