Skip to main content

AI agents and token efficiency

An AI coding agent writes code fast, but to reason about a change it usually reads a lot of files, and every file it reads costs tokens. Vulkro hands the agent the map of your application instead: what a symbol depends on, what a change will touch, and whether that change is safe. The agent works from a small, ranked answer rather than the whole repository.

Answering "what does this change affect?" from that map, instead of reading every file, took up to 98% fewer tokens on our benchmark repositories. Every count the map returns says what it could not resolve, so a number is never mistaken for the whole picture.

It runs on your machine. Scan content never leaves it, the answers are deterministic, and with --offline there is no network call at all.

Wire it into your agent​

Run Vulkro as a Model Context Protocol (MCP) server. Your agent calls small, structured tools and gets compact JSON back, instead of you pasting scan output into the chat or the agent reading file after file.

Claude Code​

claude mcp add vulkro -- vulkro mcp serve --offline

Cursor​

Add the server to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project), then turn it on under Settings -> MCP:

{
  "mcpServers": {
    "vulkro": {
      "command": "vulkro",
      "args": ["mcp", "serve", "--offline"]
    }
  }
}

Claude Desktop, Windsurf and Continue use the same command in their own MCP configuration.

Inline, as you type​

The editor extension shows findings inline with one-click fixes. Cursor, Windsurf and VSCodium are VS Code forks, so it installs straight in:

vulkro install-extension --editor cursor

The tools that save the tokens​

Pro

The three change-intelligence tools below (code_graph, assess_change, from_trace) are part of Vulkro Pro: the Code-structure map. On Free the MCP server still runs and the scanning tools work; these three return a short message naming what they need and where to get it. See Pricing.

  • code_graph builds a ranked, scan-free map of your symbols and what depends on what. The agent navigates from the map instead of reading every file.
  • assess_change takes a diff and returns the blast radius, the tests that cover it, and whether the change is safe or introduced a finding: a short verdict, not a full re-scan.
  • from_trace takes a production stack trace and maps each frame to the function it names, with the findings already on that line.

The full input and output shape of every tool is in the MCP server reference.

The lean loop​

  1. Before an edit, call code_graph for the map, and assess_change on the symbol you are about to touch for its blast radius and the tests that cover it.
  2. After an edit, scan only what changed at --min-confidence high, so the agent sees the proof-backed findings and not the noise.
  3. On a crash, paste the stack trace into from_trace to land on the function and its findings.

Two habits carry the savings: let the agent work from the map and the diff rather than the whole repository, and filter to high-confidence findings.

It stays on your machine​

--offline (or VULKRO_OFFLINE=1) hard-disables every outbound call: the CVE feed, the update check, the usage heartbeat, and any cloud AI endpoint. Even without it, dependency-CVE matching runs against the local bundle, so nothing about your code or your dependency tree is uploaded. The answers are deterministic, so the same code always produces the same map.

Last updated on