Install the agent

The agent is dependency-light (it shells to sqlite3 and reads local logs) — a fresh machine needs only Node. Install it on any machine you want to track.

One-liner

macOS / Linux

curl -fsSL https://tokentracker-console.vercel.app/install.sh | sh -s -- <ingest-key>

Windows (PowerShell)

irm https://tokentracker-console.vercel.app/install.ps1 | iex

npm

npx tokentracker-agent enroll <ingest-key>

Get your ingest key from Onboarding (or Admin → Keys). The installer downloads the agent to ~/.tokentracker/, enrolls the machine, and schedules a daily run (Task Scheduler / launchd / systemd).

What it does

Reads local tool logs (Claude Code, Codex, Cowork, Cursor, Hermes, …) and ships a numbers-only daily rollup to your workspace.
Writes a WHAT-IS-COLLECTED.txt disclosure receipt into ~/.tokentracker/.
Stores runtime state under ~/.tokentracker/ (override with TB_HOME).

Two scheduled tasks

Enrolling registers two background jobs, not one:

| Task | Runs | Purpose | |---|---|---| | TokenTrackerFleet | daily, 23:30 local | collect + ship the day's rollup | | TokenTrackerBeat | every 15 min | report liveness, and pick up anything you queued from the console |

The heartbeat is ~200 bytes and the machine only ever calls out — nothing listens on it, there is no inbound port, and the only work it accepts is a fixed allow-list (refresh, health, config) checked by the server and again by the agent. TB_BEAT_MIN changes the interval; TB_BEAT=0 skips it entirely.

Each machine gets its own key (agent 1.9+)

At enrollment the machine mints a per-device credential and stores it beside the workspace key. From then on it ships under its own key, so you can revoke one machine from Systems → open the machine → Revoke this machine without touching any other. A machine still on the shared workspace key says so on its passport, and the revoke control is hidden for it — re-enroll it to give it one.

Useful commands

tokentracker status      # where state lives, last run, enrolled?
tokentracker doctor      # health check: collected, reconciled, ship-ready?
tokentracker run         # collect + ship one cycle now
tokentracker heartbeat   # report liveness once, run any queued command

See Privacy & what ships for exactly what leaves the machine (and what never does).

← All docs Open the console →