Splunk’s newly released open‑source Token Meter adds a local observability layer for AI coding agents, turning raw Claude, Codex, Cursor, OpenCode, Kiro or Pi logs into real‑time token‑usage and cost metrics. Engineers can now see exactly how many tokens a session consumes, how fast they are emitted, and what the estimated spend would be at public model rates, giving them a concrete lever to curb runaway AI spend.
How Token Meter Works
The utility watches the trace files that supported agents write to disk. It parses input‑vs‑output token counts, measures wait time on the model, and applies publicly published pricing to produce an estimated cost per run. A built‑in dashboard presents:
- Tokens per second and total token count
- Breakdown of fresh input versus generated output
- Tool‑call return token volume
- Filters for runtime, model, state and time to locate current, completed or historical sessions
- Comparative views across agents, models, days or tools
In addition, a read‑only Model Context Protocol (MCP) server exposes the same metrics so an AI coding agent can query its own cost data during execution.
Operational Implications
Because the tool runs locally on Linux or macOS, it can be added to developer workstations, CI runners, or on‑premise test clusters without external dependencies. The alerting subsystem can fire a notification when a run exceeds a user‑defined cost threshold or when token consumption spikes, enabling automated budget enforcement. Teams can embed the dashboard into existing observability stacks or script the MCP endpoint to feed cost data into CI/CD dashboards, making AI spend a first‑class metric alongside CPU or memory usage.
Security and Data‑Handling Considerations
Token Meter reads raw agent logs that may contain code snippets, prompts, or data payloads. Operators should treat those logs as sensitive and enforce appropriate file‑system permissions. The MCP server is read‑only, but exposing any local endpoint widens the attack surface; restricting access to trusted processes or network namespaces is advisable. As an open‑source project, the codebase should be reviewed for inadvertent credential leakage or insecure defaults before production deployment.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Adopt Token Meter where AI‑driven development is already in use, configure thresholds that align with budget policies, and integrate the MCP feed into existing monitoring pipelines. Use the comparative dashboards to evaluate whether a cheaper model can replace a higher‑cost one for a given task. Finally, keep an eye on emerging federated data‑access patterns that Splunk hints at, as future versions may shift cost‑control logic from the workstation to a distributed service layer.
