gnaw
Interactive repo-to-prompt packer with live token counts and gitleaks scanning. A fork of code2prompt, in Rust.
A terminal UI for choosing exactly what a model sees. Browse the tree, toggle files and directories in or out, and watch the token total update as you go — a context window is a budget, and the tool should show you spending it.
Why it exists
Agents pick their own context now, and most of the time that's the right default.
But not always: code review across a whole subsystem, a migration plan, a raw API
call where nobody is doing retrieval for you. In those cases I want to be the
retrieval step — deterministic, inspectable, and certain that .env.production
didn't tag along.
Three requirements: fast, interactive with visible token costs, secret-scanned. No existing tool had all three. The fast ones are fire-and-forget; the interactive one doesn't show token costs. So gnaw is a fork of code2prompt with live token accounting, a parallel extraction engine, and gitleaks wired in as the default scanner.
Numbers
Packing the Next.js monorepo (26,706 files), Docker-pinned at 8 cores, hyperfine over 10 runs:
| mean | |
|---|---|
| gnaw, no scan | 1.55 s |
| gnaw, full gitleaks pass | 1.76 s |
| yek | 8.05 s |
| repomix, scanning | 35.97 s |
The interesting number isn't the headline multiple — it's the gap between those first two rows. A full secret scan costs about 200 ms. Whatever era "scanning is too slow to leave on by default" belonged to, it's over.
Against repomix-rs with both tools scanning it's a dead heat, 1.01 ± 0.08, at the cost of 166 MB more peak RSS for the larger ruleset. The full methodology, caveats, and the part where I misread my own benchmark by 5x are in the write-up.
Next
An MCP server, so agents can call gnaw as a token-budgeted, secret-scanned context extractor rather than this staying a manual-only tool.
Repo on GitHub — quickstart in the README, benchmark script and Dockerfile beside it.