能力标签

🔌 MCP 🤖 Agent 🔄 工作流 🐳 Docker 💻 CLI 🧬 Embedding 🧠 Claude ✨ GPT 🖥 本地 LLM

🛠

AI工具

Tokenix

基于 Rust · 开源免费，本地部署，数据完全自主可控

英文名：tokenix

⭐ 11 Stars 💻 Rust 📄 MIT 🏷 AI 8.0分

8.0AI 综合评分

aiai-toolsclirust

📺 TG 频道

✦ AI Skill Hub 推荐

经 AI Skill Hub 精选评估，Tokenix 获评「强烈推荐」。这款AI工具在功能完整性、社区活跃度和易用性方面表现出色，AI 评分 8.0 分，适合有一定技术背景的用户使用。

📚 深度解析

Tokenix 是一款基于 Rust 的开源工具，在 GitHub 上收获 0k+ Star，是ai、ai-tools、cli、rust领域中的优质开源项目。开源工具的最大优势在于代码完全透明，你可以审计每一行代码的安全性，也可以根据自身需求进行二次开发和定制。

**为什么要使用开源工具而非商业 SaaS？**
对于个人开发者和有隐私需求的用户，本地部署的开源工具意味着数据不离本机，不受第三方服务商的数据政策约束。同时，开源工具通常没有使用次数限制和月度费用，一次安装即可长期使用，对于高频使用场景的总拥有成本（TCO）远低于订阅制商业工具。

**安装与环境准备**
Tokenix 依赖 Rust 运行环境。建议通过 pyenv（Python）或 nvm（Node.js）管理 Rust 版本，避免全局环境污染。对于新手用户，推荐先创建虚拟环境（python -m venv venv && source venv/bin/activate），再安装依赖，这样即使出现问题也可以随时删除虚拟环境重新开始，不影响系统稳定性。

**社区与维护**
GitHub Issue 和 Discussion 是获取帮助的最快渠道。在提问前建议先检查 Closed Issues（已关闭的问题），大多数常见问题都已有解答。遇到 Bug 时，提供 pip list 的输出、完整错误堆栈和最小可复现示例，能显著提高开发者响应速度。AI Skill Hub 将持续追踪 Tokenix 的版本更新，及时通知重要功能变化。

📋 工具概览

本地语义搜索、符号图、秘密扫描和CLI工具

Tokenix 是一款基于 Rust 开发的开源工具，专注于 ai、ai-tools、cli 等核心功能。作为 GitHub 开源项目，它拥有活跃的社区支持和持续的版本迭代，代码完全透明可审计，支持本地部署以保护数据隐私。无论是个人使用还是集成到企业工作流，都能提供稳定可靠的解决方案。

GitHub Stars

⭐ 11

开发语言

Rust

支持平台

Windows / macOS / Linux

维护状态

轻量级项目，按需更新

开源协议

MIT

AI 综合评分

8.0 分

工具类型

AI工具

Forks

—

📖 中文文档

以下内容由 AI Skill Hub 根据项目信息自动整理，如需查看完整原始文档请访问底部「原始来源」。

本地语义搜索、符号图、秘密扫描和CLI工具

📌 核心特色

开源免费，支持本地部署，数据完全自主可控
活跃的 GitHub 开源社区，持续迭代更新
提供详细文档和使用示例，新手友好
支持自定义配置，灵活适配不同使用环境
可作为基础组件集成进现有技术栈或进行二次开发

🎯 主要使用场景

本地部署运行，保护数据隐私，满足合规要求
自定义集成到现有系统，扩展技术栈能力
作为开源基础组件进行商业化二次开发

以下安装命令基于项目开发语言和类型自动生成，实际以官方 README 为准。

安装命令

# 方式一：cargo install（推荐）
cargo install tokenix

# 方式二：从源码编译
git clone https://github.com/juninmd/tokenix
cd tokenix
cargo build --release
# 二进制在 ./target/release/tokenix

📋 安装步骤说明

访问 GitHub 仓库页面
按照 README 文档完成依赖安装
根据系统环境完成初始化配置
参考官方示例或文档开始使用
遇到问题可在 GitHub Issues 中查找解答

以下用法示例由 AI Skill Hub 整理，涵盖最常见的使用场景。

常用命令 / 代码示例

# 查看帮助
tokenix --help

# 基本运行
tokenix [options] <input>

# 详细使用说明请查阅文档
# https://github.com/juninmd/tokenix

以下配置示例基于典型使用场景生成，具体参数请参照官方文档调整。

配置示例

# tokenix 配置说明
# 查看配置选项
tokenix --config-example > config.yml

# 常见配置项
# output_dir: ./output
# log_level: info
# workers: 4

# 环境变量（覆盖配置文件）
export TOKENIX_CONFIG="/path/to/config.yml"

📑 README 深度解析真实文档完整度 56/100 查看 GitHub 原文 →

以下内容由系统直接从 GitHub README 解析整理，保留代码块、表格与列表结构。

简介

Local semantic search, symbol graphs, secrets scanning, output filters, and CLI hooks that save 60-90% LLM tokens.

<a href="#-quick-install">Install</a> · <a href="#-interactive-dashboard">Dashboard</a> · <a href="#-how-it-works">How it Works</a> · <a href="#-usage">Usage</a> · <a href="#-setup-by-tool">Setup</a> · <a href="#-commands-reference">Commands</a> · <a href="CONTRIBUTING.md">Contributing</a> </div>

---

tokenix is a local-first Rust CLI that helps AI coding agents understand a repository without dumping huge files into the prompt. It indexes your code, finds relevant chunks by meaning, returns compact file outlines, and can hook into AI tools to replace noisy reads and command output with smaller, more useful context. Works with Claude Code, GitHub Copilot, OpenAI Codex CLI, Gemini, and any MCP client. No Ollama or external server required.

Without tokenix:  Read(src/auth/middleware.rs) → 800 lines → ~2,400 tokens  (illustrative)
With tokenix:     tokenix read src/auth/middleware.rs → symbol outline → ~180 tokens

Savings depend on codebase size, AI behavior, and file sizes. Run tokenix gain to see your real numbers.

---

✨ Features

Feature	Description
Semantic search	Find relevant code by meaning, not just keywords (`tokenix query`); cross-project with `--link`
Context artifacts	`tokenix artifacts` indexes non-code schemas, API docs, and specs via `.tokenix/artifacts.json`
Hybrid ranking	FTS5 BM25 + vector cosine + RRF fusion for ranked results
Exact search	Regex/literal search over indexed content, no embedding (`tokenix grep`)
One-call task context	`tokenix context` combines semantic search, entry points, and compact outlines with strict budget modes (`plan`, `debug`, `audit`, `security`, `review`)
Graph-aware explore	`tokenix explore` returns related symbols, relationship maps, and grouped source in one capped call
Repository pack	`tokenix pack` emits a budgeted, secret-safe repo map with changed-file packs, token maps, and safety reporting
Symbol graph	`tokenix symbols` (`--kind` filters by symbol type), `callers`, `callees`, `impact`, `flow`, and `cycles` trace relationships, call-flow, and circular deps between indexed symbols
Import graph	`tokenix deps FILE` shows file-level import dependencies (`--reverse` for importers, `--transitive` to follow the chain); external deps are tracked too
Int8-quantized embeddings	Vectors are stored int8-quantized (4x smaller DB + daemon RAM, near-identical recall); legacy f32 indexes migrate automatically on the next `tokenix index`
JSON output	`--json` on `query`, `context`, `explore`, `read`, `symbols`, `callers`, `callees`, `deps` (+ `impact --format json`) for scripts and agent pipelines
PC-friendly indexing	`tokenix index` runs at below-normal OS priority by default so long index runs never starve the machine (`--no-low-priority` opts out)
Interactive HTML/Mermaid graphs	`tokenix impact --format html\\|mermaid` exports vis.js / Mermaid flowcharts; `tokenix flow --format mermaid` traces call flow
Cycle detection	`tokenix cycles` finds circular dependencies via Tarjan's strongly-connected components algorithm, dropping same-name (homonym) false positives and annotating each node with `path:line`
Token map	`tokenix tokenmap` shows a directory tree with token counts per file/folder
Preference memory	`tokenix memory add/list` stores global and project preferences in editable Markdown; context/explore include saved preferences
Dynamic language detection	Map custom file extensions to any built-in parser via a project `.tokenix.toml` — no recompile needed
Legacy VB6 + SQL sources	`.bas`/`.cls`/`.ctl`/`.frm`/`.vbp` and `.sql`/`.fnc`/`.trg`/`.pkg`/`.prc`/`.tab`/`.vw` indexed with symbol-aware heuristic chunking (`Sub`/`Function`/`Property`, `CREATE` objects); UTF-16 SQL files decoded via BOM; binary files (e.g. `.frx`) skipped by a NUL sniff
Symbol-aware chunking	AST Tree-sitter parsers for Rust, Python, TypeScript, JavaScript, Go, C/C++
Multi-agent safe index	PID-based index lock prevents concurrent reindex; embeddings are committed per batch, so a killed index run resumes from the last completed batch
Smart file reader	Outlines large files; supports `--symbol` and `--lines` reads
Hook-based interception	`PreToolUse` intercepts large reads and rewrites noisy Bash and PowerShell commands before execution; thresholds tunable via `[hook]` in `.tokenix.toml`
Structural output compression	Fuzzy grouping, compact `git`/`cargo` filters, NDJSON/JSON compaction, and ANSI/Emoji stripping
Local project filters	Drop `.toml` files in `.tokenix/filters/` for project-scoped compression rules — highest priority over user and bundled filters
Output filters	244 TOML output filters embedded in the binary (each homologated against 522 golden cases) — auto-applied to Bash output for `uv`, `cargo`, `terraform`, `ansible`, `docker`, `kubectl`, `git`, `npm`, `pnpm`, `bun`, `deno`, `vite`, `pip`, `poetry`, `go`, `rust`, `helm`, and more
Filter generation	`tokenix filter generate` writes a TOML filter for a command; `tokenix filter record` captures real output for richer generation
GPU acceleration (opt-in)	Build with `--features directml` (Windows) or `--features cuda` to run embeddings on GPU; GPU is used by default at runtime with automatic CPU fallback, or force CPU with `--only-cpu`
Environment diagnostics	`tokenix doctor` reports the compiled backend, detected GPU, CUDA/cuDNN status, model cache, and daemon
Branch-aware indexing	`TOKENIX_BRANCH_AWARE=true` isolates indexes per git branch
In-memory daemon	`tokenix serve` keeps model + index in RAM so repeated hook calls avoid reloading the model each invocation; `tokenix daemon status\\|stop\\|restart` manages it
Graceful fallback	Exits `0` on errors — your AI session is never broken
Token budget	Results fit within a configurable token budget (default `1200`)
Savings analytics	`tokenix gain` — token summary, savings split by source (semantic index vs command filters), and by-tool histogram; `--cost-estimate` adds a per-model cost table (10 reference models across Anthropic / OpenAI / Google)
Slim MCP profile	`tokenix mcp --profile slim` exposes 3 meta-tools instead of the full tool surface for hosts that support progressive discovery
MCP/prompt weight audit	`tokenix prompt-audit --recommend --profile-impact` connects to configured MCP servers, tokenizes tool schemas, and shows full-vs-slim MCP savings
Session audit	`tokenix session-audit --cache-hygiene` combines index freshness, hook history, MCP/tool weight, and prompt-cache stability risks
Conversation token-waste audit	`tokenix conversation-audit` scans local Claude / Codex / Copilot / OpenAI histories for large assistant-visible blobs such as full reads, command logs, bootstrap prompts, connector JSON, images, patches, and task artifacts
Conversation secret scan	`tokenix scan-secrets` — gitleaks-style credential scan of Claude / Gemini / Copilot / Antigravity conversation transcripts (no git); findings are always redacted, exits non-zero when any are found. Patterns live in TOML (`assets/secret-rules/`), extensible via `~/.tokenix/secret-rules/.toml` or `<repo>/.tokenix/secret-rules/.toml`
Local-first, no dependencies	fastembed ONNX in-process — no Ollama, no server, no internet after first run

---

⚡ Quick Install

🔧 Setup by Tool

Linux / Windows — CUDA (needs CUDA 12.x + cuDNN 9.x installed and on PATH;

🛠 Usage

📖 Commands Reference

Run bare tokenix (or tokenix --help) for an audience-grouped command catalog with examples. The reference below mirrors that grouping: AI agent commands (the LLM/hooks drive these for token-lean retrieval) vs human commands (setup, ops & analytics you run yourself).

🎯 aiskill88 AI 点评 A 级 2026-06-17

Tokenix是一个功能强大的本地语义搜索工具

📚 实用指南（长尾问题）

适合谁

需要让 Claude / Cursor 操作本地工具的 AI 工程师
构建多智能体协作系统的 Agent 开发者
构建企业知识库 / RAG 检索应用的团队

最佳实践

配置 MCP 服务器时建议使用 stdio 传输 + JSON-RPC，避免暴露公网
生产部署优先使用 Docker Compose 隔离依赖，并挂载 volume 持久化数据
本地部署优先选 GGUF 量化模型，节省显存并保持响应速度
Agent 任务先做 dry-run 验证工具调用链，再开启自主执行

常见错误

API key 直接提交到 git 仓库（请用 .env 并加入 .gitignore）
MCP 配置路径拼错或权限不足，重启 Claude Desktop 才生效
容器内无法访问宿主机 localhost — 使用 host.docker.internal
显存不足直接 OOM — 优先降低 context 或换更小的量化模型

部署方案

Docker：tokenix 提供官方镜像，docker compose up 一键启动
CLI：直接 npm install -g / pip install，命令行调用
本地部署：CPU 8GB 起，GPU 推荐 16GB+ 显存
云端托管：可放在 Vercel / Railway / Fly.io 等 PaaS 平台

⚡ 核心功能

开源免费，支持本地部署，数据完全自主可控
活跃的 GitHub 开源社区，持续迭代更新
提供详细文档和使用示例，新手友好
支持自定义配置，灵活适配不同使用环境
可作为基础组件集成进现有技术栈或进行二次开发

👥 适合谁

需要让 Claude / Cursor 操作本地工具的 AI 工程师
构建多智能体协作系统的 Agent 开发者
构建企业知识库 / RAG 检索应用的团队

⭐ 最佳实践

配置 MCP 服务器时建议使用 stdio 传输 + JSON-RPC，避免暴露公网
生产部署优先使用 Docker Compose 隔离依赖，并挂载 volume 持久化数据
本地部署优先选 GGUF 量化模型，节省显存并保持响应速度
Agent 任务先做 dry-run 验证工具调用链，再开启自主执行

⚠️ 常见错误

API key 直接提交到 git 仓库（请用 .env 并加入 .gitignore）
MCP 配置路径拼错或权限不足，重启 Claude Desktop 才生效
容器内无法访问宿主机 localhost — 使用 host.docker.internal
显存不足直接 OOM — 优先降低 context 或换更小的量化模型

👥 适合人群

AI 技术爱好者研究人员和学生开发者和工程师技术创业者

🎯 使用场景

本地部署运行，保护数据隐私，满足合规要求
自定义集成到现有系统，扩展技术栈能力
作为开源基础组件进行商业化二次开发

⚖️ 优点与不足

✅ 优点

+MIT 协议，可免费商用
+完全开源免费，无授权费用
+本地部署，数据完全自主可控
+开发者社区支持，遇问题可查可问

⚠️ 不足

−安装和初始配置可能需要一定技术基础
−功能完整性通常不如成熟商业产品
−技术支持主要依赖开源社区，响应速度不稳定

⚠️ 使用须知

AI Skill Hub 为第三方内容聚合平台，本页面信息基于公开数据整理，不对工具功能和质量作任何法律背书。

建议在沙箱或测试环境中充分验证后，再部署至生产环境，并做好必要的安全评估。

📄 License 说明

🔗 相关工具推荐

transformers AI技能包

Hugging Face开源的深度学习框架，提供预训练语言模型、视觉模型和多模态模型。集成BERT、GPT、Llama等

ComfyUI 节点式AI图像生成

强大的开源扩散模型可视化工具，提供图形界面、API和后端服务。采用节点图式设计，支持模块化工作流构建，适合AI绘图、图像

llama-cpp AI技能包

高效的大语言模型C/C++推理框架，支持在本地CPU/GPU上运行量化LLM模型，具有内存占用小、推理速度快的特点。适合

yt-dlp 视频下载

功能强大的开源视频下载工具，支持YouTube、TikTok等数千个视频平台，可自动下载视频、字幕、封面和元数据。适合内

📰 相关 AI 新闻

AI 前沿资讯：How many tabs do you currently…

AI 资讯 · 知识关联

AI Agent 自主化能力最新进展

AI 资讯 · 知识关联

Anthropic Claude 最新进展

AI 资讯 · 知识关联

AI Agent 自主化能力最新进展

AI 资讯 · 知识关联

🍿 AI 圈相关吃瓜

配了5个 MCP 工具，Claude 一个都没用

AI 圈观察

AutoGPT 自主完成了任务：把我的文件夹全部重命名了

AI 圈观察

Filesystem MCP 帮 Claude 找文件，找了整个 node_modules

🗺️ 相关解决方案

ai-workflow-templates

docker

docker-deploy

🧩 你可能还需要

基于当前 Skill 的能力图谱，自动补全的工具组合

技能寻求者

MCP · Agent · 工作流

natively-cluely-ai-assistant — Claude Skill 中文使用文档

免费开源的AI面试助手，实时转录，隐蔽模式，局部RAG，BYOK。无订阅，防止数据泄露。

gptme Agent工作流

MCP · Agent · 工作流

AI公司多智能体操作系统

为Claude Code设计的开源MCP工具集，包含108个MCP工具和40+智能体模板。支持多智能体协作编排，提供完整的自主代理框架。适合

❓ 常见问题 FAQ

如何使用Tokenix进行代码搜索−

使用tokenix search命令进行代码搜索

安装这个工具需要什么基础？+

安装过程中遇到依赖冲突怎么办？+

工具安装成功但运行报错，该怎么处理？+

这个工具是否有数据隐私风险？+

工具更新后会影响已有的配置和数据吗？+

💡 AI Skill Hub 点评

AI Skill Hub 点评：Tokenix 的核心功能完整，质量优秀。对于AI 技术爱好者来说，这是一个值得纳入个人工具库的选择。建议先在非生产环境试用，再逐步推广。

📚 深入学习 Tokenix

查看分步骤安装教程和完整使用指南，快速上手这款工具

⚙️ 安装教程 📚 使用教程

🌐 原始信息

原始名称	`tokenix`
原始描述	开源AI工具：Local semantic search, symbol graphs, secrets scanning, output filters, and CLI 。⭐11 · Rust
Topics	`aiai-toolsclirust`
GitHub	https://github.com/juninmd/tokenix
License	MIT
语言	Rust

🔗 原始来源

🐙 GitHub 仓库 https://github.com/juninmd/tokenix

收录时间：2026-06-17 · 更新时间：2026-06-17 · License：MIT · AI Skill Hub 不对第三方内容的准确性作法律背书。

📺 订阅 AI Skill Hub Daily Telegram 频道

每天 8 条精选 AI Skill、MCP、Agent 与自动化工具推送

加入频道 →

Feature	Description
Semantic search	Find relevant code by meaning, not just keywords (`tokenix query`); cross-project with `--link`
Context artifacts	`tokenix artifacts` indexes non-code schemas, API docs, and specs via `.tokenix/artifacts.json`
Hybrid ranking	FTS5 BM25 + vector cosine + RRF fusion for ranked results
Exact search	Regex/literal search over indexed content, no embedding (`tokenix grep`)
One-call task context	`tokenix context` combines semantic search, entry points, and compact outlines with strict budget modes (`plan`, `debug`, `audit`, `security`, `review`)
Graph-aware explore	`tokenix explore` returns related symbols, relationship maps, and grouped source in one capped call
Repository pack	`tokenix pack` emits a budgeted, secret-safe repo map with changed-file packs, token maps, and safety reporting
Symbol graph	`tokenix symbols` (`--kind` filters by symbol type), `callers`, `callees`, `impact`, `flow`, and `cycles` trace relationships, call-flow, and circular deps between indexed symbols
Import graph	`tokenix deps FILE` shows file-level import dependencies (`--reverse` for importers, `--transitive` to follow the chain); external deps are tracked too
Int8-quantized embeddings	Vectors are stored int8-quantized (4x smaller DB + daemon RAM, near-identical recall); legacy f32 indexes migrate automatically on the next `tokenix index`
JSON output	`--json` on `query`, `context`, `explore`, `read`, `symbols`, `callers`, `callees`, `deps` (+ `impact --format json`) for scripts and agent pipelines
PC-friendly indexing	`tokenix index` runs at below-normal OS priority by default so long index runs never starve the machine (`--no-low-priority` opts out)
Interactive HTML/Mermaid graphs	`tokenix impact --format html\\|mermaid` exports vis.js / Mermaid flowcharts; `tokenix flow --format mermaid` traces call flow
Cycle detection	`tokenix cycles` finds circular dependencies via Tarjan's strongly-connected components algorithm, dropping same-name (homonym) false positives and annotating each node with `path:line`
Token map	`tokenix tokenmap` shows a directory tree with token counts per file/folder
Preference memory	`tokenix memory add/list` stores global and project preferences in editable Markdown; context/explore include saved preferences
Dynamic language detection	Map custom file extensions to any built-in parser via a project `.tokenix.toml` — no recompile needed
Legacy VB6 + SQL sources	`.bas`/`.cls`/`.ctl`/`.frm`/`.vbp` and `.sql`/`.fnc`/`.trg`/`.pkg`/`.prc`/`.tab`/`.vw` indexed with symbol-aware heuristic chunking (`Sub`/`Function`/`Property`, `CREATE` objects); UTF-16 SQL files decoded via BOM; binary files (e.g. `.frx`) skipped by a NUL sniff
Symbol-aware chunking	AST Tree-sitter parsers for Rust, Python, TypeScript, JavaScript, Go, C/C++
Multi-agent safe index	PID-based index lock prevents concurrent reindex; embeddings are committed per batch, so a killed index run resumes from the last completed batch
Smart file reader	Outlines large files; supports `--symbol` and `--lines` reads
Hook-based interception	`PreToolUse` intercepts large reads and rewrites noisy Bash and PowerShell commands before execution; thresholds tunable via `[hook]` in `.tokenix.toml`
Structural output compression	Fuzzy grouping, compact `git`/`cargo` filters, NDJSON/JSON compaction, and ANSI/Emoji stripping
Local project filters	Drop `.toml` files in `.tokenix/filters/` for project-scoped compression rules — highest priority over user and bundled filters
Output filters	244 TOML output filters embedded in the binary (each homologated against 522 golden cases) — auto-applied to Bash output for `uv`, `cargo`, `terraform`, `ansible`, `docker`, `kubectl`, `git`, `npm`, `pnpm`, `bun`, `deno`, `vite`, `pip`, `poetry`, `go`, `rust`, `helm`, and more
Filter generation	`tokenix filter generate` writes a TOML filter for a command; `tokenix filter record` captures real output for richer generation
GPU acceleration (opt-in)	Build with `--features directml` (Windows) or `--features cuda` to run embeddings on GPU; GPU is used by default at runtime with automatic CPU fallback, or force CPU with `--only-cpu`
Environment diagnostics	`tokenix doctor` reports the compiled backend, detected GPU, CUDA/cuDNN status, model cache, and daemon
Branch-aware indexing	`TOKENIX_BRANCH_AWARE=true` isolates indexes per git branch
In-memory daemon	`tokenix serve` keeps model + index in RAM so repeated hook calls avoid reloading the model each invocation; `tokenix daemon status\\|stop\\|restart` manages it
Graceful fallback	Exits `0` on errors — your AI session is never broken
Token budget	Results fit within a configurable token budget (default `1200`)
Savings analytics	`tokenix gain` — token summary, savings split by source (semantic index vs command filters), and by-tool histogram; `--cost-estimate` adds a per-model cost table (10 reference models across Anthropic / OpenAI / Google)
Slim MCP profile	`tokenix mcp --profile slim` exposes 3 meta-tools instead of the full tool surface for hosts that support progressive discovery
MCP/prompt weight audit	`tokenix prompt-audit --recommend --profile-impact` connects to configured MCP servers, tokenizes tool schemas, and shows full-vs-slim MCP savings
Session audit	`tokenix session-audit --cache-hygiene` combines index freshness, hook history, MCP/tool weight, and prompt-cache stability risks
Conversation token-waste audit	`tokenix conversation-audit` scans local Claude / Codex / Copilot / OpenAI histories for large assistant-visible blobs such as full reads, command logs, bootstrap prompts, connector JSON, images, patches, and task artifacts
Conversation secret scan	`tokenix scan-secrets` — gitleaks-style credential scan of Claude / Gemini / Copilot / Antigravity conversation transcripts (no git); findings are always redacted, exits non-zero when any are found. Patterns live in TOML (`assets/secret-rules/`), extensible via `~/.tokenix/secret-rules/.toml` or `<repo>/.tokenix/secret-rules/.toml`
Local-first, no dependencies	fastembed ONNX in-process — no Ollama, no server, no internet after first run