# AI agents for DevOps and SRE: keep Terraform plans and pod logs from filling the context > Terraform plans, kubectl output and CI logs fill your AI agent's context and trigger compaction loops. Tokenade folds them on your machine and masks secrets. Source: https://tokenade.net/en/solutions/infrastructure-security/devops-sre · Updated: 2026-10-15 If you run Claude Code or Codex against your infrastructure, you know the pattern: one `terraform plan`, two `kubectl describe`, a failed CI log, and the session reads "Context low". The agent needed one error line. It got a thousand lines, and it will send them again on every turn. Tokenade folds that output on your computer before the agent sees it. ## What you deal with every day ### Compaction loops on large tool output The window fills, the agent compacts, and the next big result fills it again. A troubleshooting guide describes it exactly: "Claude Code compacts, then a single oversized file read or tool result immediately refills the window and it compacts again" ([startdebugging.net, 2026-07-22](https://startdebugging.net/2026/07/fix-claude-code-autocompact-thrashing-on-large-file-or-tool-output/)). Each compaction also costs a summary and loses detail you may need an hour later. ### Plans and run logs crowding the session Infrastructure work is mostly reading. A Kubernetes guide notes that the agent "diagnoses failing deployments by reading kubectl describe output and pod logs, which is where most debugging time goes" ([computingforgeeks.com, 2026-04-09](https://computingforgeeks.com/claude-code-kubernetes-guide/)). The usual advice is to move that reading elsewhere. A Terraform least-privilege guide recommends a separate read-only subagent, because "Plans, provider schemas, and run logs shouldn't sit in your main session" ([scalr.com, 2026-07-21](https://scalr.com/learning-center/using-claude-code-with-terraform-a-least-privilege-setup)). It works, but you maintain the subagent and the output still costs tokens there. ### MCP servers that return whole documents Terraform, Kubernetes and cloud MCP servers answer with large JSON. The same scalr guide notes that "Claude Code warns when one MCP result exceeds 10,000 tokens and caps results at 25,000 by default." A cap protects the window. It does not make the result any smaller below the cap. ### Secrets that arrive through output You can block the agent from opening `.env`. Output is another route. As one security write-up puts it: "A database error dumps the connection string with the password. The `.env` file was never opened, but the secrets are now in context anyway" ([strongly.ai, 2026-04-12](https://www.strongly.ai/blog/stop-leaking-secrets-claude-code.html)). In ops work, that means kubeconfigs, state files and CI tokens printed by a debug command. ## What Tokenade changes Tokenade is a local CLI that sits between the AI agent and its tools. `tokenade install` wires it into Claude Code, Codex, Cursor, Copilot CLI, OpenCode and 15+ other agents ([compatibility](https://tokenade.net/en/docs/compatibility)). - **Command-aware folding.** Tokenade recognises the command and uses a compactor that knows its output: `terraform`, `kubectl`, `docker`, `git`, `npm`, `pytest` and many more. Errors, changed resources and failing pods stay; progress lines and repeated noise go ([how compaction works](https://tokenade.net/en/docs/compaction)). - **Format-aware fallback.** For tools it does not know, it reads the shape of the output instead: JSON, YAML, logs, stack traces, tables, diffs. - **Nothing is thrown away.** When a result is still large, the agent gets a preview and the full output stays in a local stash for 7 days. The agent can pull exact lines back with `tokenade expand-ref --grep ` ([details](https://tokenade.net/en/docs/expand-ref-disclose)). - **Your internal tools too.** A short TOML file teaches Tokenade what matters in the output of an in-house CLI, with no code ([custom compactors](https://tokenade.net/en/docs/custom-compactors)). - **MCP results folded.** `tokenade mcp-wrap` puts third-party MCP servers behind the same folding ([wrap MCP servers](https://tokenade.net/en/docs/mcp-wrap)). - **Credentials masked.** Cloud keys, tokens, private keys and high-entropy strings it recognises are replaced with `` before the output reaches the agent, and before anything is stored. - **Savings you can check.** `tokenade gain` and the local dashboard show what each compaction saved, row by row. On long sessions, the kind an incident or a migration produces, Tokenade made sessions [39% cheaper in our public THOL benchmark](https://tokenade.net/en/thol). ## What stays on your computer Compaction runs on the computer where your agent runs. Your plans, logs, code and command arguments never pass through Tokenade's servers. What Tokenade sends is one small usage row per compaction (token counts, compactor name, agent, model, program name such as `kubectl`) so your plan can be metered. The full list is in [What Tokenade sends and stores](https://tokenade.net/en/docs/privacy-telemetry). Two limits to keep in mind: - The folded output still goes to the model provider your agent uses. Tokenade makes it shorter; it does not keep it on your machine. - Masking covers credentials Tokenade recognises. It is not a secret scanner, and it does not replace deny rules, a secrets manager or key rotation. If Tokenade itself fails, its hooks exit cleanly and the command runs as if it were not there ([hooks](https://tokenade.net/en/docs/hooks)). Your pipeline work is never blocked by it. > Let your AI agent read plans, pod logs and CI output without filling its context: Tokenade folds them on your computer. > > Install: `npm install -g @tokenade/cli && tokenade install && tokenade login` — or let your agent do it: https://tokenade.net/install.md ## Setting it up 1. **Install.** Run the installer from [Install Tokenade](https://tokenade.net/en/docs/install). It detects the agents on your computer. 2. **Wire your agents.** `tokenade install` adds the hooks or plugin for each agent it finds, and wraps the MCP servers in their configs. 3. **Work as usual.** Run your next `terraform plan` or `kubectl logs` through the agent, then check `tokenade gain` to see what was folded. ## FAQ ### Will the agent miss the error line in a long log? Compactors keep errors, warnings, failing tests and changed resources, and drop progress and repetition. If the agent needs more, the full output is in the local stash and `tokenade expand-ref` returns it, or only the lines matching a pattern. ### Does Tokenade understand Terraform and kubectl output? Yes. `terraform`, `kubectl` and `docker` each have a dedicated compactor. For other tools, Tokenade detects the format (JSON, YAML, logs, tables) and folds by structure. You can add your own rules in TOML. ### Does it work in CI or only on my laptop? Tokenade works with agents that run on your computer: Claude Code, Codex, Cursor, Copilot CLI, OpenCode and others. It folds the CI logs your agent fetches, for example with `gh run view`. It is not a CI plugin. ### Can I roll it out to my team? Each engineer installs it on their own machine and sees their own savings. Output never leaves those machines. See [Roll out Tokenade to a team](https://tokenade.net/en/docs/teams) and [pricing](https://tokenade.net/en/pricing). ## Further reading - [Output filtering: trim command logs for agents](https://tokenade.net/en/articles/output-filtering-command-logs) - [Stop an overnight AI agent burning your budget](https://tokenade.net/en/articles/overnight-agent-budget-safety) - [Claude Code /compact: what it costs and what survives](https://tokenade.net/en/articles/claude-code-compact)