TOON format cuts agent token costs in Sonar issue output

At a glance

What this is: This is Sonar’s analysis of how TOON format reduces the token overhead of passing issue lists into AI coding workflows without losing information.

Why it matters: It matters because agent cost, context efficiency, and tool-output design now influence how teams govern AI-assisted development, including the boundaries around NHI-like agent workflows and coding automation.

By the numbers:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.

👉 Read Sonar's analysis of TOON format for AI issue output

Context

Token usage is increasingly a data-formatting problem, not just a model-selection problem. When AI agents ingest issue lists, quality-gate status, or dependency findings, they pay for repetition, field labels, and structural verbosity as well as the underlying content. In practice, that makes output schema a governance issue for AI-assisted development.

TOON is a compact, lossless way to represent JSON data for LLM input, and it works best where the data is uniform, such as issue lists or other tabular records. The identity angle here is indirect but real: as enterprises automate more development and security workflows, they need to understand how agent context is shaped, costed, and controlled across toolchains.

Sonar’s starting position is typical for teams trying to operationalise AI coding assistants: the data is useful, but the default format is unnecessarily expensive for machines to consume. The article is strongest when it treats token savings as an operational efficiency problem rather than a novelty.

Key questions

Q: How should security teams decide whether to use TOON or JSON for AI agent input?

A: Use TOON when the data is uniform, repetitive, and consumed by a machine that benefits from reduced structural noise. Keep JSON when the payload is deeply nested, irregular, or needs broad compatibility. The decision should be based on measured token savings and parsing reliability, not on format preference alone.

Q: Why do structured tool outputs affect AI agent cost so much?

A: Because agents pay for repeated field names, punctuation, and schema verbosity every time they ingest a payload. When outputs are tabular or repetitive, compact encoding can reduce the context burden without changing the underlying data. In practice, format design becomes part of cost control and workflow efficiency.

Q: What breaks when teams compress data for agents too aggressively?

A: Loss of fidelity, broken parsers, and ambiguous records. If a compact format is not lossless or cannot be validated consistently, downstream automation loses reliability and auditability. The right standard is not smallest possible output, but smallest output that still preserves structure, controls, and traceability.

Q: How can teams govern AI context without slowing engineering workflows?

A: Set rules for which tools may emit compact output, define the consumers that can parse it, and validate the round-trip back to the original data model. That lets teams reduce token use while keeping automation auditable and predictable, which is the real governance requirement.

Technical breakdown

Why TOON is smaller than JSON for issue lists

TOON, or Token-Oriented Object Notation, keeps the JSON data model intact but compresses the way repeated structure is expressed. For uniform arrays of objects, it declares the field names once in a header and then streams each record as a compact row. That works well for issue lists because every item shares the same schema, so the model does not need to re-parse repeated keys, braces, and quotes on every line. The result is lower input overhead without losing the ability to reconstruct the original data faithfully.

Practical implication: use TOON for structured, repeating records that agents consume repeatedly, and keep JSON for irregular or deeply nested payloads.

How token savings emerge from context shape, not just data size

The article’s deeper point is that token cost depends on how much structure an agent must read, not only on how many facts the data contains. Repetition in JSON is cheap for humans but expensive for models because each field label and punctuation mark adds context load. In tabular issue output, the same semantic content can be represented with less structural noise, which improves efficiency for LLM input. This is why a uniform issues list is a strong fit, while a highly nested configuration blob may not benefit in the same way.

Practical implication: profile the shape of the payload before standardising on a compact format, rather than assuming every JSON output should be converted.

Why lossless output matters for security and workflow automation

A compact format only becomes operationally useful if it remains lossless and machine-verifiable. TOON matters here because it is not a flattened summary, but a structured representation that can be round-tripped back into the original data model. That distinction is important in security workflows, where issue metadata, remediation status, and dependency findings must stay intact for automation, auditability, and downstream triage. In other words, the value is not compression alone, but compression without governance loss.

Practical implication: prefer compact encodings only when you can preserve fidelity, validation, and downstream parsing across the workflow.

NHI Mgmt Group analysis

Token efficiency is becoming part of AI governance. When agents consume tool output at scale, the format of that output affects operating cost, latency, and how much context is available for the next task. That makes token management a programme issue, not just a developer convenience, because format choices influence how reliable and economical AI-assisted workflows become.

Structured output design now sits alongside access design. Security teams already care about what data a tool can reach, but AI workflows also require attention to how that data is packaged. If the same issue list can be delivered in a lossless compact form, the control question shifts from

formatting something down

to

governing the data shape that agents are allowed to ingest. Practitioners should treat output schema as part of the control plane.

What this signals

Token optimisation will increasingly show up in AI operating reviews because context costs are now part of the unit economics of engineering. Teams that standardise compact, lossless outputs for repetitive records will usually see lower inference overhead and better workflow predictability, especially where agents are polling issue trackers or security tooling.

Context-shaping discipline: the emerging control question is not only what an agent may access, but how efficiently that access is encoded. Practitioners should review tool contracts, output schemas, and validation paths together so that format choice does not become an unmanaged cost or reliability risk.

Where AI workflows touch security data, the broader lesson is that control design extends beyond permissions into payload design. That aligns with the growing need to govern AI consumption patterns, not just authorisation boundaries.

For practitioners

• Standardise compact output for uniform machine-readable records Use TOON or a similar compact encoding for issue lists, dependency findings, and other repetitive records that AI agents consume frequently. Keep JSON for nested or irregular payloads where compression could obscure structure or complicate parsing.
• Measure token savings on real payloads before changing defaults Run representative Sonar outputs through a token-savings workflow and compare results on the data your agents actually use. Base the decision on measured savings, not assumptions about format size alone.
• Treat output schema as part of AI workflow governance Document which tools may emit compact formats, which consumers can parse them, and how validation will be handled before data reaches an LLM context window. That keeps optimisation aligned with auditability and reduces accidental breakage in downstream automation.
• Pair compact output with cleaner source code and tighter context Use compact tool output alongside context-augmentation and code-quality controls so agents ingest less noise end to end. That creates a layered efficiency gain instead of a one-off format tweak.

Key takeaways

• TOON reduces the structural overhead of repetitive machine-readable data, which makes it a practical fit for issue lists and similar AI inputs.
• The real saving comes from context shape as much as data volume, so teams should measure token cost on their own payloads before changing defaults.
• For AI-enabled engineering workflows, output schema is now part of governance because it affects cost, fidelity, and auditability at the same time.

Key terms

• Token-Oriented Object Notation: A compact, lossless way to represent JSON data for large language models. It keeps the underlying data model intact but reduces repeated structural markup, which can lower token consumption when the data is highly uniform and table-like.
• Context Augmentation: A pattern for injecting only the most relevant information into an AI agent’s working context before it acts. In security workflows, it is used to reduce noise, constrain tool use, and make the agent’s next step more efficient and more predictable.
• Machine-Readable Output Schema: The defined structure used when a tool returns data for another system to consume. For AI workflows, schema choice affects parsing, validation, token cost, and auditability, so it should be treated as part of governance rather than a formatting detail.

What's in the full article

Sonar's full article covers the implementation detail this post intentionally leaves at the analytical level:

• Measured TOON versus JSON token counts on representative Sonar issue payloads, including the exact workflow used to reproduce the comparison
• Step-by-step CLI examples for converting `sonar list issues` output into TOON for agent consumption
• Guidance on when TOON is the better fit than JSON for different data shapes and consumer types
• Sonar-specific context around Context Augmentation and cleaner code as complementary token-saving levers

👉 Sonar's full post covers the measured savings, CLI examples, and when TOON is the better fit than JSON

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and agentic AI identity for practitioners building controlled machine workflows. It is suited to security and identity teams that need a common governance baseline for AI-enabled operations.