diff --git a/plugins/config-audit/scanners/token-hotspots-cli.mjs b/plugins/config-audit/scanners/token-hotspots-cli.mjs
new file mode 100755
index 0000000..4b75106
--- /dev/null
+++ b/plugins/config-audit/scanners/token-hotspots-cli.mjs
@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+
+/**
+ * token-hotspots CLI — emit ranked token hotspots and Opus 4.7 pattern findings
+ * for a target repo path.
+ *
+ * Usage:
+ *   node token-hotspots-cli.mjs [path] [--json] [--output-file <path>] [--global]
+ *
+ * Exit codes: 0=ok, 3=unrecoverable error.
+ * Zero external dependencies.
+ */
+
+import { resolve } from 'node:path';
+import { writeFile, stat } from 'node:fs/promises';
+import { discoverConfigFiles } from './lib/file-discovery.mjs';
+import { resetCounter } from './lib/output.mjs';
+import { scan } from './token-hotspots.mjs';
+
+async function main() {
+  const args = process.argv.slice(2);
+  let targetPath = '.';
+  let outputFile = null;
+  let jsonMode = false;
+  let includeGlobal = false;
+
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--json') jsonMode = true;
+    else if (args[i] === '--global') includeGlobal = true;
+    else if (args[i] === '--output-file' && args[i + 1]) outputFile = args[++i];
+    else if (!args[i].startsWith('-')) targetPath = args[i];
+  }
+
+  const absPath = resolve(targetPath);
+  try {
+    const s = await stat(absPath);
+    if (!s.isDirectory()) {
+      process.stderr.write(`Error: ${absPath} is not a directory\n`);
+      process.exit(3);
+    }
+  } catch {
+    process.stderr.write(`Error: path does not exist: ${absPath}\n`);
+    process.exit(3);
+  }
+
+  resetCounter();
+  const discovery = await discoverConfigFiles(absPath, { includeGlobal });
+  const result = await scan(absPath, discovery);
+
+  const payload = {
+    scanner: result.scanner,
+    status: result.status,
+    files_scanned: result.files_scanned,
+    duration_ms: result.duration_ms,
+    total_estimated_tokens: result.total_estimated_tokens,
+    hotspots: result.hotspots,
+    findings: result.findings,
+    counts: result.counts,
+  };
+
+  const json = JSON.stringify(payload, null, 2);
+
+  if (outputFile) {
+    await writeFile(outputFile, json, 'utf-8');
+  }
+
+  if (jsonMode || !outputFile) {
+    process.stdout.write(json + '\n');
+  }
+}
+
+const isDirectRun = process.argv[1] && resolve(process.argv[1]) === resolve(new URL(import.meta.url).pathname);
+if (isDirectRun) {
+  main().catch(err => {
+    process.stderr.write(`Fatal: ${err.message}\n`);
+    process.exit(3);
+  });
+}
diff --git a/plugins/config-audit/tests/scanners/token-hotspots-cli.test.mjs b/plugins/config-audit/tests/scanners/token-hotspots-cli.test.mjs
new file mode 100644
index 0000000..ef97a94
--- /dev/null
+++ b/plugins/config-audit/tests/scanners/token-hotspots-cli.test.mjs
@@ -0,0 +1,66 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readFile, unlink } from 'node:fs/promises';
+
+const exec = promisify(execFile);
+const __dirname = fileURLToPath(new URL('.', import.meta.url));
+const REPO = resolve(__dirname, '../..');
+const CLI = resolve(REPO, 'scanners/token-hotspots-cli.mjs');
+const ORCH = resolve(REPO, 'scanners/scan-orchestrator.mjs');
+const FIXTURE = resolve(REPO, 'tests/fixtures/marketplace-large');
+
+describe('token-hotspots-cli', () => {
+  it('returns valid JSON with hotspots.length >= 3', async () => {
+    const { stdout } = await exec('node', [CLI, FIXTURE, '--json'], {
+      timeout: 30000,
+      cwd: REPO,
+    });
+    const json = JSON.parse(stdout);
+    assert.equal(json.scanner, 'TOK');
+    assert.ok(Array.isArray(json.hotspots), 'hotspots must be an array');
+    assert.ok(json.hotspots.length >= 3, `expected ≥3 hotspots, got ${json.hotspots.length}`);
+    assert.equal(typeof json.total_estimated_tokens, 'number');
+    assert.ok(json.total_estimated_tokens > 0, 'expected non-zero token estimate');
+  });
+
+  it('writes JSON to --output-file when provided', async () => {
+    const out = `/tmp/tok-cli-${process.pid}-${Date.now()}.json`;
+    try {
+      await exec('node', [CLI, FIXTURE, '--output-file', out], {
+        timeout: 30000,
+        cwd: REPO,
+      });
+      const written = await readFile(out, 'utf-8');
+      const json = JSON.parse(written);
+      assert.equal(json.scanner, 'TOK');
+      assert.ok(json.hotspots.length >= 3);
+    } finally {
+      await unlink(out).catch(() => {});
+    }
+  });
+});
+
+describe('scan-orchestrator integration — TOK hotspots survive envelope', () => {
+  it('envelope.scanners contains TOK with hotspots field', async () => {
+    const out = `/tmp/tok-orch-${process.pid}-${Date.now()}.json`;
+    try {
+      await exec('node', [ORCH, FIXTURE, '--output-file', out], {
+        timeout: 60000,
+        cwd: REPO,
+      });
+      const written = await readFile(out, 'utf-8');
+      const envelope = JSON.parse(written);
+      const tok = envelope.scanners.find(s => s.scanner === 'TOK');
+      assert.ok(tok, 'expected TOK scanner result in envelope.scanners');
+      assert.ok(Array.isArray(tok.hotspots), 'TOK result must carry hotspots through the envelope');
+      assert.ok(tok.hotspots.length > 0, 'expected hotspots to survive into final envelope');
+      assert.equal(typeof tok.total_estimated_tokens, 'number');
+    } finally {
+      await unlink(out).catch(() => {});
+    }
+  });
+});