ondraulehla/mcpcost

Is that MCP server alive, and what does it cost your context window?
Live board: mcpcost.ulehla.dev
mcpcost probes every remote server in the official MCP registry and records, for each one:
whether it answers initialize and tools/list, and how fast
the protocol version it negotiates
whether it needs auth, which scheme (from WWW-Authenticate), and how a client gets in: OAuth with dynamic client registration, OAuth with a client id from the publisher, or a key, read from the server's public OAuth metadata
whether it asks for payment (HTTP 402)
how many tools it has and how many tokens their definitions cost
## mcpcost: what do your own servers cost?
bash
npx mcpcost # reads Claude Code, Claude Desktop, Cursor, VS Code, Windsurf and Gemini CLI configs
npx mcpcost --config .mcp.json # one file
npx mcpcost --budget 30000 # exit 1 when the total is above the budget, for CI
npx mcpcost --claude # exact counts from the Anthropic counttokens endpoint (free, needs ANTHROPICAPIKEY)
npx mcpcost mcp # the same measurements as an MCP server over stdio, for your agent
It starts every configured server the way your client does, lists the tools and prints the token cost per server and in total. See packages/mcpcost.
### Servers that need auth
A server that answers 401 is reachable but not measured until it gets credentials. Store them once; every later measurement of that URL uses them.
bash
npx mcpcost auth https://mcp.linear.app/mcp # OAuth: register, consent in the browser, store the tokens
npx mcpcost auth https://api.githubcopilot.com/mcp/ --header "Authorization: Bearer ghp…" # an API key instead
npx mcpcost auth --list # what is stored, without the secrets
The OAuth flow follows the MCP authorization spec: discovery, dynamic client registration, PKCE, a callback on 127.0.0.1. The consent screen is the one step that needs a person. After it, the tokens live in ~/.mcpcost/credentials.json (mode 0600, or $MCPCOSTCREDENTIALS), npx mcpcost sends them for that URL, and a refreshed token goes back to the file.
The board does the same: npm run credentials:push copies the file into the D1 table credentials; the daily run reads it before the probe, writes the refreshed tokens back after it, and marks the server "measured with credentials". A refresh token that a service revokes or lets expire needs the consent step again.
Without credentials, the board still shows a tool set for many gated servers: tool definitions do not depend on the token, so when the publisher's repository holds a package on npm or PyPI, probe/derive-packages.ts finds it and the weekly container run measures it with placeholder values. The server page then says "from the publisher's package". probe/derived-aliases.json maps the few servers whose registry entry names no repository.
### In CI, as a GitHub Action
yaml
uses: ondraulehla/mcpcost@v1
with:
config: .mcp.json # one or more config files, one per line
budget: 30000 # fail when the tool definitions cost more than this
The job summary gets a table with every server, its result and its cost, plus the most expensive tools. A pull request that adds a 40 000-token server fails the check. Set claude: true and put ANTHROPICAPIKEY in env for exact counts from the free counttokens endpoint; the default is the o200kbase estimate. Outputs: tokens, servers, over-budget.