Token Guardian MCP
Token Guardian MCP
Token Guardian は、Claude Code と Codex のトークン無駄遣いを、どちらのクライアントも賢くすることなく見つけるためのローカル専用の MCP サーバーです。
次の 2 つの役割を担います。
どのエージェント、モデル、セッションが最も多くのトークンを処理しているかを報告します。
特定のタスクに対して、最も安全で安価なモデルと努力レベルを推奨します。
また、MCP がどこにも登録される前に、プロンプトファーストのルーティングをテストするためのドライランの route-task コマンドも含まれています。
厳格な安全境界
Token Guardian は、モデル設定、努力レベル、コンテキスト制限、コンパクション、MCP 登録、または実行中のセッションを変更できません。モデル認証情報を持たず、有料の API 呼び出しも行いません。
使用状況ツールは、ccusage を --offline および --no-cost で呼び出します。Codex のタイトルは sqlite3 -readonly を通して読み取られるオプションのメタデータです。すべての MCP ツールは、読み取り専用、非破壊的、冪等、かつ閉じた世界であるとマークされています。
Related MCP server: token-pilot
ツール
token_guardian_usage_snapshot
1 日から 30 日分のローカル使用状況を読み取り、以下を返します。
エージェントおよびモデル別の合計
キャッシュ読み取り、出力、およびフロンティアモデルのシェア
最大のセッション
重複する Codex 作業タイトル
証拠に基づくクイックウィン
処理されたトークンはワークロード診断です。特にキャッシュされた入力が支配的な場合、これらはサブスクリプションメーターと同じではありません。
token_guardian_recommend_route
クライアント、タスク、リスク、および現在のコンテキストサイズを受け入れます。モデル、努力レベル、理由、およびオプションのフロンティアバリデータを返します。
ポリシーはフェイルクローズされます。セキュリティ、アーキテクチャ、本番環境、破壊的、高リスク、重大、またはあいまいな作業はフロンティアモデルに残ります。安価なモデルは、境界のある機械的な作業を処理します。バランスの取れたモデルは、通常のコーディングとデバッグを処理し、必要に応じてフロンティアレビューを行います。
プロンプトファーストのルーティングをテストする
プロジェクトをビルドし、任意のフォルダからルーターを実行します。
node ./dist/route-cli.js --client codex --prompt "Implement a bounded TypeScript parser with tests." --cwd .作業フォルダはリポジトリである必要はありません。ルーターは主にプロンプトを使用します。現在のフォルダ内の最大 256 個の名前をチェックして、オプションのプロジェクトマーカーを探しますが、ファイルの内容を開いたり、サブフォルダをスキャンしたりしません。
このコマンドは、推奨事項とセッションスコープの起動コマンドのみを出力します。そのコマンドを実行したり、設定を変更したり、MCP を登録したり、アクティブなセッションに触れたりすることはありません。yeah, test that のようなあいまいな継続プロンプトは、実際のコンテキストが欠落しているため、フロンティアルートに残ります。
ローカル要件
Node.js 24 以降
PATH 上の
ccusageオプションの Codex スレッドタイトル用の PATH 上の
sqlite3
ビルドとテスト
npm install
npm test
npm run typecheck
npm run buildビルドされた stdio サーバーを実行します。
node dist/index.jsライブクライアントに登録せずに検査します。
npx @modelcontextprotocol/inspector node dist/index.js登録ステータス
この最初のビルドは、意図的に Claude、Codex、または共有の Kitsune ゲートウェイに登録されていません。登録とクライアントの再起動は、分離されたサーバーが承認された後、別の変更として行われます。
ライセンス
MIT。 LICENSE を参照してください。
Available Tools
2 toolstoken_guardian_recommend_routeRecommend Model RouteARead-onlyIdempotent
Recommend a conservative Claude, Codex, or local model and effort for one task. Returns advice only and never switches the active client.
| Name | Required | Description | Default |
|---|---|---|---|
| risk | No | normal | |
| client | Yes | Client that will perform the task. | |
| task_kind | No | Explicit task class. Omit only when genuinely unknown. | |
| task_summary | Yes | Short description of the actual work. | |
| current_model | No | ||
| context_tokens | No | ||
| current_effort | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| tier | Yes | |
| model | Yes | |
| client | Yes | |
| effort | Yes | |
| actions | Yes | |
| reasons | Yes | |
| validator | No | |
| confidence | Yes | |
| advisoryOnly | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context: 'Returns advice only and never switches the active client', confirming the tool's side-effect-free nature. No contradiction with annotations. The description could mention error handling or latency but is sufficient given the strong annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the key action, and contains no filler. Every word adds value: 'conservative' qualifies the recommendation, 'one task' sets scope, and 'never switches' clarifies behavior. Ideal conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, output schema exists, good annotations), the description covers the core workflow but leaves out context like the meaning of 'conservative', 'effort', or how the recommendation relates to the input parameters. The output schema might fill gaps, but the description could be more helpful for understanding the tool's role in a multi-step workflow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 43% (3 of 7 parameters have descriptions). The description adds no parameter-specific information; it only states the overall purpose. Parameters like 'risk', 'current_effort', and 'context_tokens' remain undocumented, and the description does not compensate for the low coverage. The agent must rely on the incomplete schema, which is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'recommend', the resource ('model and effort'), and the scope ('for one task'). It also distinguishes from the sibling tool 'token_guardian_usage_snapshot' by emphasizing that it returns advice only and does not change state, making the purpose specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus the sibling 'token_guardian_usage_snapshot'. It states that it returns advice only, implying safe usage, but does not mention when to choose recommendations over usage snapshots or any prerequisites or exclusions. This leaves the agent without clear direction on invocation context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token_guardian_usage_snapshotToken Usage SnapshotARead-onlyIdempotent
Read local Claude Code and Codex usage, identify large contexts and expensive routing, and return evidence-backed quick wins. Never changes settings or sessions.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | ||
| agent | No | all | |
| top_sessions | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| caveat | Yes | |
| totals | Yes | |
| window | Yes | |
| byAgent | Yes | |
| byModel | Yes | |
| metrics | Yes | |
| quickWins | Yes | |
| topSessions | Yes | |
| duplicateCodexWork | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint as safe. The description reinforces this by stating 'Never changes settings or sessions.' It adds value by describing what the tool does with the data (identify, return quick wins), which goes beyond the annotations' safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences that pack in the tool's purpose, outcomes, and safety guarantee. Every word serves a purpose with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a read-only snapshot tool with an output schema and sensible defaults, but it fails to mention the tunable parameters (days, agent, top_sessions) that control the snapshot scope. The sibling tool is not contrasted, leaving the agent to infer the relationship.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it does not mention the three parameters (days, agent, top_sessions) or their roles. The parameter names are somewhat self-explanatory, but the description adds no additional meaning beyond the schema's type and default constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads usage data, identifies large contexts and expensive routing, and returns quick wins. It uses a specific verb ('Read') and resource ('local Claude Code and Codex usage'), and distinguishes from the sibling tool 'token_guardian_recommend_route' by focusing on analysis rather than recommendations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states it never changes settings or sessions, implying it is safe for inspection. It contrasts with the sibling by focusing on analysis and quick wins, but does not provide explicit 'when to use vs when not to use' guidance. The context is clear enough for an agent to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.1.0- First observed
token_guardian_recommend_route - First observed
token_guardian_usage_snapshot
TDQS
Scored across 2 tools
Each tool serves a distinct, non-overlapping purpose: one provides a usage snapshot with improvement suggestions, the other recommends a routing choice for a task. There is no ambiguity between them.
Both tool names follow a consistent 'token_guardian_<verb>_<noun>' pattern using snake_case, with descriptive verbs ('usage_snapshot', 'recommend_route') that clearly indicate their function.
With only 2 tools, the server feels minimal for a domain that might benefit from additional diagnostics (e.g., cost breakdown, model listing) or configuration advice. The count is on the low end of acceptable for a focused utility.
The server explicitly avoids any action tools, being read-only. It covers snapshot analysis and routing recommendations but lacks tools for detailed queries (e.g., by time period, by model) or applying any changes, leaving notable gaps for hands-on usage optimization.
Maintenance
Related MCP Connectors
LLM cost optimization gateway, repo token-waste auditor & model arbitrage MCP server.
LLM cost optimization gateway, repo token-waste auditor & model arbitrage MCP server.
Hosted MCP server for LLM cost estimation, model comparison, and budget-aware routing.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Related MCP Servers
- AlicenseAqualityCmaintenanceAn MCP server that helps AI agents reduce token usage by compressing, summarizing, and managing conversation/context data more efficiently.11MIT
- AlicenseAqualityAmaintenanceMCP server that reduces token consumption in AI coding assistants by up to 90% via structural reads, PreToolUse hooks, and tp-\* subagents.25162 npm5MIT
- AlicenseNot gradedqualityDmaintenanceMCP server that analyzes AI agent session logs to find token waste and optimization opportunities.8 npmMIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that reduces token usage by lazily loading skills and tools only when needed, and routing repetitive subtasks to ML backends instead of the LLM.Apache 2.0