Token Guardian MCP
Token Guardian MCP
Token Guardian은 Claude Code와 Codex가 토큰을 낭비하는 현상을 찾아내는 로컬 읽기 전용 MCP 서버로, 두 클라이언트의 성능을 저하시키지 않습니다.
두 가지 작업을 수행합니다:
어떤 에이전트, 모델, 세션이 가장 많은 토큰을 처리하고 있는지 보고합니다.
특정 작업에 대해 가장 저렴하면서도 안전한 모델과 노력 수준을 추천합니다.
또한 MCP가 등록되기 전에 프롬프트 우선 라우팅을 테스트하기 위한 건식 실행 route-task 명령어도 포함되어 있습니다.
엄격한 안전 경계
Token Guardian은 모델 설정, 노력 수준, 컨텍스트 제한, 압축, MCP 등록 또는 실행 중인 세션을 변경할 수 없습니다. 모델 자격 증명이 없으며 유료 API 호출을 하지 않습니다.
사용량 도구는 --offline 및 --no-cost 플래그와 함께 ccusage를 호출합니다. Codex 제목은 sqlite3 -readonly를 통해 읽는 선택적 메타데이터입니다. 모든 MCP 도구는 읽기 전용, 비파괴적, 멱등적, 폐쇄 세계로 표시되어 있습니다.
Related MCP server: token-pilot
도구
token_guardian_usage_snapshot
1일에서 30일 간의 로컬 사용량을 읽고 다음을 반환합니다:
에이전트 및 모델별 합계
캐시 읽기, 출력, 프론티어 모델 점유율
가장 큰 세션
정확히 중복된 Codex 작업 제목
증거 기반의 빠른 개선점
처리된 토큰은 워크로드 진단 지표입니다. 특히 캐시된 입력이 지배적인 경우 구독 측정기와 동일하지 않습니다.
token_guardian_recommend_route
클라이언트, 작업, 위험도 및 현재 컨텍스트 크기를 입력받습니다. 모델, 노력 수준, 이유 및 선택적 프론티어 검증기를 반환합니다.
정책은 안전 쪽으로 실패합니다. 보안, 아키텍처, 프로덕션, 파괴적, 고위험, 중요 또는 모호한 작업은 프론티어 모델에 남습니다. 저렴한 모델은 제한된 기계적 작업을 처리합니다. 균형 잡힌 모델은 필요 시 프론티어 검토와 함께 일반 코딩 및 디버깅을 처리합니다.
프롬프트 우선 라우팅 테스트
프로젝트를 빌드한 다음 모든 폴더에서 라우터를 실행하세요:
node ./dist/route-cli.js --client codex --prompt "Implement a bounded TypeScript parser with tests." --cwd .작업 폴더는 저장소일 필요가 없습니다. 라우터는 주로 프롬프트를 사용합니다. 현재 폴더에서 최대 256개의 이름을 확인하여 선택적 프로젝트 표시자를 찾지만, 파일 내용을 열거나 하위 폴더를 스캔하지는 않습니다.
이 명령어는 추천 사항과 세션 범위의 실행 명령어만 출력합니다. 해당 명령어를 실행하거나, 구성을 변경하거나, MCP를 등록하거나, 활성 세션을 건드리지 않습니다. yeah, test that와 같은 모호한 연속 프롬프트는 실제 컨텍스트가 누락되었기 때문에 프론티어 경로에 남습니다.
로컬 요구 사항
Node.js 24 이상
PATH에
ccusage선택적 Codex 스레드 제목을 위한 PATH의
sqlite3
빌드 및 테스트
npm install
npm test
npm run typecheck
npm run build빌드된 stdio 서버를 실행하세요:
node dist/index.js라이브 클라이언트에 등록하지 않고 검사하세요:
npx @modelcontextprotocol/inspector node dist/index.js등록 상태
이 첫 번째 빌드는 의도적으로 Claude, Codex 또는 공유 Kitsune 게이트웨이에 등록되지 않았습니다. 등록 및 모든 클라이언트 재시작은 격리된 서버가 승인된 후 별도의 변경 사항입니다.
라이선스
MIT. LICENSE 파일을 참조하세요.
Available Tools
2 toolstoken_guardian_recommend_routeRecommend Model RouteARead-onlyIdempotent
Recommend a conservative Claude, Codex, or local model and effort for one task. Returns advice only and never switches the active client.
| Name | Required | Description | Default |
|---|---|---|---|
| risk | No | normal | |
| client | Yes | Client that will perform the task. | |
| task_kind | No | Explicit task class. Omit only when genuinely unknown. | |
| task_summary | Yes | Short description of the actual work. | |
| current_model | No | ||
| context_tokens | No | ||
| current_effort | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| tier | Yes | |
| model | Yes | |
| client | Yes | |
| effort | Yes | |
| actions | Yes | |
| reasons | Yes | |
| validator | No | |
| confidence | Yes | |
| advisoryOnly | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context: 'Returns advice only and never switches the active client', confirming the tool's side-effect-free nature. No contradiction with annotations. The description could mention error handling or latency but is sufficient given the strong annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the key action, and contains no filler. Every word adds value: 'conservative' qualifies the recommendation, 'one task' sets scope, and 'never switches' clarifies behavior. Ideal conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, output schema exists, good annotations), the description covers the core workflow but leaves out context like the meaning of 'conservative', 'effort', or how the recommendation relates to the input parameters. The output schema might fill gaps, but the description could be more helpful for understanding the tool's role in a multi-step workflow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 43% (3 of 7 parameters have descriptions). The description adds no parameter-specific information; it only states the overall purpose. Parameters like 'risk', 'current_effort', and 'context_tokens' remain undocumented, and the description does not compensate for the low coverage. The agent must rely on the incomplete schema, which is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'recommend', the resource ('model and effort'), and the scope ('for one task'). It also distinguishes from the sibling tool 'token_guardian_usage_snapshot' by emphasizing that it returns advice only and does not change state, making the purpose specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus the sibling 'token_guardian_usage_snapshot'. It states that it returns advice only, implying safe usage, but does not mention when to choose recommendations over usage snapshots or any prerequisites or exclusions. This leaves the agent without clear direction on invocation context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token_guardian_usage_snapshotToken Usage SnapshotARead-onlyIdempotent
Read local Claude Code and Codex usage, identify large contexts and expensive routing, and return evidence-backed quick wins. Never changes settings or sessions.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | ||
| agent | No | all | |
| top_sessions | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| caveat | Yes | |
| totals | Yes | |
| window | Yes | |
| byAgent | Yes | |
| byModel | Yes | |
| metrics | Yes | |
| quickWins | Yes | |
| topSessions | Yes | |
| duplicateCodexWork | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint as safe. The description reinforces this by stating 'Never changes settings or sessions.' It adds value by describing what the tool does with the data (identify, return quick wins), which goes beyond the annotations' safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences that pack in the tool's purpose, outcomes, and safety guarantee. Every word serves a purpose with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a read-only snapshot tool with an output schema and sensible defaults, but it fails to mention the tunable parameters (days, agent, top_sessions) that control the snapshot scope. The sibling tool is not contrasted, leaving the agent to infer the relationship.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it does not mention the three parameters (days, agent, top_sessions) or their roles. The parameter names are somewhat self-explanatory, but the description adds no additional meaning beyond the schema's type and default constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads usage data, identifies large contexts and expensive routing, and returns quick wins. It uses a specific verb ('Read') and resource ('local Claude Code and Codex usage'), and distinguishes from the sibling tool 'token_guardian_recommend_route' by focusing on analysis rather than recommendations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states it never changes settings or sessions, implying it is safe for inspection. It contrasts with the sibling by focusing on analysis and quick wins, but does not provide explicit 'when to use vs when not to use' guidance. The context is clear enough for an agent to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.1.0- First observed
token_guardian_recommend_route - First observed
token_guardian_usage_snapshot
TDQS
Scored across 2 tools
Each tool serves a distinct, non-overlapping purpose: one provides a usage snapshot with improvement suggestions, the other recommends a routing choice for a task. There is no ambiguity between them.
Both tool names follow a consistent 'token_guardian_<verb>_<noun>' pattern using snake_case, with descriptive verbs ('usage_snapshot', 'recommend_route') that clearly indicate their function.
With only 2 tools, the server feels minimal for a domain that might benefit from additional diagnostics (e.g., cost breakdown, model listing) or configuration advice. The count is on the low end of acceptable for a focused utility.
The server explicitly avoids any action tools, being read-only. It covers snapshot analysis and routing recommendations but lacks tools for detailed queries (e.g., by time period, by model) or applying any changes, leaving notable gaps for hands-on usage optimization.
Maintenance
Related MCP Connectors
LLM cost optimization gateway, repo token-waste auditor & model arbitrage MCP server.
LLM cost optimization gateway, repo token-waste auditor & model arbitrage MCP server.
Hosted MCP server for LLM cost estimation, model comparison, and budget-aware routing.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Related MCP Servers
- AlicenseAqualityCmaintenanceAn MCP server that helps AI agents reduce token usage by compressing, summarizing, and managing conversation/context data more efficiently.11MIT
- AlicenseAqualityAmaintenanceMCP server that reduces token consumption in AI coding assistants by up to 90% via structural reads, PreToolUse hooks, and tp-\* subagents.25162 npm5MIT
- AlicenseNot gradedqualityDmaintenanceMCP server that analyzes AI agent session logs to find token waste and optimization opportunities.8 npmMIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that reduces token usage by lazily loading skills and tools only when needed, and routing repetitive subtasks to ML backends instead of the LLM.Apache 2.0