Token Guardian MCP
Token Guardian MCP
Token Guardian 是一个本地只读 MCP 服务器,用于发现 Claude Code 和 Codex 的 token 浪费,而不会降低任一客户端的智能水平。
它执行两项任务:
报告哪些代理、模型和会话处理的 token 最多。
针对特定任务推荐最便宜的安全模型和努力级别。
它还包含一个用于测试提示优先路由的 route-task 命令(干运行模式),在 MCP 注册到任何地方之前即可使用。
严格安全边界
Token Guardian 无法更改模型设置、努力级别、上下文限制、压缩、MCP 注册或正在运行的会话。它没有模型凭据,也不进行付费 API 调用。
usage 工具使用 --offline 和 --no-cost 参数调用 ccusage。Codex 标题是通过 sqlite3 -readonly 读取的可选元数据。每个 MCP 工具都被标记为只读、非破坏性、幂等且封闭世界。
Related MCP server: token-pilot
工具
token_guardian_usage_snapshot
读取一到三十天的本地使用情况,并返回:
按代理和模型统计的总量
缓存读取、输出和前沿模型占比
最大的会话
完全重复的 Codex 工作标题
有证据支持的快速改进点
处理的 token 是工作负载诊断指标。它们不等同于订阅计量,尤其是在缓存输入占主导地位时。
token_guardian_recommend_route
接受客户端、任务、风险和当前上下文大小。它返回模型、努力级别、原因以及可选的前沿验证器。
该策略在失败时采取保守措施。安全、架构、生产、破坏性、高风险、关键或模糊的工作仍由前沿模型处理。廉价模型处理有边界的机械性工作。平衡模型处理常规编码和调试,必要时进行前沿审查。
测试提示优先路由
构建项目,然后从任意文件夹运行路由器:
node ./dist/route-cli.js --client codex --prompt "Implement a bounded TypeScript parser with tests." --cwd .工作文件夹不必是仓库。路由器主要使用提示。它会检查当前文件夹中最多 256 个名称以获取可选的项目标记,但不会打开文件内容或扫描子文件夹。
该命令仅打印推荐和会话范围的启动命令。它不会运行该命令、更改配置、注册 MCP 或触及活动会话。诸如 yeah, test that 之类的模糊延续提示会保留在前沿路由上,因为它们的真实上下文缺失。
本地要求
Node.js 24 或更新版本
ccusage在 PATH 中sqlite3在 PATH 中(用于可选的 Codex 线程标题)
构建和测试
npm install
npm test
npm run typecheck
npm run build运行构建好的 stdio 服务器:
node dist/index.js在不注册到活动客户端的情况下检查它:
npx @modelcontextprotocol/inspector node dist/index.js注册状态
此首次构建特意未注册到 Claude、Codex 或共享的 Kitsune 网关。注册以及任何客户端重启是在独立服务器被接受后的单独更改。
许可证
MIT。参见 LICENSE。
Available Tools
2 toolstoken_guardian_recommend_routeRecommend Model RouteARead-onlyIdempotent
Recommend a conservative Claude, Codex, or local model and effort for one task. Returns advice only and never switches the active client.
| Name | Required | Description | Default |
|---|---|---|---|
| risk | No | normal | |
| client | Yes | Client that will perform the task. | |
| task_kind | No | Explicit task class. Omit only when genuinely unknown. | |
| task_summary | Yes | Short description of the actual work. | |
| current_model | No | ||
| context_tokens | No | ||
| current_effort | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| tier | Yes | |
| model | Yes | |
| client | Yes | |
| effort | Yes | |
| actions | Yes | |
| reasons | Yes | |
| validator | No | |
| confidence | Yes | |
| advisoryOnly | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context: 'Returns advice only and never switches the active client', confirming the tool's side-effect-free nature. No contradiction with annotations. The description could mention error handling or latency but is sufficient given the strong annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the key action, and contains no filler. Every word adds value: 'conservative' qualifies the recommendation, 'one task' sets scope, and 'never switches' clarifies behavior. Ideal conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, output schema exists, good annotations), the description covers the core workflow but leaves out context like the meaning of 'conservative', 'effort', or how the recommendation relates to the input parameters. The output schema might fill gaps, but the description could be more helpful for understanding the tool's role in a multi-step workflow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 43% (3 of 7 parameters have descriptions). The description adds no parameter-specific information; it only states the overall purpose. Parameters like 'risk', 'current_effort', and 'context_tokens' remain undocumented, and the description does not compensate for the low coverage. The agent must rely on the incomplete schema, which is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'recommend', the resource ('model and effort'), and the scope ('for one task'). It also distinguishes from the sibling tool 'token_guardian_usage_snapshot' by emphasizing that it returns advice only and does not change state, making the purpose specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus the sibling 'token_guardian_usage_snapshot'. It states that it returns advice only, implying safe usage, but does not mention when to choose recommendations over usage snapshots or any prerequisites or exclusions. This leaves the agent without clear direction on invocation context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token_guardian_usage_snapshotToken Usage SnapshotARead-onlyIdempotent
Read local Claude Code and Codex usage, identify large contexts and expensive routing, and return evidence-backed quick wins. Never changes settings or sessions.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | ||
| agent | No | all | |
| top_sessions | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| caveat | Yes | |
| totals | Yes | |
| window | Yes | |
| byAgent | Yes | |
| byModel | Yes | |
| metrics | Yes | |
| quickWins | Yes | |
| topSessions | Yes | |
| duplicateCodexWork | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint as safe. The description reinforces this by stating 'Never changes settings or sessions.' It adds value by describing what the tool does with the data (identify, return quick wins), which goes beyond the annotations' safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences that pack in the tool's purpose, outcomes, and safety guarantee. Every word serves a purpose with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a read-only snapshot tool with an output schema and sensible defaults, but it fails to mention the tunable parameters (days, agent, top_sessions) that control the snapshot scope. The sibling tool is not contrasted, leaving the agent to infer the relationship.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it does not mention the three parameters (days, agent, top_sessions) or their roles. The parameter names are somewhat self-explanatory, but the description adds no additional meaning beyond the schema's type and default constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads usage data, identifies large contexts and expensive routing, and returns quick wins. It uses a specific verb ('Read') and resource ('local Claude Code and Codex usage'), and distinguishes from the sibling tool 'token_guardian_recommend_route' by focusing on analysis rather than recommendations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states it never changes settings or sessions, implying it is safe for inspection. It contrasts with the sibling by focusing on analysis and quick wins, but does not provide explicit 'when to use vs when not to use' guidance. The context is clear enough for an agent to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.1.0- First observed
token_guardian_recommend_route - First observed
token_guardian_usage_snapshot
TDQS
Scored across 2 tools
Each tool serves a distinct, non-overlapping purpose: one provides a usage snapshot with improvement suggestions, the other recommends a routing choice for a task. There is no ambiguity between them.
Both tool names follow a consistent 'token_guardian_<verb>_<noun>' pattern using snake_case, with descriptive verbs ('usage_snapshot', 'recommend_route') that clearly indicate their function.
With only 2 tools, the server feels minimal for a domain that might benefit from additional diagnostics (e.g., cost breakdown, model listing) or configuration advice. The count is on the low end of acceptable for a focused utility.
The server explicitly avoids any action tools, being read-only. It covers snapshot analysis and routing recommendations but lacks tools for detailed queries (e.g., by time period, by model) or applying any changes, leaving notable gaps for hands-on usage optimization.
Related MCP Connectors
LLM cost optimization gateway, repo token-waste auditor & model arbitrage MCP server.
Hosted MCP server for LLM cost estimation, model comparison, and budget-aware routing.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Veqen brings together work and coding agent costs per person and team, product inference costs per customer, agent spending, protection incidents, invoice checks, chargeback and the month-end close. Ask your assistant to investigate recorded spending, compare model prices, review provider keys and incidents, record bills and credits, or manage budgets, alerts, teams and spending policies. Your account role and plan govern access. Provider-key shut-off and agent-card controls require the appropriate role and provider permissions. Destructive actions require confirmation, and organizations can require a second person to approve a shut-off. SDK budget blocking is not a guaranteed spending cap. Work and coding agents are free for up to 3 people; product inference is free up to $1,000 in monthly AI spend. Connect your Veqen account for private organization data. The separate public model-price server needs no account. Estimates remain separate from provider invoices. Setup and permissions: https://veqen-app.com/docs/mcp
Related MCP Servers
- AlicenseAqualityCmaintenanceAn MCP server that helps AI agents reduce token usage by compressing, summarizing, and managing conversation/context data more efficiently.11MIT
- AlicenseAqualityAmaintenanceMCP server that reduces token consumption in AI coding assistants by up to 90% via structural reads, PreToolUse hooks, and tp-\* subagents.25217 npm5MIT
- AlicenseNot gradedqualityDmaintenanceMCP server that analyzes AI agent session logs to find token waste and optimization opportunities.22 npmMIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that reduces token usage by lazily loading skills and tools only when needed, and routing repetitive subtasks to ML backends instead of the LLM.Apache 2.0