将 AI 代理在使用 MCP 工具时消耗的 Token 削减高达 98%——且不丢失任何内容。
服务器 | 工具数 | 压缩前 | 压缩后 | 缩减比例 |
filesystem (Anthropic) | 14 | 1,892 tok | 236 tok | −88% |
sequential-thinking | 1 | 926 tok | 20 tok | −98% |
Google Calendar | 5 | 5,010 tok | 660 tok | −87% |
Enterprise (Cal + Gmail + Drive) | 12 | 8,649 tok | 882 tok | −90% |
sample_app.js (JavaScript) | — | 799 tok | 284 tok | −64.5% |
sample_app.ts (TypeScript) | — | 378 tok | 266 tok | −29.6% |
ast_extractor.py (Python) | — | 3,633 tok | 890 tok | −75.5% |
发送更少的 Token = 更低的 API 费用、更快的响应。而且没有任何损失。每次检查都确认工具在压缩后仍 100% 可用。
您可以自行复现这些数字——每个输入都是仓库中的静态测试用例，Token 使用 tiktoken cl100k_base 计数：
python benchmarks/run_benchmark.py # the table above
python benchmarks/run_benchmark.py --json # machine-readable
python benchmarks/run_benchmark.py --fixture path/to/your_schemas.jsonRelated MCP server: Bifrost-MCP Gateway
一行命令（macOS / Linux）——安装包并配置 Claude Desktop：
curl -sSL https://raw.githubusercontent.com/LoudiliMed/Refract/main/install-refract.sh | sh从互联网通过管道执行脚本前，建议先快速检查一下：在 GitHub 上查看 install-refract.sh。它从不使用 sudo。
或者直接使用 pip：
pip install refract-mcp可选附加组件：
pip install refract-mcp[semantic] # semantic tool routing with embeddings
pip install refract-mcp[multilang] # JavaScript, TypeScript, JSX, TSX support位于您的代理与任何 MCP 服务器之间。实时压缩工具模式，使您的代理无需在每次请求时加载完整目录。
本地子进程（stdio）：
refract-proxy --target "npx @modelcontextprotocol/server-filesystem /tmp" --verbose远程 HTTP/SSE 服务器：
# --url implies SSE transport (explicit, recommended for remote endpoints)
refract-proxy --url https://my-mcp-server.com/sse
# or with --transport flag (auto-detection can be overridden)
refract-proxy --target https://my-mcp-server.com/sse --transport sse代理参数：
参数 | 默认值 | 描述 |
| 必填 | MCP 目标：stdio 命令、HTTP URL 或 JSON 文件 |
| — | 用于 stdio 命令的 |
| — | 远程 SSE/HTTP 端点——隐含 |
| auto | 强制指定与目标的传输方式： |
| 30 | SSE 目标的连接超时（重试 3 次） |
| stdio | 代理向您的代理提供服务的方式 |
| 8080 |
|
| off | 打印每次请求的 Token 数量 |
| WARNING | DEBUG / INFO / WARNING / ERROR |
将其添加到 Claude Desktop：
{
"mcpServers": {
"my-server-via-refract": {
"command": "/path/to/refract-proxy",
"args": [
"--target",
"npx @modelcontextprotocol/server-filesystem /path/to/folder",
"--verbose"
]
}
}
}对于远程 MCP 服务器（SSE）：
{
"mcpServers": {
"remote-via-refract": {
"command": "/path/to/refract-proxy",
"args": ["--url", "https://my-mcp-server.com/sse"]
}
}
}无需逐个编辑条目（或为每个服务器运行 refract-install），refract-wrap-all 通过一条命令将 claude_desktop_config.json 中所有 stdio 服务器重写为通过 refract-proxy 运行：
# Preview what would change — writes nothing
refract-wrap-all --dry-run
# Wrap every stdio server not already going through refract
refract-wrap-all
# Restore the original commands
refract-wrap-all --unwrap示例：以下条目
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["@modelcontextprotocol/server-filesystem", "/tmp"],
"env": {"MY_VAR": "1"}
}
}
}变为
{
"mcpServers": {
"filesystem": {
"command": "/path/to/refract-proxy",
"args": ["--stdio-cmd", "npx @modelcontextprotocol/server-filesystem /tmp"],
"env": {"MY_VAR": "1"}
}
}
}保证：
每次写入前都会备份配置文件（claude_desktop_config.json.bak，然后是 .bak2、.bak3……——不会覆盖已有备份）。
保留 env、cwd 及其他服务器字段。
已通过 refract-proxy 或 refract-server 运行的服务器会被跳过（already wrapped）。
远程 SSE/HTTP 服务器（url 条目）会被跳过——仅包装 stdio 服务器。
--unwrap 可精确回退：先包装再解包，可恢复所有原始命令、参数和字段。
参数 | 值 | 描述 |
| Streamable HTTP | 当前标准（MCP 规范 2025-03-26）。用于远程 MCP 服务器。 |
| SSE | 旧版传输方式，为兼容性保留。如果服务器不支持 Streamable HTTP，则使用此方式。 |
| stdio 子进程 | 本地命令（当 |
(省略) | 自动检测 | 根据 |
sse 和 http 都需要在 --target 中提供 HTTP(S) URL。
# Connect to a remote MCP server via Streamable HTTP (recommended)
refract-proxy --target "https://my-mcp-server.com/mcp" --transport http
# Connect via SSE (legacy)
refract-proxy --target "https://my-mcp-server.com/sse" --transport sse
# Local subprocess (auto-detected, --transport stdio optional)
refract-proxy --target "npx @modelcontextprotocol/server-filesystem /tmp"将您的代码库暴露为 MCP 服务器。您的代理可以索引仓库、获取压缩后的文件上下文、展开特定函数、分析影响、检测破坏性变更以及映射安全风险。
refract-server --root /path/to/your/repo将其添加到 Claude Desktop：
{
"mcpServers": {
"refract-code": {
"command": "/path/to/refract-server",
"args": ["--root", "/path/to/your/repo"]
}
}
}想象一个拥有 50 本书的图书馆。
没有 Refract：您的代理在回答每个问题时都会获取所有 50 本书的详细摘要，即使答案只需要其中一本。
有了 Refract：您的代理首先获取一个标题列表（索引）。一旦知道需要哪本书，它只接收那本书的内容。
技术层面：
索引（始终发送）：仅包含工具名称和每个工具的简短描述。
详细信息（仅在需要时发送）：实际使用的工具的完整描述，以及正确使用它所需的一切，不多不少。
验证：每次压缩后，Refract 自动检查是否删除了重要内容。如有任何疑问，它会发送完整版本，而不是冒险。
此过程不涉及任何 AI 模型。它是完全自动、快速且确定性的。
工具 | 功能 |
压缩 | 实时压缩工具模式，最高可减少 98% |
信号检查 | 每次压缩后验证可调用合约 |
语义路由 | 使用嵌入识别正确的工具（可选） |
提示缓存 | 为重复请求注入 Anthropic cache_control |
工具 | 输入 | 输出 |
index_repo | 仓库路径 | 所有 Python、JS、TS 文件的聚合索引 |
get_compressed | 文件路径 | 压缩后的结构 + Token 统计 |
expand | 文件路径 + 函数名 | 原始源代码 + 依赖上下文 |
blast_radius | 文件路径 + 函数名 | 如果目标更改，所有会受影响的函数 |
semantic_diff | 文件路径 + 旧源码 + 新源码 | 破坏性变更与仅内容变更的区分 |
semantic_diff_branches | 仓库路径 + 文件 + 函数 + 基础/目标 git 引用 | 两个分支/提交间一个函数的 semantic_diff |
security_surface | 仓库路径 | 危险调用映射（subprocess、eval、pickle、requests） |
refract-status --root /path/to/repo
refract-status --root /path/to/repo --json参数 | 描述 |
| 要分析的路径（默认：当前目录） |
| 机器可读的输出 |
显示：每种语言的文件数、原始 Token 与压缩后 Token、已索引的函数/类、按类别划分的危险调用、不支持 tree-sitter 的语言。
让 Claude 告诉您，如果更改某个目标函数，哪些函数会受影响。
示例结果：
{
"target": "authenticate",
"direct_callers": ["login_user"],
"all_impacted": ["login_user", "verify_session", "admin_access"],
"impacted_count": 3,
"risk_level": "MEDIUM"
}风险等级：LOW（0 到 2 个受影响）、MEDIUM（3 到 5 个）、HIGH（6 个或更多）。
通过比较函数接口（而非函数体）检测破坏性 API 变更。可用作 CI 门禁。
示例结果：
{
"breaking": ["authenticate"],
"body_only": ["logout"],
"added": ["new_function"],
"removed": [],
"unchanged": ["hash_password"],
"is_breaking": true
}如果 is_breaking 为 true，则 PR 更改了公共 API，必须进行审查。
映射仓库中每个调用危险原语的函数。
高风险：subprocess、os.system、eval、exec、pickle、ctypes
中风险：open（写入模式）、socket、requests、httpx、urllib
示例结果：
{
"high_risk": [
{
"file": "src/llm_client.py",
"function": "run_command",
"calls": ["subprocess.run"]
}
],
"summary": {
"high_risk_count": 1,
"medium_risk_count": 3,
"total_functions_scanned": 87,
"clean_files": 8
}
}Python（通过 ast 模块）、JavaScript、TypeScript、JSX、TSX（通过 tree-sitter，可选安装：pip install refract-mcp[multilang]）。
语言根据文件扩展名自动检测。如果未安装 tree-sitter，则优雅降级。
Refract 与 Anthropic 提示缓存集成。as_anthropic_tools() 会自动将压缩后的目录标记为可缓存，从而在重复请求中进一步降低成本。
示例：30 天内，每天 100 次请求，每次 5,000 Token 的模式：
场景 | 成本 |
无 Refract，无缓存 | $45.00 |
使用 Refract + 缓存 | $1.49 |
Claude Desktop 中显示 "Failed to spawn process: No such file or directory"
Claude Desktop 在其 PATH 中找不到 refract-proxy。请找到绝对路径并直接使用：
which refract-proxy然后在 claude_desktop_config.json 中使用完整路径：
{
"mcpServers": {
"my-tool-via-refract": {
"command": "/full/path/to/refract-proxy",
"args": [
"--target",
"npx @modelcontextprotocol/server-filesystem /path/to/folder"
]
}
}
}Claude Desktop、Cursor、任何遵循 MCP 标准的客户端、任何现有的 MCP 服务器。
MIT——可自由使用，包括商业用途。
Reverse-call-graph impact analysis for a Python function: BFS over inverted call edges to find every function transitively affected by changing target_function. Returns direct_callers, all_impacted, impacted_count, total_functions and a risk_level. Python files only.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to a .py file (relative to --root or absolute). | |
| target_function | Yes | Function/method name to analyze the blast radius of. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavior: BFS algorithm, inverted call edges, returns specific fields (direct_callers, all_impacted, etc.), and scope (Python files only). No hidden side effects or destructive actions are implied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the purpose, and includes all essential information without verbosity. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations or output schema, the description covers purpose, algorithm, input parameters, return fields, and file type restriction. It is complete for an agent to understand and use this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (both params described), so baseline is 3. The description adds value by explaining the algorithm context (BFS over inverted call edges) and linking the parameters to the analysis process, though the schema already defines them clearly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Reverse-call-graph impact analysis for a Python function', specifying the verb (analyze impact), resource (Python function), and methodology (BFS over inverted call edges). It distinguishes from sibling tools like index_repo and security_surface which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly defines usage: when you need to know which functions are affected by changing a target function in a Python file. It does not explicitly compare with siblings, but the context is clear. The restriction 'Python files only' provides a clear constraint, earning a 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Given function/class names in a .py file, return them verbatim (full source) plus their compressed dependency context.
| Name | Required | Description | Default |
|---|---|---|---|
| targets | Yes | Function/class names to expand. | |
| file_path | Yes | Path to a .py file (relative to --root or absolute). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so description carries full burden. It states it returns 'full source' and 'compressed dependency context', which is a key behavioral trait. However, it does not disclose read-only nature, auth requirements, or potential performance implications (e.g., large files). Adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with purpose. No wasted words; all information is necessary and directly conveys the tool's action and output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is no output schema and no annotations, the description is somewhat vague about the exact format of 'compressed dependency context'. While the tool is simple, the description could be more complete by clarifying what 'compressed' means. Sufficient but leaves room for ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters adequately. The tool description adds no new meaning beyond restating the schema descriptions, meeting the baseline but not adding value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'expand' on function/class names in a .py file, clearly indicating it returns full source plus dependency context. Differentiates from siblings like 'get_compressed' (which likely returns compressed content) and 'blast_radius' (impact analysis).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like 'get_compressed' or 'blast_radius'. Usage is implied by the description (to get full source of specific definitions with dependencies), but lacks when-not-to-use or prerequisite information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
S5-compress a single source file — Python or JS/TS (signatures + dependency contracts, bodies stripped) — and return the compressed structure plus token stats (tokens_before, tokens_after, reduction_pct).
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to a .py file (relative to --root or absolute). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must disclose behaviors. It does not state whether the operation is read-only or modifies files, nor does it mention side effects, auth requirements, or rate limits. The word 'compress' might imply mutation, but the return of a 'compressed structure' suggests the original file is unchanged. This ambiguity is a gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single well-structured sentence. It front-loads the action ('S5-compress a single source file'), specifies file types, details the compression behavior, and lists the output. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without output schema, the description should explain the return value structure, but it does mention 'compressed structure plus token stats (tokens_before, tokens_after, reduction_pct),' which is helpful. However, it lacks behavioral context (read/write), does not resolve the file type inconsistency, and does not address how this relates to sibling tools like 'expand.' The minimal viable information is present, but gaps reduce completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (one parameter with description). The description adds that the tool supports Python and JS/TS, but the schema's parameter description says 'Path to a .py file,' which contradicts the broader file types stated in the tool description. This inconsistency misleads the agent and detracts from the value added beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool compresses a single source file (Python or JS/TS) by stripping bodies while keeping signatures and dependency contracts, and returns token stats. The verb 'compress' and resource 'source file' are specific, and it distinguishes from siblings like 'blast_radius' or 'expand' implicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description does not mention when to choose compression over expansion or other sibling tools, leaving the agent without decision context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Walk a repo (Python + JavaScript/TypeScript) and return an aggregated structural index: every function, class, import and dependency. Max depth 3; skips pycache, .git, venv, node_modules.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Repo path (relative to --root or absolute). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses maximum depth 3 and skipped directories (__pycache__, .git, venv, node_modules), but fails to mention behavior for unsupported file types, invalid paths, or performance implications for large repos. Additional context would improve transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with front-loaded purpose and clear constraints. Every word adds value, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description partially explains return value as 'aggregated structural index' listing functions, classes, imports, dependencies. However, it lacks details on output format (e.g., JSON structure, list vs. dict) and does not address edge cases like empty repos or mixed languages. It is acceptable but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single required 'path' parameter described adequately. The description adds no extra parameter details beyond the schema, so baseline 3 is appropriate. The description's main value is in explaining the tool's overall function, not parameter specifics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool walks a repo and returns a structural index of functions, classes, imports, and dependencies, explicitly specifying supported languages (Python and JavaScript/TypeScript). This distinguishes it from sibling tools like 'blast_radius' or 'security_surface', which likely have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives like 'blast_radius' or 'expand'. It only implies usage for structural indexing, but lacks when-to-use, when-not-to-use, or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Walk a Python repo and find functions that call dangerous primitives — pure AST analysis, zero LLM calls. Classifies calls as HIGH risk (subprocess/os.system/eval/exec/pickle/import/ctypes …) or MEDIUM risk (sockets/requests/httpx/urllib/paramiko/smtplib and write-mode open()). Also scans for potential secrets: hardcoded keys/tokens (AKIA…, sk-…, ghp_…, token=/password=/api_key= assignments), .env/environment loading, and high-entropy token-looking literals. Returns high_risk, medium_risk, secrets, clean files and a summary. Max depth 3; skips pycache, .git, venv, node_modules.
| Name | Required | Description | Default |
|---|---|---|---|
| repo_path | Yes | Repo path (relative to --root or absolute). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It clearly states pure AST analysis, zero LLM calls, risk classification levels, secret detection, max depth 3, and skipped directories. Could mention whether the tool is read-only (likely yes) but overall quite transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is front-loaded with the main action and packed with relevant details in three sentences. Minimal redundancy, though length could be trimmed slightly without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, description adequately explains return values (high_risk, medium_risk, secrets, clean files, summary). Covers key behaviors and limitations. Could mention file type filtering but sufficient for an agent to understand scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (repo_path) with 100% schema coverage. Description adds no extra detail beyond the schema's description of the path. Baseline score is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it walks a Python repo using AST analysis to find dangerous function calls and secrets, with specific risk classifications. No sibling tool overlaps, making its unique purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (security scanning of Python repos) but does not explicitly state when not to use or mention alternatives among siblings. More precise guidance would improve this dimension.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.7.0blast_radiusexpandget_compressedindex_reposecurity_surfaceScored across 5 tools
Each tool has a distinct purpose: impact analysis, source retrieval, file compression, repo indexing, and security scanning. No two tools overlap in functionality.
All tools use snake_case, but 'expand' is a lone verb while others follow a verb_noun pattern (e.g., get_compressed, index_repo). Minor inconsistency but still clear.
5 tools is a well-scoped set for a static analysis toolkit. Neither too few nor too many, each tool serves a clear need.
Covers core static analysis needs (impact, source, compression, indexing, security). Missing a dedicated diff or test analysis tool, but the surface is reasonably complete for the domain.
The OpenRouter for tools. One MCP connection gives any AI agent 254 hosted tools, pay per call.
One MCP endpoint for Claude, GPT & Gemini: 100+ tools + no-code connectors + agent workers.
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
