mcp-context-cost 0.11.3 → 0.13.0

package/README.md

@@ -2,6 +2,27 @@
 
 [![npm](https://img.shields.io/npm/v/mcp-context-cost)](https://www.npmjs.com/package/mcp-context-cost)
 [![CI](https://github.com/athakur3/mcp-context-cost/actions/workflows/ci.yml/badge.svg)](https://github.com/athakur3/mcp-context-cost/actions/workflows/ci.yml)
+[![GitHub Marketplace](https://img.shields.io/badge/GitHub%20Marketplace-MCP%20context%20cost-blue?logo=github)](https://github.com/marketplace/actions/mcp-context-cost)
+
+Two entry points: `audit`, for the config you run (below), and a GitHub Action, for the
+server you publish — five lines in a workflow that fail a pull request adding more context
+cost than you meant to ship:
+
+```yaml
+- uses: athakur3/mcp-context-cost@v1
+  with:
+    name: my-server
+    command: node dist/index.js
+    baseline: .context-cost/baseline.json
+    max-increase: 500
+```
+
+Inputs: `name`, `command` or `remote`, `baseline`, `max-increase`, `budget`, `timeout`,
+`version`. Outputs: `tokens`, `tools`, `status`, `measurement`, `badge` — written whether the
+gate passed or not, so a later step can comment the number on the PR or publish the badge.
+[Full workflow](examples/server-author-ci.yml) ·
+[how the gate decides](#defend-the-number-dont-just-display-it) ·
+[what the number is](docs/METHODOLOGY.md).
 
 **What do the MCP servers in your config cost you before you type anything — and what did
 that last config change add to every session you will ever run?**
@@ -105,7 +126,7 @@ costs **more** than loading the definitions would.
 
 Three things the report will not do: it will not convert between units silently (in
 threshold mode the stack is compared as a range, because the audit counts wire bytes and the
-threshold is counted in what the client sends to the API — measured at 0.20×–1.92× across 20
+threshold is counted in what the client sends to the API — measured at 0.20×–1.92× across 23
 servers); it will not claim a posture the machine did not state readably, which is four
 refusals and not one — when two places set the same variable to different values, when a
 settings file exists and cannot be read, when the place that would decide sets the variable
@@ -183,8 +204,8 @@ INCREASE FAIL:
 Add `--claude` to annotate each server with its Anthropic-request cost from the published
 [Claude divergence](docs/METHODOLOGY.md#claude-divergence) run — an exact number when the
 published capture hash matches what you have installed, `—` (silence, not a stale guess)
-when it doesn't. The run holds 20 rows — the top 20 measured servers by tokens when it ran —
-and [results/leaderboard.md](results/leaderboard.md) prints a claude number for the 16 that
+when it doesn't. The run holds 23 rows — the measured servers it covered when it last ran —
+and [results/leaderboard.md](results/leaderboard.md) prints a claude number for the 15 that
 still match today and silence for the rest. Most installs will show a mix:
 
 ```
@@ -235,7 +256,7 @@ Flags: `--json` (full report on stdout, progress on stderr), `--budget N`,
 
 The number `audit` gives you is the same measurement, run across a curated set of public
 servers — which is how you can tell it is a measurement and not this tool's opinion. It also
-shows what you are choosing between: across the 81 servers measured, cost spans **1,700×**,
+shows what you are choosing between: across the 86 servers measured, cost spans **1,700×**,
 from `postgres` at 32 tokens to `github` at 54,622. The table below is a
 sample of that range; the full range is in
 [results/leaderboard.md](results/leaderboard.md).
@@ -244,13 +265,13 @@ sample of that range; the full range is in
 |---|---:|---:|
 | github (official) | **54,622 tokens** | 44 |
 | xcodebuildmcp | 26,594 | 24 |
-| brave-search | 25,456 | 8 |
+| brave-search | 25,487 | 8 |
 | notion | 17,500 | 24 |
 | playwright *(4.8M installs/week)* | 4,024 | 24 |
 | filesystem (reference) | 2,823 | 14 |
 | markitdown | 64 | 1 |
 
-*(81 of 106 popular servers measured, each row dated by its own most recent sweep — full table in
+*(86 of 106 popular servers measured, each row dated by its own most recent sweep — full table in
 [results/leaderboard.md](results/leaderboard.md); every failure is listed with its reason.
 Each measured server also has a [detail page](https://athakur3.github.io/mcp-context-cost/servers/)
 showing which tools its tokens are in.)*
@@ -260,7 +281,7 @@ answers a question no client asks: **what did this server cost last month?**
 [results/regressions.md](results/regressions.md) reports each server's most recent movement —
 dated to when it happened, separated into *shipped more tools* versus *same tools, rewritten*,
 and compared only within one isolation. The ecosystem ratchets upward: of the servers whose
-cost has moved at all, 9 moved up against 1 that moved down. Method:
+cost has moved at all, 11 moved up against 6 that moved down. Method:
 [cost movement](docs/METHODOLOGY.md#cost-movement).
 
 If you publish a server, the same measurement is available as a badge, so your users can see
@@ -328,7 +349,7 @@ number is *not*, config policy, failure taxonomy, frozen color bands, known dive
 | `spec/fixtures/` | golden vectors shared by the TypeScript and bash implementations |
 | `tools/` | the one script that calls a network API (Claude divergence); kept out of the package so the library stays offline |
 | `upstream/` | `badge.sh` + composite-action patch + bash tests — the self-serve badge recipe, carried here |
-| `servers.yaml` | 82 curated candidates with live install metrics and provenance |
+| `servers.yaml` | 106 curated candidates with live install metrics and provenance |
 | `results/` · `badges/` | measurements, leaderboard, history series, shields endpoint JSONs |
 | `docs/` | methodology, dashboard, and a generated page per measured server |
 
@@ -350,11 +371,11 @@ Then in your README:
 
 A badge says what your server costs today; it does nothing about the release
 that adds 1,200 tokens to every user's context next month. Across the servers
-measured here, that release is the norm rather than the exception — the
-[movement report](results/regressions.md) has nine servers ratcheting upward
-against one that got cheaper, and none of those maintainers had a check that
-would have said so first. `measure` takes the same gate flags `audit` does, so
-your own CI can be that check:
+measured here most costs hold steady from sweep to sweep, but when a cost does
+move it usually moves up: the [movement report](results/regressions.md) has 11
+servers ratcheting upward against 6 that got cheaper, and none of those
+maintainers had a check that would have said so first. `measure` takes the same
+gate flags `audit` does, so your own CI can be that check:
 
 ```bash
 # on your default branch, once — commit the result

package/dist/audit/deferral.js

@@ -229,7 +229,20 @@ export function resolveToolSearchSources(sources) {
 export const PUBLISHED_WIRE_TO_CLIENT_RATIO = {
     low: 0.2,
     high: 1.92,
-    servers: 20,
+    // A snapshot of the run this package was cut against, which is what `source`
+    // below says it is — the installed package has no `results/` to read, so when
+    // a live run is supplied `wireToClientRatio` uses that instead and this is
+    // never consulted. It may therefore lag the run on trunk, and a test holds it
+    // to the two things that matter: the band must still be accurate to the
+    // precision it is published at, because a wrong band gives a wrong
+    // above/below verdict, and the count must never *exceed* the run, because
+    // that would be a claim about servers nobody measured.
+    //
+    // It read 20 from the day the run covered the top 20 until the run widened to
+    // every measured server on 2026-09-05, with nothing comparing the two. The
+    // band had not moved — the servers added sat inside it — which is exactly how
+    // a number like this goes wrong quietly.
+    servers: 23,
     source: 'the published claude-opus-5 divergence run',
 };
 /** Derive the band from a supplied divergence run, falling back to the published one. */

package/dist/core/regression.d.ts

@@ -42,6 +42,8 @@ export interface DatedMeasurement {
     tokens: number;
     toolCount: number;
     status: string;
+    /** What the server called itself at `initialize`, or `''` when not recorded. */
+    version?: string;
 }
 /** Method identifier, versioned independently of METHODOLOGY_VERSION. */
 export declare const REGRESSION_METHOD = "cost-regression/v1";
@@ -67,6 +69,14 @@ export interface ToolVectorEntry {
     canonicalSha256: string;
     totalTokens: number;
     tools: ToolVector[];
+    /**
+     * The version the server reported at `initialize`, absent when it reported
+     * none or when the entry was stored before this field existed. Entries are
+     * deduped by capture and never rewritten, so an existing one does not gain a
+     * version retroactively — which is correct: identical bytes are the same
+     * definitions, and what upstream called them that day is not on record.
+     */
+    version?: string;
 }
 export interface ToolVectorFile {
     method: string;
@@ -150,6 +160,17 @@ export interface CostChange {
     fromToolCount: number;
     toToolCount: number;
     deltaTools: number;
+    /**
+     * What the server called itself on each side, or `''` where the row does not
+     * say. Never inferred: a movement whose earlier row predates the version
+     * column names no release, because nothing on disk records which one it was.
+     *
+     * The two being *equal* is a reading in its own right, and a common one —
+     * the cost moved while the version did not, which means the change came from
+     * a dependency the server does not pin rather than from its own release.
+     */
+    fromVersion: string;
+    toVersion: string;
     mechanism: Mechanism;
     /** True when the movement clears both thresholds. */
     significant: boolean;
@@ -162,11 +183,44 @@ export interface CostChange {
     /** Per-tool breakdown, or null when the two captures are not both on record. */
     attribution: ToolAttribution | null;
 }
+/**
+ * A cost that has been measured more than once, under the same isolation, and
+ * has not moved.
+ *
+ * Published because it is a measured fact and not the absence of one. The
+ * report used to swallow it: `latestChange` returned null both for this and
+ * for "there is nothing to compare", and the page counted every null the same
+ * way — so a number four sweeps had confirmed read exactly like a number
+ * measured once.
+ */
+export interface UnchangedSeries {
+    server: string;
+    tokens: number;
+    toolCount: number;
+    /** The first date this cost was recorded — when it became this, not when it was last looked at. */
+    since: string;
+    /** The newest measurement on record. */
+    measuredThrough: string;
+    /** How many comparable measurements carry this same cost, `since` included. */
+    sweeps: number;
+}
+/**
+ * What one server's series supports. Three readings, and they are three
+ * different claims: the cost moved, the cost was confirmed and held, or there
+ * is not yet a second comparable measurement to say either.
+ */
+export type SeriesReading = {
+    kind: 'changed';
+    change: CostChange;
+} | {
+    kind: 'unchanged';
+    held: UnchangedSeries;
+} | {
+    kind: 'incomparable';
+};
 export declare function isSignificant(deltaTokens: number, deltaPct: number): boolean;
 /**
- * The most recent comparable *movement* for one server, or null when there
- * isn't one: fewer than two comparable measurements, or a series that has never
- * changed.
+ * What one server's history supports, as one of three readings.
  *
  * Deliberately not "the newest pair". A server that grew 82% one week and held
  * that cost since has a newest pair of zero, and reporting only that would hide
@@ -176,10 +230,23 @@ export declare function isSignificant(deltaTokens: number, deltaPct: number): bo
  * actually happened — `2026-08-19 → 2026-08-26`, not a span up to today.
  * `measuredThrough` then carries how long the new cost has held.
  *
+ * Where that walk ends decides the reading. Reaching the start of the series
+ * means every comparable measurement agrees, which is `unchanged` — a fact
+ * about the server. Having fewer than two comparable rows to walk means there
+ * is nothing to compare, which is `incomparable` — an absence. The two used
+ * to share one `null` return, and the report counted them together.
+ *
  * `rows` is that server's history, already narrowed to the run a trend may be
  * drawn across (`plottableSeries`), so the isolation rule is applied once, in
  * the place that owns it.
  */
+export declare function readSeries(server: string, rows: DatedMeasurement[], vectors?: ToolVectorFile | null): SeriesReading;
+/**
+ * The most recent comparable movement, or null when there was none. Kept as
+ * the narrow question `readSeries` answers in full, for the callers that only
+ * ever wanted a movement — but a caller that publishes a count must ask
+ * `readSeries`, because null here is two different facts.
+ */
 export declare function latestChange(server: string, rows: DatedMeasurement[], vectors?: ToolVectorFile | null): CostChange | null;
 export interface RegressionSummary {
     changes: CostChange[];
@@ -188,7 +255,22 @@ export interface RegressionSummary {
     significant: number;
     /** Net tokens the measured set gained (or lost) across every listed movement. */
     netTokens: number;
-    /** Servers with a measurement but no second comparable one to diff against. */
+    /**
+     * Servers measured more than once under the same isolation whose cost has
+     * not moved. Counted apart from `withoutComparison`, which they were folded
+     * into while both readings shared one `null`.
+     */
+    unchanged: UnchangedSeries[];
+    /**
+     * Servers with no second comparable measurement to diff against — a first
+     * measurement, or every earlier run taken under different isolation. Not
+     * "has not moved": that is `unchanged`.
+     */
     withoutComparison: number;
 }
-export declare function summarize(changes: CostChange[], withoutComparison: number): RegressionSummary;
+/**
+ * `unchanged` is required rather than defaulted: every reading a caller
+ * classifies belongs to exactly one of the three, and a default would let a
+ * caller that forgot them publish a total that quietly does not sum.
+ */
+export declare function summarize(changes: CostChange[], withoutComparison: number, unchanged: UnchangedSeries[]): RegressionSummary;

package/dist/core/regression.js

@@ -38,6 +38,7 @@ export function parseToolVectorFile(text) {
             date: e.date,
             canonicalSha256: e.canonicalSha256,
             totalTokens: e.totalTokens,
+            ...(typeof e.version === 'string' && e.version ? { version: e.version } : {}),
             tools: e.tools
                 .filter((t) => !!t && typeof t.name === 'string' && typeof t.tokens === 'number')
                 .map((t) => ({ name: t.name, tokens: t.tokens })),
@@ -62,6 +63,7 @@ export function vectorEntryOf(m) {
         date,
         canonicalSha256: m.canonicalSha256,
         totalTokens: m.totalTokens,
+        ...(m.serverVersion ? { version: m.serverVersion } : {}),
         tools: m.tools.map((t) => ({ name: t.name, tokens: t.tokens })),
     };
 }
@@ -139,9 +141,7 @@ export function isSignificant(deltaTokens, deltaPct) {
     return Math.abs(deltaPct) >= SIGNIFICANT_PCT && Math.abs(deltaTokens) >= SIGNIFICANT_TOKENS;
 }
 /**
- * The most recent comparable *movement* for one server, or null when there
- * isn't one: fewer than two comparable measurements, or a series that has never
- * changed.
+ * What one server's history supports, as one of three readings.
  *
  * Deliberately not "the newest pair". A server that grew 82% one week and held
  * that cost since has a newest pair of zero, and reporting only that would hide
@@ -151,14 +151,20 @@ export function isSignificant(deltaTokens, deltaPct) {
  * actually happened — `2026-08-19 → 2026-08-26`, not a span up to today.
  * `measuredThrough` then carries how long the new cost has held.
  *
+ * Where that walk ends decides the reading. Reaching the start of the series
+ * means every comparable measurement agrees, which is `unchanged` — a fact
+ * about the server. Having fewer than two comparable rows to walk means there
+ * is nothing to compare, which is `incomparable` — an absence. The two used
+ * to share one `null` return, and the report counted them together.
+ *
  * `rows` is that server's history, already narrowed to the run a trend may be
  * drawn across (`plottableSeries`), so the isolation rule is applied once, in
  * the place that owns it.
  */
-export function latestChange(server, rows, vectors) {
+export function readSeries(server, rows, vectors) {
     const usable = rows.filter((r) => r.status === 'measured' || r.status === 'dynamic');
     if (usable.length < 2)
-        return null;
+        return { kind: 'incomparable' };
     const newest = usable[usable.length - 1];
     // Walk back over measurements identical to the newest: the first of that run
     // is when the current cost arrived.
@@ -169,14 +175,26 @@ export function latestChange(server, rows, vectors) {
             break;
         toIdx--;
     }
+    /** The trailing run reaches back this far, and every row in it agrees. */
+    const held = () => ({
+        kind: 'unchanged',
+        held: {
+            server,
+            tokens: newest.tokens,
+            toolCount: newest.toolCount,
+            since: usable[toIdx].date,
+            measuredThrough: newest.date,
+            sweeps: usable.length - toIdx,
+        },
+    });
     if (toIdx === 0)
-        return null; // the series has never changed
+        return held(); // every comparable measurement agrees
     const to = usable[toIdx];
     const from = usable[toIdx - 1];
     const deltaTokens = to.tokens - from.tokens;
     const deltaTools = to.toolCount - from.toolCount;
     if (deltaTokens === 0 && deltaTools === 0)
-        return null;
+        return held();
     const deltaPct = from.tokens > 0 ? (deltaTokens / from.tokens) * 100 : 0;
     // Attribution needs both sides on record. Matched by *cost as of that date*,
     // not by date equality: vectors are deduped by capture and keep the first
@@ -209,23 +227,43 @@ export function latestChange(server, rows, vectors) {
         attribution = attribute(fromVec, toVec, deltaTokens);
     }
     return {
-        server,
-        fromDate: from.date,
-        toDate: to.date,
-        fromTokens: from.tokens,
-        toTokens: to.tokens,
-        deltaTokens,
-        deltaPct,
-        fromToolCount: from.toolCount,
-        toToolCount: to.toolCount,
-        deltaTools,
-        mechanism: mechanismOf(deltaTokens, deltaTools),
-        significant: isSignificant(deltaTokens, deltaPct),
-        measuredThrough: newest.date,
-        attribution,
+        kind: 'changed',
+        change: {
+            server,
+            fromDate: from.date,
+            toDate: to.date,
+            fromTokens: from.tokens,
+            toTokens: to.tokens,
+            deltaTokens,
+            deltaPct,
+            fromToolCount: from.toolCount,
+            toToolCount: to.toolCount,
+            deltaTools,
+            fromVersion: from.version ?? '',
+            toVersion: to.version ?? '',
+            mechanism: mechanismOf(deltaTokens, deltaTools),
+            significant: isSignificant(deltaTokens, deltaPct),
+            measuredThrough: newest.date,
+            attribution,
+        },
     };
 }
-export function summarize(changes, withoutComparison) {
+/**
+ * The most recent comparable movement, or null when there was none. Kept as
+ * the narrow question `readSeries` answers in full, for the callers that only
+ * ever wanted a movement — but a caller that publishes a count must ask
+ * `readSeries`, because null here is two different facts.
+ */
+export function latestChange(server, rows, vectors) {
+    const reading = readSeries(server, rows, vectors);
+    return reading.kind === 'changed' ? reading.change : null;
+}
+/**
+ * `unchanged` is required rather than defaulted: every reading a caller
+ * classifies belongs to exactly one of the three, and a default would let a
+ * caller that forgot them publish a total that quietly does not sum.
+ */
+export function summarize(changes, withoutComparison, unchanged) {
     const sorted = [...changes].sort((a, b) => Math.abs(b.deltaPct) - Math.abs(a.deltaPct));
     return {
         changes: sorted,
@@ -233,6 +271,9 @@ export function summarize(changes, withoutComparison) {
         shrank: sorted.filter((c) => c.deltaTokens < 0).length,
         significant: sorted.filter((c) => c.significant).length,
         netTokens: sorted.reduce((a, c) => a + c.deltaTokens, 0),
+        // Longest-held first: the sentence this section exists to publish is "this
+        // number has been the same since <date>", so the oldest `since` leads.
+        unchanged: [...unchanged].sort((a, b) => a.since.localeCompare(b.since) || b.tokens - a.tokens),
         withoutComparison,
     };
 }

package/dist/core/types.d.ts

@@ -1,5 +1,15 @@
 /** Status taxonomy — every swept server gets exactly one; no silent drops. */
-export type MeasurementStatus = 'measured' | 'auth-required' | 'startup-failure' | 'timeout' | 'dynamic' | 'remote-auth-wall';
+export type MeasurementStatus = 'measured' | 'auth-required' | 'startup-failure' | 'timeout'
+/**
+ * This harness cannot run the server, for a reason that is a property of the
+ * harness rather than of the software: an OS or architecture the package does
+ * not ship for, or a backing service the isolation deliberately does not
+ * provide. Distinct from `startup-failure`, which asserts the server did not
+ * come up — a claim about someone else's code that these entries do not
+ * support. Only ever set when the entry declares the reason AND the failure's
+ * own text corroborates it (see `notApplicable` in report.ts).
+ */
+ | 'not-applicable' | 'dynamic' | 'remote-auth-wall';
 export interface ToolMeasurement {
     name: string;
     /** Tokens of the whole tool object, canonically serialized. */
@@ -43,6 +53,18 @@ export interface Measurement {
         image?: string;
         network?: string;
         note?: string;
+        /**
+         * The architecture the measurement ran on, as `<platform>/<arch>` (e.g.
+         * `linux/amd64`). Part of the isolation because some packages ship builds
+         * for only some of them: `local-mcp` was published as a startup failure on
+         * the strength of a run whose real finding was "this laptop is arm64 and
+         * the package has no arm64 runtime" — a fact about the machine that the
+         * record gave no way to see.
+         *
+         * Absent on records written before this was captured, which is why it is
+         * optional; absence means unknown, never "the same as yours".
+         */
+        arch?: string;
     };
     /** Request timeout in force during this measurement. */
     timeoutMs?: number;

package/dist/sweep/client.d.ts

@@ -13,6 +13,28 @@ export interface WireCapture {
     instructions: string | null;
     stderrTail: string;
 }
+/**
+ * The part of a dead server's stderr worth keeping as evidence.
+ *
+ * A failure record is only useful if it contains the failure, and a plain tail
+ * reliably keeps the least useful part. `npx` prints a deprecation warning per
+ * transitive dependency and a version notice at the end, and a crashing process
+ * prints its message *before* the stack — so the last N characters of stderr
+ * are npm warnings and stack frames on exactly the servers whose failure needs
+ * explaining. Several published records ended up saying nothing about why the
+ * server did not start.
+ *
+ * This is not cosmetic. `run.ts` classifies a failure by reading these words:
+ * a record whose message was cut off is filed as `startup-failure` — the server
+ * is broken — when the surviving text would have said `auth-required`. Spending
+ * the budget on the message rather than the frames is what keeps the published
+ * taxonomy describing the server.
+ *
+ * Noise is only dropped while something else survives. A package that fails
+ * *inside* npm (EBADPLATFORM, a failed postinstall) has npm's own lines as its
+ * only evidence, and a server whose whole output is a stack keeps the stack.
+ */
+export declare function evidenceTail(stderr: string, limit?: number): string;
 export declare class McpStdioClient {
     private child;
     private buffer;

package/dist/sweep/client.js

@@ -6,6 +6,92 @@
  */
 import { spawn } from 'node:child_process';
 const PROTOCOL_VERSION = '2025-06-18';
+/**
+ * The part of a dead server's stderr worth keeping as evidence.
+ *
+ * A failure record is only useful if it contains the failure, and a plain tail
+ * reliably keeps the least useful part. `npx` prints a deprecation warning per
+ * transitive dependency and a version notice at the end, and a crashing process
+ * prints its message *before* the stack — so the last N characters of stderr
+ * are npm warnings and stack frames on exactly the servers whose failure needs
+ * explaining. Several published records ended up saying nothing about why the
+ * server did not start.
+ *
+ * This is not cosmetic. `run.ts` classifies a failure by reading these words:
+ * a record whose message was cut off is filed as `startup-failure` — the server
+ * is broken — when the surviving text would have said `auth-required`. Spending
+ * the budget on the message rather than the frames is what keeps the published
+ * taxonomy describing the server.
+ *
+ * Noise is only dropped while something else survives. A package that fails
+ * *inside* npm (EBADPLATFORM, a failed postinstall) has npm's own lines as its
+ * only evidence, and a server whose whole output is a stack keeps the stack.
+ */
+export function evidenceTail(stderr, limit = 600) {
+    const withoutNoise = drop(stderr, (l) => /^npm (warn|notice)\b/.test(l));
+    const withoutFrames = drop(withoutNoise, (l) => /^at\s/.test(l));
+    return bothEnds(withoutFrames, limit);
+}
+/**
+ * Keep the start and the end, eliding the middle.
+ *
+ * Dropping npm noise and stack frames is not enough on its own: a CLI that
+ * rejects its environment often prints one line saying why and then its entire
+ * usage screen, which is neither. kubernetes-mcp-server does exactly that, and
+ * a tail-only budget kept forty lines of flag documentation while discarding
+ * "no current-context is set and no contexts are defined in kubeconfig" — the
+ * only sentence in the output that explained anything.
+ *
+ * Failures put their explanation at one end or the other — a crash message
+ * above its aftermath, or an error at the end of a log — so both ends are kept
+ * and the middle is what goes. The split leans towards the head because a
+ * message that precedes its own noise is the more common shape here.
+ */
+function bothEnds(text, limit) {
+    if (text.length <= limit)
+        return text;
+    const elision = '\n […] \n';
+    const budget = Math.max(0, limit - elision.length);
+    const lines = text.split('\n');
+    // Whole lines only: a boundary cut mid-word ("ool/prompt change") reads as
+    // corruption and loses the token an evidence string would match on.
+    const take = (from, to, cap, fromEnd) => {
+        const out = [];
+        let used = 0;
+        for (let i = fromEnd ? to : from; fromEnd ? i >= from : i <= to; i += fromEnd ? -1 : 1) {
+            const cost = lines[i].length + 1;
+            if (used + cost > cap)
+                break;
+            fromEnd ? out.unshift(lines[i]) : out.push(lines[i]);
+            used += cost;
+        }
+        return { out, used };
+    };
+    const headCap = Math.ceil(budget * 0.6);
+    const head = take(0, lines.length - 1, headCap, false);
+    // Whole lines, except when the first line alone overruns the budget. A server
+    // that logs structured JSON puts its entire message on one line, so that line
+    // is both the most informative thing in the output and the only one that can
+    // never fit — slack-mcp-server's `{"level":"fatal","message":"Authentication
+    // required: ..."}` was dropped in full, and the record it left behind said a
+    // child process exited. Truncated evidence beats none.
+    const headText = head.out.length > 0 ? head.out.join('\n') : lines[0].slice(0, headCap);
+    const headUsed = head.out.length > 0 ? head.used : headText.length;
+    const tailFrom = head.out.length > 0 ? head.out.length : 1;
+    const tail = take(tailFrom, lines.length - 1, budget - headUsed, true);
+    if (headText === '' && tail.out.length === 0)
+        return text.slice(0, budget) + elision;
+    return `${headText}${elision}${tail.out.join('\n')}`;
+}
+/** Drop matching lines, keeping the input whole if that would leave nothing. */
+function drop(text, isNoise) {
+    const kept = text
+        .split('\n')
+        .filter((l) => !isNoise(l.trim()))
+        .join('\n')
+        .trim();
+    return kept || text.trim();
+}
 export class McpStdioClient {
     child;
     buffer = '';
@@ -37,7 +123,7 @@ export class McpStdioClient {
                 resolve();
             });
             this.child.on('exit', (code) => {
-                const tail = this.stderrTail.slice(-600);
+                const tail = evidenceTail(this.stderrTail);
                 this.deadReason = `server exited (code ${code})${tail ? `; stderr tail: ${tail}` : ''}`;
                 for (const p of this.pending.values())
                     p.reject(new Error(this.deadReason));
@@ -95,7 +181,12 @@ export class McpStdioClient {
         return new Promise((resolve, reject) => {
             const timer = setTimeout(() => {
                 this.pending.delete(id);
-                reject(new Error(`timeout after ${timeoutMs}ms waiting for ${method}`));
+                // A process that is killed mid-hang never reaches the exit handler, so
+                // without this a timed-out record carries no evidence at all — it says
+                // only that we waited. What the server managed to print before it
+                // stopped answering is usually the whole explanation.
+                const tail = evidenceTail(this.stderrTail);
+                reject(new Error(`timeout after ${timeoutMs}ms waiting for ${method}${tail ? `; stderr tail: ${tail}` : ''}`));
             }, timeoutMs);
             this.pending.set(id, {
                 resolve: (v) => {

package/dist/sweep/cross-check.js

@@ -162,6 +162,7 @@ export function runCli(binPath, entry, opts) {
             dummyEnv: entry.env ?? [],
             dummyEnvValues: entry.envValues,
             needsGit: entry.needsGit,
+            aptPackages: entry.aptPackages,
             containerName,
             binds: [`${binPath}:/opt/mcp-tokens:ro`],
         });
@@ -287,6 +288,8 @@ if (isMain) {
                     dummyEnv: e.env ?? [],
                     dummyEnvValues: e.envValues,
                     needsGit: e.needsGit,
+                    aptPackages: e.aptPackages,
+                    notApplicable: e.notApplicable,
                     persist: false, // the measurements on disk are not this run's to rewrite
                 });
             }

package/dist/sweep/dashboard.js

@@ -66,7 +66,22 @@ export function generateDashboard(root = process.cwd()) {
     const median = totals.length ? totals.slice().sort((a, b) => a - b)[Math.floor(totals.length / 2)] : 0;
     const max = totals.length ? Math.max(...totals) : 1;
     const fmt = (n) => n.toLocaleString('en-US');
-    const now = new Date().toISOString().slice(0, 16).replace('T', ' ') + ' UTC';
+    /**
+     * The stamp is the newest measurement on the page, not the moment the page
+     * was written.
+     *
+     * A wall-clock stamp made `docs/dashboard.html` differ on every regeneration,
+     * so the scheduled jobs' "no change to publish" guard could never fire: one
+     * file that always diffs is enough to publish a commit that says nothing
+     * happened. Dated to the data instead, the page changes when the data does —
+     * and the line now answers the question a reader actually has, which is how
+     * fresh these numbers are, not when the HTML was rendered.
+     */
+    const dates = rows
+        .map((r) => String(r.m?.measuredAt ?? '').slice(0, 10))
+        .filter((d) => /^\d{4}-\d{2}-\d{2}$/.test(d))
+        .sort();
+    const newestMeasurement = dates[dates.length - 1] ?? null;
     const barRows = measured
         .map((r, i) => {
         const m = r.m;
@@ -225,7 +240,7 @@ export function generateDashboard(root = process.cwd()) {
 </style>
 <div class="wrap">
   <header>
-    <p class="eyebrow">methodology v1.0 · o200k_base · generated ${now}</p>
+    <p class="eyebrow">methodology v1.0 · o200k_base · newest measurement ${newestMeasurement ?? 'not yet taken'}</p>
     <h1>mcp-context-cost</h1>
     <p class="sub">What popular MCP servers cost in context tokens before the agent does any work — measured from raw <code>tools/list</code> captures, every number re-derivable from its published measurement file.</p>
   </header>