mcp-context-cost 0.13.1 → 0.14.0

package/README.md

@@ -126,7 +126,7 @@ costs **more** than loading the definitions would.
 
 Three things the report will not do: it will not convert between units silently (in
 threshold mode the stack is compared as a range, because the audit counts wire bytes and the
-threshold is counted in what the client sends to the API — measured at 0.20×–1.92× across 24
+threshold is counted in what the client sends to the API — measured at 0.19×–1.93× across 86
 servers); it will not claim a posture the machine did not state readably, which is four
 refusals and not one — when two places set the same variable to different values, when a
 settings file exists and cannot be read, when the place that would decide sets the variable
@@ -204,8 +204,8 @@ INCREASE FAIL:
 Add `--claude` to annotate each server with its Anthropic-request cost from the published
 [Claude divergence](docs/METHODOLOGY.md#claude-divergence) run — an exact number when the
 published capture hash matches what you have installed, `—` (silence, not a stale guess)
-when it doesn't. The run holds 24 rows — the measured servers it covered when it last ran —
-and [results/leaderboard.md](results/leaderboard.md) prints a claude number for the 16 that
+when it doesn't. The run holds 87 rows — the measured servers it covered when it last ran —
+and [results/leaderboard.md](results/leaderboard.md) prints a claude number for the 86 that
 still match today and silence for the rest. Most installs will show a mix:
 
 ```
@@ -271,7 +271,7 @@ sample of that range; the full range is in
 | filesystem (reference) | 2,823 | 14 |
 | markitdown | 64 | 1 |
 
-*(87 of 106 popular servers measured, each row dated by its own most recent sweep — full table in
+*(87 of 107 popular servers measured, each row dated by its own most recent sweep — full table in
 [results/leaderboard.md](results/leaderboard.md); every failure is listed with its reason.
 Each measured server also has a [detail page](https://athakur3.github.io/mcp-context-cost/servers/)
 showing which tools its tokens are in.)*
@@ -299,7 +299,7 @@ now measured against a pinned model and published beside the badge, and they do
 
 | server | badge (o200k) | Claude (`claude-opus-5`) | |
 |---|---:|---:|---|
-| github | 54,622 | **—** | most of the capture is `annotations`/`outputSchema` metadata Claude never sees |
+| github | 54,622 | **18,728** | most of the capture is `annotations`/`outputSchema` metadata Claude never sees |
 | notion | 17,500 | **33,560** | almost no metadata to drop, so the tokenizer difference dominates |
 
 So the heaviest server on the badge is not the heaviest server on Claude. Per-server
@@ -347,9 +347,9 @@ number is *not*, config policy, failure taxonomy, frozen color bands, known dive
 | `src/audit/` | client-config discovery (5 clients, JSONC-tolerant), the per-stack report, and the baseline diff |
 | `src/cli.ts` | `audit` (measure your own stack), `verify` (re-derive any published number), `measure` |
 | `spec/fixtures/` | golden vectors shared by the TypeScript and bash implementations |
-| `tools/` | the one script that calls a network API (Claude divergence); kept out of the package so the library stays offline |
+| `tools/` | the scripts that call a network API — the Claude divergence run, the adoption reading, the registry scan — kept out of the package so the library stays offline |
 | `upstream/` | `badge.sh` + composite-action patch + bash tests — the self-serve badge recipe, carried here |
-| `servers.yaml` | 106 curated candidates with live install metrics and provenance |
+| `servers.yaml` | 107 curated candidates with live install metrics and provenance |
 | `results/` · `badges/` | measurements, leaderboard, history series, shields endpoint JSONs |
 | `docs/` | methodology, dashboard, and a generated page per measured server |
 
@@ -357,11 +357,26 @@ number is *not*, config policy, failure taxonomy, frozen color bands, known dive
 
 ```bash
 npm ci
-npm run sweep -- --name my-server --command "npx -y my-mcp-server"
-cat badges/my-server.json   # strict shields.io endpoint JSON
+npm run sweep -- --no-persist --name my-server --command "npx -y my-mcp-server"
 ```
 
-Then in your README:
+That prints the number and writes nothing. Published records
+(`results/<name>/measurement.json`, `badges/<name>.json`, the `history.csv`
+row) come from CI: a developer machine is a different architecture under
+different load, and a measurement taken there describes it rather than the
+server. `local-mcp`'s failing record was made on an arm64 laptop, and its
+stderr named an architecture the record itself did not — which is why every
+measurement now records `isolation.arch`. The entry turned out to be
+unavailable on both architectures, and a record that says where it was made
+is what lets that be told from a broken server. To get your server into the
+leaderboard, add an entry to `servers.yaml` and open a pull request; the check
+on that PR measures the entry read-only, and the rotation publishes it after
+merge.
+
+For a badge on your own README, run the published CLI in your server's own CI
+(the [gate](#defend-the-number-dont-just-display-it) below writes
+`results/my-server/measurement.json` and `badges/my-server.json` into that
+repository), then in your README:
 
 ```markdown
 [![context cost](https://img.shields.io/endpoint?url=<raw URL of badges/my-server.json>)](<link target>)
@@ -455,6 +470,7 @@ public, one click each:
 [re-sweep runs](https://github.com/athakur3/mcp-context-cost/actions/workflows/resweep.yml)
 and [self-badge runs](https://github.com/athakur3/mcp-context-cost/actions/workflows/self-badge.yml).
 See [ROADMAP.md](ROADMAP.md) for what's next — contributions welcome, especially new
-`servers.yaml` entries.
+`servers.yaml` entries; [CONTRIBUTING.md](CONTRIBUTING.md) says what an entry needs, the
+order of steps that leaves a pull request green, and where its number comes from.
 
 MIT © 2026

package/dist/audit/deferral.d.ts

@@ -219,15 +219,33 @@ export declare function resolveToolSearchSources(sources: ToolSearchSource[]): R
  * threshold is a share of the context window measured in what the client
  * actually sends to the API — the name/description/input_schema projection,
  * counted by Anthropic's tokenizer, plus the tool framework overhead. Those are
- * not the same number and the gap is not small: across the published
- * divergence run it runs from 0.20× to 1.92×, so a single stack total maps to a
- * range roughly ten times as wide as itself. Comparing the wire number directly
- * against the threshold understates the deferrable side for schema-heavy
- * servers and overstates it for metadata-heavy ones, in one direction each.
+ * not the same number and the gap is not small; the fields below carry it, and
+ * the pages state it from the run rather than from here. Comparing the wire
+ * number directly against the threshold understates the deferrable side for
+ * schema-heavy servers and overstates it for metadata-heavy ones, in one
+ * direction each.
+ *
+ * The band is **marginal**: it converts a server's own bytes and excludes the
+ * tool framework overhead, which `fixedOverhead` carries separately because the
+ * API charges it once per request however many servers are attached. Keeping
+ * them together was wrong in a way that stayed invisible while the divergence
+ * run sampled the heavy end — on a 54,000-token server a fixed 328 is noise. On
+ * 2026-09-05 the run widened to every measured server and reached `postgres` at
+ * 32 tokens on the wire, where 328 of its 348 Claude tokens *are* the overhead:
+ * a per-server ratio of 10.88× that says nothing about converting bytes. Folded
+ * into the band it took the published upper bound from 1.92× to 10.88× and made
+ * the audit refuse threshold questions it had been answering correctly. Held
+ * apart, the band across the same 86 rows is 0.19×–1.93× — which is where it
+ * already was, from a sample a quarter the size.
  */
 export interface WireToClientRatio {
     low: number;
     high: number;
+    /**
+     * Tokens the tool framework costs once per request, whatever is attached.
+     * Added to a stack a single time; never multiplied by anything.
+     */
+    fixedOverhead: number;
     /** How many servers the band was measured across, for the printed caveat. */
     servers: number;
     /** The run it came from, so a reader can date it. */

package/dist/audit/deferral.js

@@ -233,8 +233,9 @@ export function resolveToolSearchSources(sources) {
  * level down. The fields are the record; `source` dates them.
  */
 export const PUBLISHED_WIRE_TO_CLIENT_RATIO = {
-    low: 0.2,
-    high: 1.92,
+    low: 0.19,
+    high: 1.93,
+    fixedOverhead: 328,
     // A snapshot of the run this package was cut against, which is what `source`
     // below says it is — the installed package has no `results/` to read, so when
     // a live run is supplied `wireToClientRatio` uses that instead and this is
@@ -248,27 +249,42 @@ export const PUBLISHED_WIRE_TO_CLIENT_RATIO = {
     // every measured server on 2026-09-05, with nothing comparing the two. The
     // band had not moved — the servers added sat inside it — which is exactly how
     // a number like this goes wrong quietly.
-    servers: 23,
+    //
+    // The widening then moved it by a hair rather than by the fivefold the first
+    // reading suggested: 0.20×–1.92× over 23 servers, 0.19×–1.93× over 86. That a
+    // quarter of the set predicted the whole of it is the interesting part, and it
+    // is only true of the marginal band — see the interface above for what folding
+    // the fixed overhead in did to the same numbers.
+    servers: 86,
     source: 'the published claude-opus-5 divergence run',
 };
 /** Derive the band from a supplied divergence run, falling back to the published one. */
 export function wireToClientRatio(run) {
     if (!run)
         return PUBLISHED_WIRE_TO_CLIENT_RATIO;
+    // `probeDelta` is the run's own reading of the fixed overhead: one tiny tool
+    // attached, minus the same request with none. An upper bound, and the only
+    // measurement of it there is. A run that does not carry one converts as it
+    // always did rather than guessing at a correction.
+    const fixedOverhead = typeof run.probeDelta === 'number' && run.probeDelta > 0 ? run.probeDelta : 0;
     let low = Infinity;
     let high = -Infinity;
     let servers = 0;
     for (const row of Object.values(run.servers)) {
         if (!row || row.error || typeof row.claudeDelta !== 'number' || !(row.o200kFull > 0))
             continue;
-        const ratio = row.claudeDelta / row.o200kFull;
+        const ratio = (row.claudeDelta - fixedOverhead) / row.o200kFull;
+        // A server whose entire Claude cost is the overhead says nothing about
+        // converting bytes, and a negative ratio is not a conversion at all.
+        if (!(ratio > 0))
+            continue;
         low = Math.min(low, ratio);
         high = Math.max(high, ratio);
         servers++;
     }
     if (servers === 0)
         return PUBLISHED_WIRE_TO_CLIENT_RATIO;
-    return { low, high, servers, source: `the ${run.measuredAt} ${run.model} divergence run` };
+    return { low, high, fixedOverhead, servers, source: `the ${run.measuredAt} ${run.model} divergence run` };
 }
 /** Clients this tool discovers that have no default deferral on record. */
 const NO_DEFERRAL_ON_RECORD = new Set(['claude-desktop', 'cursor', 'vscode', 'windsurf']);
@@ -305,6 +321,15 @@ function estimate(servers, ratio) {
             estimated++;
         }
     }
+    // Once per request, not once per server — the band is marginal precisely so
+    // that this is added here and exactly one time. A published Anthropic count
+    // already carries a copy of it, which is why a stack holding one is left
+    // alone: adding another would be the same double count in the other
+    // direction.
+    if (exact === 0 && estimated > 0) {
+        low += ratio.fixedOverhead;
+        high += ratio.fixedOverhead;
+    }
     return { low: Math.round(low), high: Math.round(high), exact, estimated };
 }
 /**

package/dist/core/divergence.d.ts

@@ -67,5 +67,25 @@ export declare function claudeRatio(row: DivergenceRow): number | null;
  * caveat: a wrong number next to a fresh badge is worse than no number.
  */
 export declare function isCurrent(row: DivergenceRow | undefined, canonicalSha256: string | null): row is DivergenceRow;
+/**
+ * Drop rows that have stopped describing the capture they were computed from.
+ *
+ * The companion to `isCurrent`, one layer earlier. `isCurrent` stops a stale row
+ * reaching a page; this stops it being carried forward in the first place. A
+ * selection preserves every row it does not measure, and a re-sweep moves the
+ * capture of every server it re-measures — so between the two, a row outside the
+ * selection can go on being merged forward long after the capture it describes
+ * is gone. Eight of twenty-four rows had reached that state by 2026-09-05, and
+ * nothing said so: the cells were hidden, so the file looked complete while the
+ * count of rows had stopped meaning the count of usable rows.
+ *
+ * `captureSha` returns the canonical hash of what is on disk today, or undefined
+ * when there is no capture at all — which is also a reason to drop, because a
+ * row about a server that no longer measures is a row nothing can confirm.
+ */
+export declare function dropStaleRows(servers: Record<string, DivergenceRow>, captureSha: (name: string) => string | undefined): {
+    kept: Record<string, DivergenceRow>;
+    dropped: string[];
+};
 /** Parse results/divergence.json; anything malformed yields null, never throws. */
 export declare function parseDivergence(text: string): DivergenceRun | null;

package/dist/core/divergence.js

@@ -86,6 +86,33 @@ export function isCurrent(row, canonicalSha256) {
         return false;
     return !!canonicalSha256 && row.capturedSha256 === canonicalSha256;
 }
+/**
+ * Drop rows that have stopped describing the capture they were computed from.
+ *
+ * The companion to `isCurrent`, one layer earlier. `isCurrent` stops a stale row
+ * reaching a page; this stops it being carried forward in the first place. A
+ * selection preserves every row it does not measure, and a re-sweep moves the
+ * capture of every server it re-measures — so between the two, a row outside the
+ * selection can go on being merged forward long after the capture it describes
+ * is gone. Eight of twenty-four rows had reached that state by 2026-09-05, and
+ * nothing said so: the cells were hidden, so the file looked complete while the
+ * count of rows had stopped meaning the count of usable rows.
+ *
+ * `captureSha` returns the canonical hash of what is on disk today, or undefined
+ * when there is no capture at all — which is also a reason to drop, because a
+ * row about a server that no longer measures is a row nothing can confirm.
+ */
+export function dropStaleRows(servers, captureSha) {
+    const kept = {};
+    const dropped = [];
+    for (const [name, row] of Object.entries(servers)) {
+        if (row.capturedSha256 && row.capturedSha256 === captureSha(name))
+            kept[name] = row;
+        else
+            dropped.push(name);
+    }
+    return { kept, dropped };
+}
 /** Parse results/divergence.json; anything malformed yields null, never throws. */
 export function parseDivergence(text) {
     let run;

package/dist/sweep/client.d.ts

@@ -33,16 +33,43 @@ export interface WireCapture {
  * Noise is only dropped while something else survives. A package that fails
  * *inside* npm (EBADPLATFORM, a failed postinstall) has npm's own lines as its
  * only evidence, and a server whose whole output is a stack keeps the stack.
+ *
+ * `required` is the phrase a declared entry's published status depends on
+ * (`notApplicable.evidence` in servers.yaml). Everything else here is a budget
+ * decision — how much of a long failure is worth publishing — but this one is
+ * not. The entry says "this failure is the harness's, and here is the sentence
+ * that proves it", and `notApplicableReason` re-reads that sentence out of what
+ * survives: elide it and the declaration turns itself off, the row reverts to
+ * `startup-failure`, and this project publishes that someone else's working
+ * software is broken. The evidence is therefore kept whatever the budget, and
+ * everything else competes for what is left — the rule the old one lacked, and
+ * the reason it depended on how much the server happened to print.
+ */
+export declare function evidenceTail(stderr: string, limit?: number, required?: string): string;
+/**
+ * Cut a record's notes to `limit` without cutting away the evidence its own
+ * status rests on.
+ *
+ * The same rule as `evidenceTail`, one layer up and for a different reason. The
+ * classifier reads the message *before* this cut, so this one cannot change a
+ * published status — it can only leave a record asserting `not-applicable` with
+ * the sentence that justifies it deleted, which is a claim published without its
+ * evidence. `windows-mcp` sits at exactly the cap today, so the margin here is
+ * one character of growth in somebody else's error message.
  */
-export declare function evidenceTail(stderr: string, limit?: number): string;
+export declare function clampNotes(text: string, limit: number, required?: string): string;
 export declare class McpStdioClient {
+    /** Phrase this entry's declared status depends on — see `evidenceTail`. */
+    private keepEvidence?;
     private child;
     private buffer;
     private nextId;
     private pending;
     private stderrChunks;
     private exited;
-    constructor(command: string, args: string[], env: Record<string, string | undefined>);
+    constructor(command: string, args: string[], env: Record<string, string | undefined>, 
+    /** Phrase this entry's declared status depends on — see `evidenceTail`. */
+    keepEvidence?: string | undefined);
     private onData;
     private send;
     private deadReason;
@@ -61,6 +88,7 @@ export declare function captureTools(spec: string | {
 }, opts?: {
     timeoutMs?: number;
     env?: Record<string, string>;
+    keepEvidence?: string;
 }): Promise<WireCapture>;
 /** Shell-free command splitting: honors single/double quotes, no expansion. */
 export declare function splitCommand(line: string): string[];

package/dist/sweep/client.js

@@ -6,6 +6,8 @@
  */
 import { spawn } from 'node:child_process';
 const PROTOCOL_VERSION = '2025-06-18';
+/** How an elided middle is marked, in every layout here. */
+const ELISION = ' […] ';
 /**
  * The part of a dead server's stderr worth keeping as evidence.
  *
@@ -26,11 +28,24 @@ const PROTOCOL_VERSION = '2025-06-18';
  * Noise is only dropped while something else survives. A package that fails
  * *inside* npm (EBADPLATFORM, a failed postinstall) has npm's own lines as its
  * only evidence, and a server whose whole output is a stack keeps the stack.
+ *
+ * `required` is the phrase a declared entry's published status depends on
+ * (`notApplicable.evidence` in servers.yaml). Everything else here is a budget
+ * decision — how much of a long failure is worth publishing — but this one is
+ * not. The entry says "this failure is the harness's, and here is the sentence
+ * that proves it", and `notApplicableReason` re-reads that sentence out of what
+ * survives: elide it and the declaration turns itself off, the row reverts to
+ * `startup-failure`, and this project publishes that someone else's working
+ * software is broken. The evidence is therefore kept whatever the budget, and
+ * everything else competes for what is left — the rule the old one lacked, and
+ * the reason it depended on how much the server happened to print.
  */
-export function evidenceTail(stderr, limit = 600) {
-    const withoutNoise = drop(stderr, (l) => /^npm (warn|notice)\b/.test(l));
-    const withoutFrames = drop(withoutNoise, (l) => /^at\s/.test(l));
-    return bothEnds(withoutFrames, limit);
+export function evidenceTail(stderr, limit = 600, required) {
+    const needle = required ? required.toLowerCase() : undefined;
+    const protect = (l) => needle !== undefined && l.toLowerCase().includes(needle);
+    const withoutNoise = drop(stderr, (l) => /^npm (warn|notice)\b/.test(l), protect);
+    const withoutFrames = drop(withoutNoise, (l) => /^at\s/.test(l), protect);
+    return bothEnds(withoutFrames, limit, needle);
 }
 /**
  * Keep the start and the end, eliding the middle.
@@ -47,10 +62,23 @@ export function evidenceTail(stderr, limit = 600) {
  * and the middle is what goes. The split leans towards the head because a
  * message that precedes its own noise is the more common shape here.
  */
-function bothEnds(text, limit) {
+function bothEnds(text, limit, needle) {
+    const kept = bothEndsPlain(text, limit);
+    if (needle === undefined)
+        return kept;
+    // Only pay for the anchored layout when the ordinary one lost the phrase and
+    // the raw text actually had it. An entry whose evidence never appeared is a
+    // declaration that does not hold, and must keep failing as one.
+    if (kept.toLowerCase().includes(needle))
+        return kept;
+    if (!text.toLowerCase().includes(needle))
+        return kept;
+    return aroundRequired(text, limit, needle);
+}
+function bothEndsPlain(text, limit) {
     if (text.length <= limit)
         return text;
-    const elision = '\n […] \n';
+    const elision = `\n${ELISION}\n`;
     const budget = Math.max(0, limit - elision.length);
     const lines = text.split('\n');
     // Whole lines only: a boundary cut mid-word ("ool/prompt change") reads as
@@ -83,23 +111,119 @@ function bothEnds(text, limit) {
         return text.slice(0, budget) + elision;
     return `${headText}${elision}${tail.out.join('\n')}`;
 }
-/** Drop matching lines, keeping the input whole if that would leave nothing. */
-function drop(text, isNoise) {
+/**
+ * Keep the line the declared evidence is on, then spend what is left on context.
+ *
+ * Head before tail, the same lean `bothEndsPlain` takes and for the same reason:
+ * an explanation usually precedes its own aftermath. The elisions are marked, so
+ * a reader of the record can see that something was dropped around the sentence
+ * that was not.
+ */
+function aroundRequired(text, limit, needle) {
+    const lines = text.split('\n');
+    const k = lines.findIndex((l) => l.toLowerCase().includes(needle));
+    // Both elisions and the newlines joining at most five chunks, reserved before
+    // the anchor is sized: the budget is a published-record limit, and a layout
+    // that keeps the evidence by overrunning it has only moved the problem.
+    const reserve = 2 * ELISION.length + 4;
+    const anchor = windowAround(lines[k], needle, Math.max(needle.length, limit - reserve));
+    let budget = limit - anchor.length - reserve;
+    const head = [];
+    for (let i = 0; i < k; i++) {
+        const cost = lines[i].length + 1;
+        if (cost > budget)
+            break;
+        head.push(lines[i]);
+        budget -= cost;
+    }
+    const tail = [];
+    for (let i = lines.length - 1; i > k; i--) {
+        const cost = lines[i].length + 1;
+        if (cost > budget)
+            break;
+        tail.unshift(lines[i]);
+        budget -= cost;
+    }
+    const chunks = [];
+    if (head.length)
+        chunks.push(head.join('\n'));
+    if (head.length < k)
+        chunks.push(ELISION);
+    chunks.push(anchor);
+    if (tail.length < lines.length - 1 - k)
+        chunks.push(ELISION);
+    if (tail.length)
+        chunks.push(tail.join('\n'));
+    return chunks.join('\n');
+}
+/**
+ * A single line that alone overruns the budget, kept as a window around the
+ * match rather than from its start — a structured log puts the whole message on
+ * one line, and the phrase that matters can sit anywhere in it.
+ */
+function windowAround(line, needle, limit) {
+    if (line.length <= limit)
+        return line;
+    const at = line.toLowerCase().indexOf(needle);
+    const lead = Math.max(0, Math.floor((limit - needle.length) / 2));
+    const start = Math.max(0, Math.min(at - lead, line.length - limit));
+    return line.slice(start, start + limit);
+}
+/**
+ * Cut a record's notes to `limit` without cutting away the evidence its own
+ * status rests on.
+ *
+ * The same rule as `evidenceTail`, one layer up and for a different reason. The
+ * classifier reads the message *before* this cut, so this one cannot change a
+ * published status — it can only leave a record asserting `not-applicable` with
+ * the sentence that justifies it deleted, which is a claim published without its
+ * evidence. `windows-mcp` sits at exactly the cap today, so the margin here is
+ * one character of growth in somebody else's error message.
+ */
+export function clampNotes(text, limit, required) {
+    if (text.length <= limit)
+        return text;
+    const plain = text.slice(0, limit);
+    if (!required)
+        return plain;
+    const needle = required.toLowerCase();
+    if (plain.toLowerCase().includes(needle))
+        return plain;
+    const at = text.toLowerCase().indexOf(needle);
+    if (at < 0)
+        return plain;
+    const room = Math.max(0, limit - ELISION.length);
+    const width = Math.min(room, Math.max(needle.length, Math.floor(room / 2)));
+    const start = Math.max(0, Math.min(at - Math.floor((width - needle.length) / 2), text.length - width));
+    return text.slice(0, Math.max(0, room - width)) + ELISION + text.slice(start, start + width);
+}
+/**
+ * Drop matching lines, keeping the input whole if that would leave nothing.
+ *
+ * `isProtected` outranks `isNoise`: safari-mcp declares `EBADPLATFORM`, which npm
+ * prints on a line of its own, and a filter that reaches it first would delete
+ * the evidence before any budget was even applied.
+ */
+function drop(text, isNoise, isProtected = () => false) {
     const kept = text
         .split('\n')
-        .filter((l) => !isNoise(l.trim()))
+        .filter((l) => isProtected(l.trim()) || !isNoise(l.trim()))
         .join('\n')
         .trim();
     return kept || text.trim();
 }
 export class McpStdioClient {
+    keepEvidence;
     child;
     buffer = '';
     nextId = 1;
     pending = new Map();
     stderrChunks = [];
     exited;
-    constructor(command, args, env) {
+    constructor(command, args, env, 
+    /** Phrase this entry's declared status depends on — see `evidenceTail`. */
+    keepEvidence) {
+        this.keepEvidence = keepEvidence;
         this.child = spawn(command, args, {
             env: { ...env },
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -123,7 +247,7 @@ export class McpStdioClient {
                 resolve();
             });
             this.child.on('exit', (code) => {
-                const tail = evidenceTail(this.stderrTail);
+                const tail = evidenceTail(this.stderrTail, undefined, this.keepEvidence);
                 this.deadReason = `server exited (code ${code})${tail ? `; stderr tail: ${tail}` : ''}`;
                 for (const p of this.pending.values())
                     p.reject(new Error(this.deadReason));
@@ -185,7 +309,7 @@ export class McpStdioClient {
                 // without this a timed-out record carries no evidence at all — it says
                 // only that we waited. What the server managed to print before it
                 // stopped answering is usually the whole explanation.
-                const tail = evidenceTail(this.stderrTail);
+                const tail = evidenceTail(this.stderrTail, undefined, this.keepEvidence);
                 reject(new Error(`timeout after ${timeoutMs}ms waiting for ${method}${tail ? `; stderr tail: ${tail}` : ''}`));
             }, timeoutMs);
             this.pending.set(id, {
@@ -222,11 +346,7 @@ export class McpStdioClient {
 export async function captureTools(spec, opts = {}) {
     const timeoutMs = opts.timeoutMs ?? 60_000;
     const [cmd, ...args] = typeof spec === 'string' ? splitCommand(spec) : [spec.command, ...spec.argv];
-    const client = new McpStdioClient(cmd, args, {
-        PATH: process.env.PATH,
-        HOME: process.env.HOME,
-        ...opts.env,
-    });
+    const client = new McpStdioClient(cmd, args, { PATH: process.env.PATH, HOME: process.env.HOME, ...opts.env }, opts.keepEvidence);
     try {
         const init = await client.request('initialize', {
             protocolVersion: PROTOCOL_VERSION,

package/dist/sweep/cross-check.js

@@ -28,7 +28,7 @@ import { homedir, tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { parse } from 'yaml';
-import { measureServer } from './run.js';
+import { isSelfContainerised, measureServer } from './run.js';
 import { DockerHarnessFault, defaultImageFor, dockerize } from './docker.js';
 import { splitCommand } from './client.js';
 import { selectShard, shardIndexForDate } from './shard.js';
@@ -305,7 +305,7 @@ if (isMain) {
                 console.log(`  ${e.name}: our measurement ${m.status} — recorded, nothing to compare`);
                 continue;
             }
-            const selfDocker = e.command.trimStart().startsWith('docker ');
+            const selfDocker = isSelfContainerised(e.command);
             const out = await runCli(docker && selfDocker ? await hostBin() : binPath, e, {
                 docker: docker && !selfDocker,
                 timeoutMs,

package/dist/sweep/pr-check.d.ts

@@ -0,0 +1,62 @@
+import { type SchemaProblem } from './servers-schema.js';
+import type { ServerEntry } from './report.js';
+import type { Measurement } from '../core/types.js';
+/**
+ * The fields that change what a sweep launches — the option object
+ * sweep-all.ts hands to `measureServer`, plus the timeout it is given. A change
+ * to `metric`, `metricSource`, `category`, `repo`, `package` or `deprecated`
+ * changes a row's text, not its process, and is not re-measured here.
+ */
+export declare const LAUNCH_FIELDS: readonly ["command", "dockerImage", "aptPackages", "needsGit", "env", "envValues", "timeoutSeconds", "notApplicable"];
+/**
+ * How many entries one pull request may launch, at the default budget. The
+ * worst case per entry is a timeout retried on `TIMEOUT_RETRY_FACTOR` times
+ * its budget (run.ts:351-352), so at the workflow's `--default-timeout 240`
+ * one entry can hold the runner for 240 × (1 + 2) = 720s, and this many of
+ * them measured one at a time is what pr-check.yml's `timeout-minutes` is
+ * sized to (`launchBudgetSeconds`).
+ *
+ * The count alone does not hold that bound. An entry's own `timeoutSeconds`
+ * replaces the default (the rotation's rule, kept here), and the schema bounds
+ * it only below — "a whole number of seconds greater than zero"
+ * (servers-schema.ts:166-169) — so one added entry with `timeoutSeconds: 4000`
+ * would cost 12000s under the same count and be killed by the job limit with
+ * no line printed for it. The bound is held because the script also refuses,
+ * before any launch, a selection whose `worstCaseSeconds` exceeds the budget
+ * the count was sized to. A PR that trips either is asked to split or shorten,
+ * rather than have the runner cut it off with the last entries unmeasured and
+ * no line saying so.
+ */
+export declare const DEFAULT_MAX_ENTRIES = 4;
+/** The launched entries among a selection: remote endpoints and self-containerised commands are listed, not spawned. */
+export declare function launchedEntries(entries: ServerEntry[]): ServerEntry[];
+/**
+ * The most seconds a selection can hold the runner: each launched entry's own
+ * budget (`timeoutSeconds`, or the default) once, then `TIMEOUT_RETRY_FACTOR`
+ * times more on the retry. Listed entries cost nothing and are not counted.
+ */
+export declare function worstCaseSeconds(entries: ServerEntry[], defaultTimeout: number): number;
+/** What the job's `timeout-minutes` was sized to: `maxEntries` launches, each at the default budget and its retry. */
+export declare function launchBudgetSeconds(maxEntries: number, defaultTimeout: number): number;
+export interface ServersDiff {
+    /** Head fails the shape check; nothing is diffed from a malformed document. */
+    problems: SchemaProblem[];
+    /** Names present in head and absent from base. */
+    added: ServerEntry[];
+    /** Names in both whose `LAUNCH_FIELDS` projection differs. */
+    relaunched: ServerEntry[];
+}
+/** The part of an entry that decides what gets spawned, as one comparable string. */
+export declare function launchSignature(entry: ServerEntry): string;
+/**
+ * What a pull request adds or relaunches, given the parsed base and head
+ * documents. Head is shape-checked first and returns only problems when it has
+ * any. Base is the committed branch, which `npm test` already holds valid; an
+ * unreadable base is treated as empty, which makes every head entry "added"
+ * and lets the entry cap refuse the run rather than measuring the whole file.
+ */
+export declare function entriesToMeasure(base: unknown, head: unknown): ServersDiff;
+/** The line printed for a launched entry — sweep-all's summary form, with the evidence behind a failure. */
+export declare function summarise(name: string, m: Measurement, secs: number): string;
+/** Whether an outcome fails the check. */
+export declare function failsCheck(status: Measurement['status']): boolean;