mcp-context-cost 0.13.2 → 0.15.0

package/README.md

@@ -60,11 +60,22 @@ claude-desktop  ~/Library/Application Support/Claude/claude_desktop_config.json
 ```
 
 It finds configs for Claude Desktop, Claude Code (`~/.claude.json`, `.mcp.json`), Cursor,
-VS Code (`.vscode/mcp.json`), and Windsurf — or pass `--config <path>`. Servers are measured
-by the same path as the published leaderboard (dual `tools/list` capture, `o200k_base` over
+VS Code (`.vscode/mcp.json`), Windsurf, Codex CLI (`~/.codex/config.toml`), Gemini CLI
+(`~/.gemini/settings.json`), Zed (`context_servers`), Kiro (`~/.kiro/settings/mcp.json`) and
+Goose (`~/.config/goose/config.yaml`) — or pass `--config <path>`. Servers are measured by
+the same path as the published leaderboard (dual `tools/list` capture, `o200k_base` over
 canonical JSON), so a server in both places gets the same number. Nothing is written to your
 project, and env var **values** are never read into the output — only their names.
 
+A remote entry — `url`, or the client's own spelling of it — is first asked what it says to
+an unauthenticated `initialize`. An endpoint that answers is measured through the
+`mcp-remote` bridge, the path the leaderboard's remote rows already take. One that answers
+`401` or `403` is reported **auth-walled**, quoting the status and the `WWW-Authenticate`
+header it sent, with the URL: a working server this audit holds no credential for, so the
+total above it is a floor. One that answers nothing usable is **unreachable**, with the
+reason. Header values an entry carries are sent and never printed — only their names are —
+and nothing here ever opens a browser.
+
 Totals are reported per config file, never merged: a context window belongs to one client
 session, so summing Cursor's servers into Claude Desktop's total would describe a session
 nobody runs.
@@ -75,8 +86,9 @@ Not every client puts every tool definition in context on every request, so the
 is not automatically your bill. Which client reads the config, and how that client is
 configured **on this machine**, decides it — and `audit` reads that rather than assuming it.
 
-**Clients with no default deferral on record** — Claude Desktop, Cursor, VS Code, Windsurf.
-The total is what every request carries, as in the example above. That sentence is an
+**Clients with no default deferral on record** — Claude Desktop, Cursor, VS Code, Windsurf,
+Codex CLI, Gemini CLI, Zed, Kiro, Goose. The total is what every request carries, as in the
+example above. That sentence is an
 absence of a record about those clients, not a measurement of them, and the report says so
 in those words.
 
@@ -97,6 +109,7 @@ deferral off in a settings file is not a machine running the default:
 | `ANTHROPIC_BASE_URL` off `api.anthropic.com` | falls back to loading up front — consulted only while `ENABLE_TOOL_SEARCH` is unset |
 | anything else in `ENABLE_TOOL_SEARCH` | not a documented value, so nothing is claimed from it |
 | any of the three set, in a settings `env` block, to something that is not a string — a JSON boolean, a number, `null` | it is set there and what it is set to is unknown, so no posture is claimed: the report says whether these tokens are deferred cannot be said from it |
+| a server pinned `"alwaysLoad": true` in its entry | loads at session start whatever the setting says — read from the entry, named with its tokens, and left out of any threshold comparison |
 
 On a machine where none of them is set, the same stack reads:
 
@@ -114,7 +127,7 @@ On a machine where none of them is set, the same stack reads:
     a Microsoft Foundry deployment hosted on Azure, which rejects tool search server-side
     Google Cloud's Agent Platform on a model earlier than the Claude 4.5 generation
     a model without support for tool_reference blocks (before Sonnet 4.5 / Haiku 4.5 / Opus 4.5)
-    a server pinned with "alwaysLoad": true, whose tools load at session start regardless
+    a tool whose _meta carries "anthropic/alwaysLoad": true, which this audit does not read from a capture
 ```
 
 Set `ENABLE_TOOL_SEARCH=false` in that shell and the same config reports the opposite —
@@ -133,7 +146,7 @@ settings file exists and cannot be read, when the place that would decide sets t
 to something that is not a string, and when `ENABLE_TOOL_SEARCH` holds a value Claude Code
 does not document; and it will not pass an absence of a record off as a measurement. The
 first two print as unanswered questions. The third prints as an answer that names
-itself: for the four discovered clients with no default on record — `claude-desktop`, `cursor`, `vscode`, `windsurf` — the tokens are counted as
+itself: for the nine discovered clients with no default on record — `claude-desktop`, `cursor`, `vscode`, `windsurf`, `codex`, `gemini`, `zed`, `kiro`, `goose` — the tokens are counted as
 loaded up front, and the report says so in those words, "an absence of a record about the
 client, not a measurement of it".
 Full model, sources and dates: [METHODOLOGY §who pays the number](docs/METHODOLOGY.md#who-pays).
@@ -271,7 +284,7 @@ sample of that range; the full range is in
 | filesystem (reference) | 2,823 | 14 |
 | markitdown | 64 | 1 |
 
-*(87 of 106 popular servers measured, each row dated by its own most recent sweep — full table in
+*(87 of 107 popular servers measured, each row dated by its own most recent sweep — full table in
 [results/leaderboard.md](results/leaderboard.md); every failure is listed with its reason.
 Each measured server also has a [detail page](https://athakur3.github.io/mcp-context-cost/servers/)
 showing which tools its tokens are in.)*
@@ -344,12 +357,12 @@ number is *not*, config policy, failure taxonomy, frozen color bands, known dive
 |---|---|
 | `src/core/` | the measurement spec, executable — canonical form, tokenizer, bands, badge JSON |
 | `src/sweep/` | raw-wire MCP stdio client + Dockerized batch sweep + leaderboard/dashboard generators |
-| `src/audit/` | client-config discovery (5 clients, JSONC-tolerant), the per-stack report, and the baseline diff |
+| `src/audit/` | client-config discovery (10 clients; JSON with comments, TOML, YAML), the remote probe, the per-stack report, and the baseline diff |
 | `src/cli.ts` | `audit` (measure your own stack), `verify` (re-derive any published number), `measure` |
 | `spec/fixtures/` | golden vectors shared by the TypeScript and bash implementations |
-| `tools/` | the one script that calls a network API (Claude divergence); kept out of the package so the library stays offline |
+| `tools/` | the scripts that call a network API — the Claude divergence run, the adoption reading, the registry scan — kept out of the package so the library stays offline |
 | `upstream/` | `badge.sh` + composite-action patch + bash tests — the self-serve badge recipe, carried here |
-| `servers.yaml` | 106 curated candidates with live install metrics and provenance |
+| `servers.yaml` | 107 curated candidates with live install metrics and provenance |
 | `results/` · `badges/` | measurements, leaderboard, history series, shields endpoint JSONs |
 | `docs/` | methodology, dashboard, and a generated page per measured server |
 
@@ -357,11 +370,26 @@ number is *not*, config policy, failure taxonomy, frozen color bands, known dive
 
 ```bash
 npm ci
-npm run sweep -- --name my-server --command "npx -y my-mcp-server"
-cat badges/my-server.json   # strict shields.io endpoint JSON
+npm run sweep -- --no-persist --name my-server --command "npx -y my-mcp-server"
 ```
 
-Then in your README:
+That prints the number and writes nothing. Published records
+(`results/<name>/measurement.json`, `badges/<name>.json`, the `history.csv`
+row) come from CI: a developer machine is a different architecture under
+different load, and a measurement taken there describes it rather than the
+server. `local-mcp`'s failing record was made on an arm64 laptop, and its
+stderr named an architecture the record itself did not — which is why every
+measurement now records `isolation.arch`. The entry turned out to be
+unavailable on both architectures, and a record that says where it was made
+is what lets that be told from a broken server. To get your server into the
+leaderboard, add an entry to `servers.yaml` and open a pull request; the check
+on that PR measures the entry read-only, and the rotation publishes it after
+merge.
+
+For a badge on your own README, run the published CLI in your server's own CI
+(the [gate](#defend-the-number-dont-just-display-it) below writes
+`results/my-server/measurement.json` and `badges/my-server.json` into that
+repository), then in your README:
 
 ```markdown
 [![context cost](https://img.shields.io/endpoint?url=<raw URL of badges/my-server.json>)](<link target>)
@@ -455,6 +483,7 @@ public, one click each:
 [re-sweep runs](https://github.com/athakur3/mcp-context-cost/actions/workflows/resweep.yml)
 and [self-badge runs](https://github.com/athakur3/mcp-context-cost/actions/workflows/self-badge.yml).
 See [ROADMAP.md](ROADMAP.md) for what's next — contributions welcome, especially new
-`servers.yaml` entries.
+`servers.yaml` entries; [CONTRIBUTING.md](CONTRIBUTING.md) says what an entry needs, the
+order of steps that leaves a pull request green, and where its number comes from.
 
 MIT © 2026

package/dist/audit/audit.d.ts

@@ -3,10 +3,20 @@ import { type ToolShapeBaseline, type ToolSuggestion } from '../core/tool-shape.
 import { type CaptureIndex, type CaptureVerdict } from '../core/capture-index.js';
 import type { Measurement, MeasurementStatus, ToolMeasurement } from '../core/types.js';
 import type { ConfiguredServer, LoadedConfig } from './config.js';
+import type { RemoteProbe } from './remote.js';
 import { type DeferralVerdict, type ToolSearchEnv, type ToolSearchSource } from './deferral.js';
 import { type AuditDiff, type IncreaseGate } from './diff.js';
 export declare const DEFAULT_CONTEXT_WINDOW = 200000;
-export type AuditStatus = MeasurementStatus | 'remote-not-measurable';
+/**
+ * A server's status in a report: the measurement statuses, plus two that only
+ * a remote endpoint can have. `auth-walled` — it answered the unauthenticated
+ * `initialize` with 401 or 403: it works, and it wants a credential this audit
+ * does not hold. `unreachable` — no MCP answer came back at all: a connection
+ * failure, a timeout, or a status that is neither an answer nor a wall. Before
+ * 2026-09-06 every `url` entry was `remote-not-measurable`, which said nothing
+ * about the endpoint and under-counted exactly the stacks the audit is for.
+ */
+export type AuditStatus = MeasurementStatus | 'auth-walled' | 'unreachable';
 export interface AuditServerResult {
     name: string;
     transport: 'stdio' | 'remote';
@@ -19,6 +29,10 @@ export interface AuditServerResult {
     url?: string;
     /** Names only — a server's env values never enter a report. */
     envVarNames: string[];
+    /** Names only, and only for a remote entry that carries any — values never enter a report. */
+    headerNames?: string[];
+    /** Claude Code's `alwaysLoad: true`, read from the entry: loads at session start whatever the setting. */
+    alwaysLoad?: true;
     canonicalSha256?: string | null;
     /**
      * Anthropic-request cost from the published Claude divergence run, only when
@@ -227,6 +241,12 @@ export declare function buildReport(configs: LoadedConfig[], measured: Map<strin
      * the report says, rather than reporting a default it did not establish.
      */
     settings?: ToolSearchSource[];
+    /**
+     * What each remote endpoint said to an unauthenticated `initialize`, keyed
+     * by `serverKey`. `runAudit` supplies it from `probeRemotes`; omitted, a
+     * remote entry is reported as not probed rather than as anything else.
+     */
+    remotes?: Map<string, RemoteProbe>;
 }): AuditReport;
 /** Human output. JSON output is the report object itself. */
 export declare function formatReport(report: AuditReport): string;

package/dist/audit/audit.js

@@ -85,7 +85,30 @@ export function serverKey(s) {
  */
 function envSignature(s) {
     const env = s.env ?? {};
-    return JSON.stringify(Object.keys(env).sort().map((k) => [k, env[k]]));
+    const headers = s.headers ?? {};
+    return JSON.stringify([
+        Object.keys(env).sort().map((k) => [k, env[k]]),
+        // A remote's headers decide what it serves the way env decides for a
+        // process: a bearer token selects an account, and an account its tools.
+        Object.keys(headers).sort().map((k) => [k, headers[k]]),
+    ]);
+}
+/**
+ * Every value an entry would spawn or send — env values, header values — so
+ * that none of them reaches a report by way of a server's own stderr. Values
+ * shorter than four characters are left alone: replacing every "1" in a
+ * message is not redaction.
+ */
+function secrets(s) {
+    return [...Object.values(s.env ?? {}), ...Object.values(s.headers ?? {})].filter((v) => v.length >= 4);
+}
+function redact(text, values) {
+    if (!text)
+        return text;
+    let out = text;
+    for (const v of values)
+        out = out.split(v).join('<redacted>');
+    return out;
 }
 /**
  * The measurement keys that stand for more than one distinct server.
@@ -105,8 +128,6 @@ export function collapsedKeys(configs) {
         if (cfg.error)
             continue;
         for (const s of cfg.servers) {
-            if (s.transport !== 'stdio')
-                continue;
             const key = serverKey(s);
             const seen = envs.get(key);
             if (seen)
@@ -160,7 +181,12 @@ function attachDeferral(configs, contextWindow, opts) {
         evaluateDeferral({
             client: group[0].client,
             sources: group.map((c) => c.source),
-            servers: group.flatMap((c) => c.servers.map((s) => ({ tokens: s.tokens ?? 0, claudeTokens: s.claudeTokens }))),
+            servers: group.flatMap((c) => c.servers.map((s) => ({
+                name: s.name,
+                tokens: s.tokens ?? 0,
+                claudeTokens: s.claudeTokens,
+                ...(s.alwaysLoad ? { alwaysLoad: true } : {}),
+            }))),
             skippedCount: group.reduce((a, c) => a + c.skipped.length, 0),
             sharedMeasurements: group.reduce((a, c) => a + (opts.shared.get(c) ?? 0), 0),
         }, { contextWindow, env: opts.env, settings: opts.settings, divergence: opts.divergence }));
@@ -219,17 +245,34 @@ export function buildReport(configs, measured, opts = {}) {
                 command: s.command,
                 url: s.url,
                 envVarNames: s.envVarNames,
+                ...(s.headerNames?.length ? { headerNames: s.headerNames } : {}),
+                ...(s.alwaysLoad ? { alwaysLoad: true } : {}),
             };
+            const none = { tokens: null, toolCount: null, share: null };
             if (s.transport === 'remote') {
-                skipped.push({
-                    ...base,
-                    status: 'remote-not-measurable',
-                    tokens: null,
-                    toolCount: null,
-                    share: null,
-                    notes: `remote endpoint (${s.url ?? 'url'}) — stdio measurement does not apply`,
-                });
-                continue;
+                const probe = opts.remotes?.get(serverKey(s));
+                if (!probe) {
+                    skipped.push({ ...base, ...none, status: 'unreachable', notes: `${s.url ?? 'url'} — not probed` });
+                    continue;
+                }
+                if (probe.kind === 'auth-walled') {
+                    // The server's own words: the status it sent and the header it named
+                    // its authorization server with. A wall is a working server this
+                    // audit holds no credential for; the session that holds one pays
+                    // this server on top of the total below, which is therefore a floor.
+                    skipped.push({
+                        ...base,
+                        ...none,
+                        status: 'auth-walled',
+                        notes: `${s.url} answered ${probe.detail} — wants a credential this audit does not hold`,
+                    });
+                    continue;
+                }
+                if (probe.kind === 'unreachable') {
+                    skipped.push({ ...base, ...none, status: 'unreachable', notes: `${s.url}: ${probe.detail}` });
+                    continue;
+                }
+                // Open: measured through the bridge, and read below like any launch.
             }
             const m = measured.get(serverKey(s));
             if (!m) {
@@ -243,7 +286,7 @@ export function buildReport(configs, measured, opts = {}) {
                     tokens: null,
                     toolCount: null,
                     share: null,
-                    notes: m.notes?.split('\n')[0]?.slice(0, 200),
+                    notes: redact(m.notes?.split('\n')[0]?.slice(0, 200), secrets(s)),
                 });
                 continue;
             }
@@ -258,7 +301,7 @@ export function buildReport(configs, measured, opts = {}) {
                 share: null, // filled once the total is known
                 canonicalSha256: m.canonicalSha256,
                 claudeTokens: opts.divergence ? (isCurrent(divRow, m.canonicalSha256 ?? null) ? divRow.claudeDelta : null) : undefined,
-                notes: m.status === 'dynamic' ? m.notes : undefined,
+                notes: m.status === 'dynamic' ? redact(m.notes, secrets(s)) : undefined,
             });
             for (const t of m.tools) {
                 tools.push({ server: s.name, tool: t.name, tokens: t.tokens });
@@ -330,8 +373,11 @@ export function buildReport(configs, measured, opts = {}) {
         // server that failed to start contributes 0, so the stack reads lighter
         // than it is and the budget passes on a number that is missing a server —
         // exactly the PR the README says this gate catches. The server-level gate
-        // (core/server-diff.ts) already refuses this; so does this one now.
-        const unestablished = results.flatMap((c) => c.skipped.filter((s) => s.status !== 'remote-not-measurable').map((s) => `${c.source}: ${s.name} (${s.status})`));
+        // (core/server-diff.ts) already refuses this; so does this one now. Every
+        // skipped row counts: an auth-walled endpoint is a working server the
+        // session pays for with its credential, and an unreachable one is a cost
+        // this could not establish, not a cost of zero.
+        const unestablished = results.flatMap((c) => c.skipped.map((s) => `${c.source}: ${s.name} (${s.status})`));
         const over = (worst?.totalTokens ?? 0) > opts.budget;
         report.budget = {
             limit: opts.budget,
@@ -480,6 +526,14 @@ function deferralLines(d, skippedNames) {
             lines.push(`    ${s}`);
         lines.push('  so they face the question below together, as their sum.');
     }
+    // Read from the entries, so it is stated up front rather than listed among
+    // the conditions a reader has to check: whatever the setting says, these load.
+    if (d.mechanism === 'tool search' && d.alwaysLoad.servers.length) {
+        const n = d.alwaysLoad.servers.length;
+        lines.push(`  ${n} server${n === 1 ? ' is' : 's are'} pinned "alwaysLoad": true and load${n === 1 ? 's' : ''} at session start whatever`);
+        lines.push(`  the setting says: ${d.alwaysLoad.servers.join(', ')} — ${d.alwaysLoad.tokens.toLocaleString()} wire tokens,`);
+        lines.push('  left out of any threshold comparison below.');
+    }
     if (d.mode === 'client-unknown') {
         lines.push('  Which client reads this config is not known here, so whether it defers');
         lines.push('  tool definitions by default is not known either. Read as loaded up front.');

package/dist/audit/config.d.ts

@@ -13,8 +13,19 @@ export interface ConfiguredServer {
     envVarNames: string[];
     /** Values, needed to spawn the server. NEVER serialize this. */
     env?: Record<string, string>;
-    /** Remote endpoint — recorded so the report can say why it was skipped. */
+    /** Remote endpoint — probed, then measured through the bridge or reported as walled. */
     url?: string;
+    /** Names only — a remote entry's header values never enter a report. Absent means none. */
+    headerNames?: string[];
+    /** Values, sent with the probe and the bridge. NEVER serialize this. */
+    headers?: Record<string, string>;
+    /**
+     * Claude Code's `alwaysLoad: true`: this server's tools load at session
+     * start whatever the tool-search setting says (its MCP documentation, §"Exempt
+     * a server from deferral", read 2026-09-06). Read from the entry, so the
+     * deferral verdict can count it rather than list it as a condition.
+     */
+    alwaysLoad?: true;
 }
 /**
  * JSON with comments and trailing commas — VS Code's mcp.json allows both, and
@@ -31,6 +42,7 @@ export declare function extractServers(doc: unknown, meta: {
     client: string;
     source: string;
     cwd?: string;
+    env?: Record<string, string | undefined>;
 }): ConfiguredServer[];
 /**
  * What one config document declares, servers and switched-off entries both.
@@ -45,6 +57,7 @@ export declare function extractDeclaration(doc: unknown, meta: {
     client: string;
     source: string;
     cwd?: string;
+    env?: Record<string, string | undefined>;
 }): {
     servers: ConfiguredServer[];
     disabled: string[];
@@ -52,6 +65,8 @@ export declare function extractDeclaration(doc: unknown, meta: {
 export interface ConfigCandidate {
     client: string;
     path: string;
+    /** How the file is written. Absent means JSON, with comments and trailing commas tolerated. */
+    format?: 'json' | 'toml' | 'yaml';
 }
 /** Every place a client config is known to live, whether or not it exists. */
 export declare function configCandidates(env: {
@@ -60,6 +75,8 @@ export declare function configCandidates(env: {
     platform: NodeJS.Platform;
     appData?: string;
 }): ConfigCandidate[];
+/** Parse one config file's text in the format its candidate declares. */
+export declare function parseConfigText(text: string, format?: ConfigCandidate['format']): unknown;
 export interface LoadedConfig {
     client: string;
     source: string;
@@ -84,7 +101,7 @@ export interface LoadedConfig {
     allDisabled?: string[];
 }
 /** Read + parse the candidates that exist. Unreadable files are reported, not thrown. */
-export declare function loadConfigs(candidates: ConfigCandidate[], cwd: string): LoadedConfig[];
+export declare function loadConfigs(candidates: ConfigCandidate[], cwd: string, processEnv?: Record<string, string | undefined>): LoadedConfig[];
 /** One file Claude Code reads its `env` block from. */
 export interface SettingsCandidate {
     scope: ToolSearchScope;

package/dist/audit/config.js

@@ -3,21 +3,37 @@
  *
  * The leaderboard measures servers one at a time; `audit` measures the set a
  * person actually has installed. That set lives in a client config file, and
- * every client spells it slightly differently:
+ * every client spells it slightly differently — each shape below is the one
+ * its client's own documentation shows, read on the date given:
  *
- *   Claude Desktop / Claude Code / Cursor / Windsurf   { "mcpServers": { ... } }
- *   VS Code (.vscode/mcp.json)                         { "servers": { ... } }
- *   Claude Code (~/.claude.json)                       also { "projects": { "<dir>": { "mcpServers": ... } } }
+ *   Claude Desktop / Claude Code / Cursor / Windsurf / Kiro   { "mcpServers": { ... } }   JSON
+ *   VS Code (.vscode/mcp.json)                                { "servers": { ... } }      JSON
+ *   Claude Code (~/.claude.json)                              also { "projects": { "<dir>": { "mcpServers": ... } } }
+ *   Gemini CLI (~/.gemini/settings.json, 2026-09-06)          { "mcpServers": { ... } }, remotes as `url` (SSE) or `httpUrl`
+ *   Zed (~/.config/zed/settings.json, 2026-09-06)             { "context_servers": { ... } }, comments allowed
+ *   Codex CLI (~/.codex/config.toml, 2026-09-06)              [mcp_servers.<name>]         TOML
+ *   Goose (~/.config/goose/config.yaml, 2026-09-06)           extensions: { <name>: { type: stdio | streamable_http } }   YAML
+ *
+ * A remote is `url` in most files, `serverUrl` in Windsurf's, `httpUrl` or
+ * `url` in Gemini's, `uri` in Goose's. An entry is off under `disabled: true`
+ * (Claude, Cursor, Kiro), `enabled = false` (Codex, Goose), a name in Gemini's
+ * `mcp.excluded` list, or a name in the project's `disabledMcpServers` list in
+ * `~/.claude.json`.
  *
  * Everything here is pure (paths in, servers out) so the discovery rules are
  * testable without touching a real home directory.
  *
  * Env var VALUES are read (a server usually needs its key to start) but are
  * never written to a report: report builders pick fields explicitly and only
- * `envVarNames` is ever serialized.
+ * `envVarNames` is ever serialized. Header values a remote entry carries (a
+ * static bearer token, or one Codex sources from an environment variable by
+ * name) are held to the same rule: sent with the request, never reported —
+ * only `headerNames` is.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+import { parse as parseYaml } from 'yaml';
 import { TOOL_SEARCH_VARS, } from './deferral.js';
 /**
  * JSON with comments and trailing commas — VS Code's mcp.json allows both, and
@@ -78,23 +94,69 @@ export function parseJsonc(text) {
     }
     return JSON.parse(out);
 }
-function toServer(name, raw, client, source) {
-    if (raw.disabled === true)
+const firstString = (...vs) => vs.find((v) => typeof v === 'string' && v.trim() !== '');
+/**
+ * The headers a remote entry would send, by name and by value.
+ *
+ * Codex sources two of its forms from the environment by name
+ * (`bearer_token_env_var`, `env_http_headers`), so a name the config carries
+ * is recorded whether or not this process can see a value for it — the config
+ * says the header exists; only the process decides whether it can be sent.
+ */
+function collectHeaders(raw, processEnv) {
+    const values = {};
+    const names = new Set();
+    for (const block of [raw.headers, raw.http_headers]) {
+        for (const [k, v] of Object.entries(block ?? {})) {
+            names.add(k);
+            if (typeof v === 'string')
+                values[k] = v;
+        }
+    }
+    for (const [k, v] of Object.entries(raw.env_http_headers ?? {})) {
+        names.add(k);
+        const fromEnv = typeof v === 'string' ? processEnv[v] : undefined;
+        if (fromEnv !== undefined)
+            values[k] = fromEnv;
+    }
+    if (typeof raw.bearer_token_env_var === 'string') {
+        names.add('Authorization');
+        const token = processEnv[raw.bearer_token_env_var];
+        if (token !== undefined)
+            values.Authorization = `Bearer ${token}`;
+    }
+    return { names: [...names].sort(), values };
+}
+function toServer(name, raw, client, source, processEnv) {
+    if (raw.disabled === true || raw.enabled === false)
         return null;
     const env = {};
-    for (const [k, v] of Object.entries(raw.env ?? {})) {
+    for (const [k, v] of Object.entries(raw.env ?? raw.envs ?? {})) {
         if (typeof v === 'string')
             env[k] = v;
     }
     const envVarNames = Object.keys(env).sort();
-    // Remote entries carry a url (and sometimes type http/sse) instead of a command.
-    if (!raw.command && typeof raw.url === 'string') {
-        return { name, client, source, transport: 'remote', url: raw.url, envVarNames };
+    const pinned = raw.alwaysLoad === true ? { alwaysLoad: true } : {};
+    const command = firstString(raw.command, raw.cmd);
+    const url = firstString(raw.url, raw.serverUrl, raw.httpUrl, raw.uri);
+    // Remote entries carry an endpoint (and sometimes a type) instead of a command.
+    if (!command && url) {
+        const { names, values } = collectHeaders(raw, processEnv);
+        return {
+            name,
+            client,
+            source,
+            transport: 'remote',
+            url,
+            envVarNames,
+            ...(names.length ? { headerNames: names, headers: values } : {}),
+            ...pinned,
+        };
     }
-    if (typeof raw.command !== 'string' || raw.command.trim() === '')
+    if (!command)
         return null;
     const args = Array.isArray(raw.args) ? raw.args.filter((a) => typeof a === 'string') : [];
-    const argv = [raw.command, ...args];
+    const argv = [command, ...args];
     return {
         name,
         client,
@@ -105,6 +167,7 @@ function toServer(name, raw, client, source) {
         argv,
         envVarNames,
         env: envVarNames.length ? env : undefined,
+        ...pinned,
     };
 }
 /**
@@ -115,6 +178,9 @@ function toServer(name, raw, client, source) {
 export function extractServers(doc, meta) {
     return extractDeclaration(doc, meta).servers;
 }
+/** Goose extension types this file can launch; `builtin` and `platform` live inside goose itself. */
+const GOOSE_LAUNCHABLE = new Set(['stdio', 'streamable_http']);
+const stringList = (v) => Array.isArray(v) ? v.filter((x) => typeof x === 'string') : [];
 /**
  * What one config document declares, servers and switched-off entries both.
  *
@@ -130,29 +196,54 @@ export function extractDeclaration(doc, meta) {
     const d = doc;
     const out = [];
     const off = [];
-    const addBlock = (block) => {
+    const processEnv = meta.env ?? {};
+    // Names a list elsewhere in the same file switches off: Gemini's
+    // `mcp.excluded` ("Servers in this list will not be connected to"), and the
+    // per-project `disabledMcpServers` Claude Code writes into `~/.claude.json`
+    // when a server is toggled off in its /mcp panel (both read 2026-09-06).
+    const listedOff = new Set();
+    const mcp = d.mcp;
+    if (mcp && typeof mcp === 'object')
+        for (const n of stringList(mcp.excluded))
+            listedOff.add(n);
+    const project = meta.cwd && d.projects && typeof d.projects === 'object'
+        ? d.projects[meta.cwd]
+        : undefined;
+    if (project && typeof project === 'object')
+        for (const n of stringList(project.disabledMcpServers))
+            listedOff.add(n);
+    const addBlock = (block, launchable = () => true) => {
         if (!block || typeof block !== 'object')
             return;
         for (const [name, raw] of Object.entries(block)) {
             if (!raw || typeof raw !== 'object')
                 continue;
+            const entry = raw;
+            if (!launchable(entry))
+                continue;
             // Recorded before `toServer` drops it, which is the only difference this
             // can still see: an entry it returns null for because the person turned
             // it off, rather than because it is malformed or absent.
-            if (raw.disabled === true)
+            if (entry.disabled === true || entry.enabled === false || listedOff.has(name)) {
                 off.push(name);
-            const s = toServer(name, raw, meta.client, meta.source);
+                continue;
+            }
+            const s = toServer(name, entry, meta.client, meta.source, processEnv);
             if (s)
                 out.push(s);
         }
     };
     addBlock(d.mcpServers);
     addBlock(d.servers); // VS Code
-    if (meta.cwd && d.projects && typeof d.projects === 'object') {
-        const project = d.projects[meta.cwd];
-        if (project && typeof project === 'object')
-            addBlock(project.mcpServers);
-    }
+    // Zed: an `extension` entry is provided by an installed extension, and
+    // nothing in this file says how to launch it.
+    addBlock(d.context_servers, (raw) => raw.source !== 'extension');
+    addBlock(d.mcp_servers); // Codex
+    // Goose: only the two types that name a process or an endpoint are servers
+    // this file can reach; `builtin` and `platform` are goose's own.
+    addBlock(d.extensions, (raw) => typeof raw.type === 'string' && GOOSE_LAUNCHABLE.has(raw.type));
+    if (project && typeof project === 'object')
+        addBlock(project.mcpServers);
     // A name can legitimately appear in both blocks of the same file; keep the first.
     const seen = new Set();
     const servers = out.filter((s) => (seen.has(s.name) ? false : (seen.add(s.name), true)));
@@ -169,6 +260,14 @@ export function configCandidates(env) {
         : platform === 'win32'
             ? join(env.appData ?? join(home, 'AppData', 'Roaming'), 'Claude', 'claude_desktop_config.json')
             : join(home, '.config', 'Claude', 'claude_desktop_config.json');
+    // Paths each client's own documentation gives, read 2026-09-06. Zed's user
+    // settings path is documented for macOS and Linux only; Goose's Windows path
+    // is under %APPDATA%\Block\goose. A project-level file is nominated wherever
+    // the client documents one (Codex: trusted projects; Gemini, Zed, Kiro).
+    const appData = env.appData ?? join(home, 'AppData', 'Roaming');
+    const goose = platform === 'win32'
+        ? join(appData, 'Block', 'goose', 'config', 'config.yaml')
+        : join(home, '.config', 'goose', 'config.yaml');
     return [
         { client: 'claude-desktop', path: desktop },
         { client: 'claude-code', path: join(home, '.claude.json') },
@@ -177,10 +276,27 @@ export function configCandidates(env) {
         { client: 'cursor', path: join(cwd, '.cursor', 'mcp.json') },
         { client: 'vscode', path: join(cwd, '.vscode', 'mcp.json') },
         { client: 'windsurf', path: join(home, '.codeium', 'windsurf', 'mcp_config.json') },
+        { client: 'codex', path: join(home, '.codex', 'config.toml'), format: 'toml' },
+        { client: 'codex', path: join(cwd, '.codex', 'config.toml'), format: 'toml' },
+        { client: 'gemini', path: join(home, '.gemini', 'settings.json') },
+        { client: 'gemini', path: join(cwd, '.gemini', 'settings.json') },
+        ...(platform === 'win32' ? [] : [{ client: 'zed', path: join(home, '.config', 'zed', 'settings.json') }]),
+        { client: 'zed', path: join(cwd, '.zed', 'settings.json') },
+        { client: 'kiro', path: join(home, '.kiro', 'settings', 'mcp.json') },
+        { client: 'kiro', path: join(cwd, '.kiro', 'settings', 'mcp.json') },
+        { client: 'goose', path: goose, format: 'yaml' },
     ];
 }
+/** Parse one config file's text in the format its candidate declares. */
+export function parseConfigText(text, format = 'json') {
+    if (format === 'toml')
+        return parseToml(text);
+    if (format === 'yaml')
+        return parseYaml(text);
+    return parseJsonc(text);
+}
 /** Read + parse the candidates that exist. Unreadable files are reported, not thrown. */
-export function loadConfigs(candidates, cwd) {
+export function loadConfigs(candidates, cwd, processEnv = process.env) {
     const out = [];
     // Running from your home directory nominates `~/.cursor/mcp.json` twice —
     // once as the home candidate, once as the cwd one. Loaded twice it is
@@ -195,8 +311,8 @@ export function loadConfigs(candidates, cwd) {
             continue;
         seen.add(c.path);
         try {
-            const doc = parseJsonc(readFileSync(c.path, 'utf8'));
-            const { servers, disabled } = extractDeclaration(doc, { client: c.client, source: c.path, cwd });
+            const doc = parseConfigText(readFileSync(c.path, 'utf8'), c.format);
+            const { servers, disabled } = extractDeclaration(doc, { client: c.client, source: c.path, cwd, env: processEnv });
             // A config with no MCP block at all (e.g. a ~/.claude.json holding only
             // session history) is not worth a line in the report — it has no total.
             // It is still worth carrying: it is the evidence that a client is on this