mcp-context-cost 0.14.0 → 0.15.0

package/README.md

@@ -60,11 +60,22 @@ claude-desktop  ~/Library/Application Support/Claude/claude_desktop_config.json
 ```
 
 It finds configs for Claude Desktop, Claude Code (`~/.claude.json`, `.mcp.json`), Cursor,
-VS Code (`.vscode/mcp.json`), and Windsurf — or pass `--config <path>`. Servers are measured
-by the same path as the published leaderboard (dual `tools/list` capture, `o200k_base` over
+VS Code (`.vscode/mcp.json`), Windsurf, Codex CLI (`~/.codex/config.toml`), Gemini CLI
+(`~/.gemini/settings.json`), Zed (`context_servers`), Kiro (`~/.kiro/settings/mcp.json`) and
+Goose (`~/.config/goose/config.yaml`) — or pass `--config <path>`. Servers are measured by
+the same path as the published leaderboard (dual `tools/list` capture, `o200k_base` over
 canonical JSON), so a server in both places gets the same number. Nothing is written to your
 project, and env var **values** are never read into the output — only their names.
 
+A remote entry — `url`, or the client's own spelling of it — is first asked what it says to
+an unauthenticated `initialize`. An endpoint that answers is measured through the
+`mcp-remote` bridge, the path the leaderboard's remote rows already take. One that answers
+`401` or `403` is reported **auth-walled**, quoting the status and the `WWW-Authenticate`
+header it sent, with the URL: a working server this audit holds no credential for, so the
+total above it is a floor. One that answers nothing usable is **unreachable**, with the
+reason. Header values an entry carries are sent and never printed — only their names are —
+and nothing here ever opens a browser.
+
 Totals are reported per config file, never merged: a context window belongs to one client
 session, so summing Cursor's servers into Claude Desktop's total would describe a session
 nobody runs.
@@ -75,8 +86,9 @@ Not every client puts every tool definition in context on every request, so the
 is not automatically your bill. Which client reads the config, and how that client is
 configured **on this machine**, decides it — and `audit` reads that rather than assuming it.
 
-**Clients with no default deferral on record** — Claude Desktop, Cursor, VS Code, Windsurf.
-The total is what every request carries, as in the example above. That sentence is an
+**Clients with no default deferral on record** — Claude Desktop, Cursor, VS Code, Windsurf,
+Codex CLI, Gemini CLI, Zed, Kiro, Goose. The total is what every request carries, as in the
+example above. That sentence is an
 absence of a record about those clients, not a measurement of them, and the report says so
 in those words.
 
@@ -97,6 +109,7 @@ deferral off in a settings file is not a machine running the default:
 | `ANTHROPIC_BASE_URL` off `api.anthropic.com` | falls back to loading up front — consulted only while `ENABLE_TOOL_SEARCH` is unset |
 | anything else in `ENABLE_TOOL_SEARCH` | not a documented value, so nothing is claimed from it |
 | any of the three set, in a settings `env` block, to something that is not a string — a JSON boolean, a number, `null` | it is set there and what it is set to is unknown, so no posture is claimed: the report says whether these tokens are deferred cannot be said from it |
+| a server pinned `"alwaysLoad": true` in its entry | loads at session start whatever the setting says — read from the entry, named with its tokens, and left out of any threshold comparison |
 
 On a machine where none of them is set, the same stack reads:
 
@@ -114,7 +127,7 @@ On a machine where none of them is set, the same stack reads:
     a Microsoft Foundry deployment hosted on Azure, which rejects tool search server-side
     Google Cloud's Agent Platform on a model earlier than the Claude 4.5 generation
     a model without support for tool_reference blocks (before Sonnet 4.5 / Haiku 4.5 / Opus 4.5)
-    a server pinned with "alwaysLoad": true, whose tools load at session start regardless
+    a tool whose _meta carries "anthropic/alwaysLoad": true, which this audit does not read from a capture
 ```
 
 Set `ENABLE_TOOL_SEARCH=false` in that shell and the same config reports the opposite —
@@ -133,7 +146,7 @@ settings file exists and cannot be read, when the place that would decide sets t
 to something that is not a string, and when `ENABLE_TOOL_SEARCH` holds a value Claude Code
 does not document; and it will not pass an absence of a record off as a measurement. The
 first two print as unanswered questions. The third prints as an answer that names
-itself: for the four discovered clients with no default on record — `claude-desktop`, `cursor`, `vscode`, `windsurf` — the tokens are counted as
+itself: for the nine discovered clients with no default on record — `claude-desktop`, `cursor`, `vscode`, `windsurf`, `codex`, `gemini`, `zed`, `kiro`, `goose` — the tokens are counted as
 loaded up front, and the report says so in those words, "an absence of a record about the
 client, not a measurement of it".
 Full model, sources and dates: [METHODOLOGY §who pays the number](docs/METHODOLOGY.md#who-pays).
@@ -344,7 +357,7 @@ number is *not*, config policy, failure taxonomy, frozen color bands, known dive
 |---|---|
 | `src/core/` | the measurement spec, executable — canonical form, tokenizer, bands, badge JSON |
 | `src/sweep/` | raw-wire MCP stdio client + Dockerized batch sweep + leaderboard/dashboard generators |
-| `src/audit/` | client-config discovery (5 clients, JSONC-tolerant), the per-stack report, and the baseline diff |
+| `src/audit/` | client-config discovery (10 clients; JSON with comments, TOML, YAML), the remote probe, the per-stack report, and the baseline diff |
 | `src/cli.ts` | `audit` (measure your own stack), `verify` (re-derive any published number), `measure` |
 | `spec/fixtures/` | golden vectors shared by the TypeScript and bash implementations |
 | `tools/` | the scripts that call a network API — the Claude divergence run, the adoption reading, the registry scan — kept out of the package so the library stays offline |

package/dist/audit/audit.d.ts

@@ -3,10 +3,20 @@ import { type ToolShapeBaseline, type ToolSuggestion } from '../core/tool-shape.
 import { type CaptureIndex, type CaptureVerdict } from '../core/capture-index.js';
 import type { Measurement, MeasurementStatus, ToolMeasurement } from '../core/types.js';
 import type { ConfiguredServer, LoadedConfig } from './config.js';
+import type { RemoteProbe } from './remote.js';
 import { type DeferralVerdict, type ToolSearchEnv, type ToolSearchSource } from './deferral.js';
 import { type AuditDiff, type IncreaseGate } from './diff.js';
 export declare const DEFAULT_CONTEXT_WINDOW = 200000;
-export type AuditStatus = MeasurementStatus | 'remote-not-measurable';
+/**
+ * A server's status in a report: the measurement statuses, plus two that only
+ * a remote endpoint can have. `auth-walled` — it answered the unauthenticated
+ * `initialize` with 401 or 403: it works, and it wants a credential this audit
+ * does not hold. `unreachable` — no MCP answer came back at all: a connection
+ * failure, a timeout, or a status that is neither an answer nor a wall. Before
+ * 2026-09-06 every `url` entry was `remote-not-measurable`, which said nothing
+ * about the endpoint and under-counted exactly the stacks the audit is for.
+ */
+export type AuditStatus = MeasurementStatus | 'auth-walled' | 'unreachable';
 export interface AuditServerResult {
     name: string;
     transport: 'stdio' | 'remote';
@@ -19,6 +29,10 @@ export interface AuditServerResult {
     url?: string;
     /** Names only — a server's env values never enter a report. */
     envVarNames: string[];
+    /** Names only, and only for a remote entry that carries any — values never enter a report. */
+    headerNames?: string[];
+    /** Claude Code's `alwaysLoad: true`, read from the entry: loads at session start whatever the setting. */
+    alwaysLoad?: true;
     canonicalSha256?: string | null;
     /**
      * Anthropic-request cost from the published Claude divergence run, only when
@@ -227,6 +241,12 @@ export declare function buildReport(configs: LoadedConfig[], measured: Map<strin
      * the report says, rather than reporting a default it did not establish.
      */
     settings?: ToolSearchSource[];
+    /**
+     * What each remote endpoint said to an unauthenticated `initialize`, keyed
+     * by `serverKey`. `runAudit` supplies it from `probeRemotes`; omitted, a
+     * remote entry is reported as not probed rather than as anything else.
+     */
+    remotes?: Map<string, RemoteProbe>;
 }): AuditReport;
 /** Human output. JSON output is the report object itself. */
 export declare function formatReport(report: AuditReport): string;

package/dist/audit/audit.js

@@ -85,7 +85,30 @@ export function serverKey(s) {
  */
 function envSignature(s) {
     const env = s.env ?? {};
-    return JSON.stringify(Object.keys(env).sort().map((k) => [k, env[k]]));
+    const headers = s.headers ?? {};
+    return JSON.stringify([
+        Object.keys(env).sort().map((k) => [k, env[k]]),
+        // A remote's headers decide what it serves the way env decides for a
+        // process: a bearer token selects an account, and an account its tools.
+        Object.keys(headers).sort().map((k) => [k, headers[k]]),
+    ]);
+}
+/**
+ * Every value an entry would spawn or send — env values, header values — so
+ * that none of them reaches a report by way of a server's own stderr. Values
+ * shorter than four characters are left alone: replacing every "1" in a
+ * message is not redaction.
+ */
+function secrets(s) {
+    return [...Object.values(s.env ?? {}), ...Object.values(s.headers ?? {})].filter((v) => v.length >= 4);
+}
+function redact(text, values) {
+    if (!text)
+        return text;
+    let out = text;
+    for (const v of values)
+        out = out.split(v).join('<redacted>');
+    return out;
 }
 /**
  * The measurement keys that stand for more than one distinct server.
@@ -105,8 +128,6 @@ export function collapsedKeys(configs) {
         if (cfg.error)
             continue;
         for (const s of cfg.servers) {
-            if (s.transport !== 'stdio')
-                continue;
             const key = serverKey(s);
             const seen = envs.get(key);
             if (seen)
@@ -160,7 +181,12 @@ function attachDeferral(configs, contextWindow, opts) {
         evaluateDeferral({
             client: group[0].client,
             sources: group.map((c) => c.source),
-            servers: group.flatMap((c) => c.servers.map((s) => ({ tokens: s.tokens ?? 0, claudeTokens: s.claudeTokens }))),
+            servers: group.flatMap((c) => c.servers.map((s) => ({
+                name: s.name,
+                tokens: s.tokens ?? 0,
+                claudeTokens: s.claudeTokens,
+                ...(s.alwaysLoad ? { alwaysLoad: true } : {}),
+            }))),
             skippedCount: group.reduce((a, c) => a + c.skipped.length, 0),
             sharedMeasurements: group.reduce((a, c) => a + (opts.shared.get(c) ?? 0), 0),
         }, { contextWindow, env: opts.env, settings: opts.settings, divergence: opts.divergence }));
@@ -219,17 +245,34 @@ export function buildReport(configs, measured, opts = {}) {
                 command: s.command,
                 url: s.url,
                 envVarNames: s.envVarNames,
+                ...(s.headerNames?.length ? { headerNames: s.headerNames } : {}),
+                ...(s.alwaysLoad ? { alwaysLoad: true } : {}),
             };
+            const none = { tokens: null, toolCount: null, share: null };
             if (s.transport === 'remote') {
-                skipped.push({
-                    ...base,
-                    status: 'remote-not-measurable',
-                    tokens: null,
-                    toolCount: null,
-                    share: null,
-                    notes: `remote endpoint (${s.url ?? 'url'}) — stdio measurement does not apply`,
-                });
-                continue;
+                const probe = opts.remotes?.get(serverKey(s));
+                if (!probe) {
+                    skipped.push({ ...base, ...none, status: 'unreachable', notes: `${s.url ?? 'url'} — not probed` });
+                    continue;
+                }
+                if (probe.kind === 'auth-walled') {
+                    // The server's own words: the status it sent and the header it named
+                    // its authorization server with. A wall is a working server this
+                    // audit holds no credential for; the session that holds one pays
+                    // this server on top of the total below, which is therefore a floor.
+                    skipped.push({
+                        ...base,
+                        ...none,
+                        status: 'auth-walled',
+                        notes: `${s.url} answered ${probe.detail} — wants a credential this audit does not hold`,
+                    });
+                    continue;
+                }
+                if (probe.kind === 'unreachable') {
+                    skipped.push({ ...base, ...none, status: 'unreachable', notes: `${s.url}: ${probe.detail}` });
+                    continue;
+                }
+                // Open: measured through the bridge, and read below like any launch.
             }
             const m = measured.get(serverKey(s));
             if (!m) {
@@ -243,7 +286,7 @@ export function buildReport(configs, measured, opts = {}) {
                     tokens: null,
                     toolCount: null,
                     share: null,
-                    notes: m.notes?.split('\n')[0]?.slice(0, 200),
+                    notes: redact(m.notes?.split('\n')[0]?.slice(0, 200), secrets(s)),
                 });
                 continue;
             }
@@ -258,7 +301,7 @@ export function buildReport(configs, measured, opts = {}) {
                 share: null, // filled once the total is known
                 canonicalSha256: m.canonicalSha256,
                 claudeTokens: opts.divergence ? (isCurrent(divRow, m.canonicalSha256 ?? null) ? divRow.claudeDelta : null) : undefined,
-                notes: m.status === 'dynamic' ? m.notes : undefined,
+                notes: m.status === 'dynamic' ? redact(m.notes, secrets(s)) : undefined,
             });
             for (const t of m.tools) {
                 tools.push({ server: s.name, tool: t.name, tokens: t.tokens });
@@ -330,8 +373,11 @@ export function buildReport(configs, measured, opts = {}) {
         // server that failed to start contributes 0, so the stack reads lighter
         // than it is and the budget passes on a number that is missing a server —
         // exactly the PR the README says this gate catches. The server-level gate
-        // (core/server-diff.ts) already refuses this; so does this one now.
-        const unestablished = results.flatMap((c) => c.skipped.filter((s) => s.status !== 'remote-not-measurable').map((s) => `${c.source}: ${s.name} (${s.status})`));
+        // (core/server-diff.ts) already refuses this; so does this one now. Every
+        // skipped row counts: an auth-walled endpoint is a working server the
+        // session pays for with its credential, and an unreachable one is a cost
+        // this could not establish, not a cost of zero.
+        const unestablished = results.flatMap((c) => c.skipped.map((s) => `${c.source}: ${s.name} (${s.status})`));
         const over = (worst?.totalTokens ?? 0) > opts.budget;
         report.budget = {
             limit: opts.budget,
@@ -480,6 +526,14 @@ function deferralLines(d, skippedNames) {
             lines.push(`    ${s}`);
         lines.push('  so they face the question below together, as their sum.');
     }
+    // Read from the entries, so it is stated up front rather than listed among
+    // the conditions a reader has to check: whatever the setting says, these load.
+    if (d.mechanism === 'tool search' && d.alwaysLoad.servers.length) {
+        const n = d.alwaysLoad.servers.length;
+        lines.push(`  ${n} server${n === 1 ? ' is' : 's are'} pinned "alwaysLoad": true and load${n === 1 ? 's' : ''} at session start whatever`);
+        lines.push(`  the setting says: ${d.alwaysLoad.servers.join(', ')} — ${d.alwaysLoad.tokens.toLocaleString()} wire tokens,`);
+        lines.push('  left out of any threshold comparison below.');
+    }
     if (d.mode === 'client-unknown') {
         lines.push('  Which client reads this config is not known here, so whether it defers');
         lines.push('  tool definitions by default is not known either. Read as loaded up front.');

package/dist/audit/config.d.ts

@@ -13,8 +13,19 @@ export interface ConfiguredServer {
     envVarNames: string[];
     /** Values, needed to spawn the server. NEVER serialize this. */
     env?: Record<string, string>;
-    /** Remote endpoint — recorded so the report can say why it was skipped. */
+    /** Remote endpoint — probed, then measured through the bridge or reported as walled. */
     url?: string;
+    /** Names only — a remote entry's header values never enter a report. Absent means none. */
+    headerNames?: string[];
+    /** Values, sent with the probe and the bridge. NEVER serialize this. */
+    headers?: Record<string, string>;
+    /**
+     * Claude Code's `alwaysLoad: true`: this server's tools load at session
+     * start whatever the tool-search setting says (its MCP documentation, §"Exempt
+     * a server from deferral", read 2026-09-06). Read from the entry, so the
+     * deferral verdict can count it rather than list it as a condition.
+     */
+    alwaysLoad?: true;
 }
 /**
  * JSON with comments and trailing commas — VS Code's mcp.json allows both, and
@@ -31,6 +42,7 @@ export declare function extractServers(doc: unknown, meta: {
     client: string;
     source: string;
     cwd?: string;
+    env?: Record<string, string | undefined>;
 }): ConfiguredServer[];
 /**
  * What one config document declares, servers and switched-off entries both.
@@ -45,6 +57,7 @@ export declare function extractDeclaration(doc: unknown, meta: {
     client: string;
     source: string;
     cwd?: string;
+    env?: Record<string, string | undefined>;
 }): {
     servers: ConfiguredServer[];
     disabled: string[];
@@ -52,6 +65,8 @@ export declare function extractDeclaration(doc: unknown, meta: {
 export interface ConfigCandidate {
     client: string;
     path: string;
+    /** How the file is written. Absent means JSON, with comments and trailing commas tolerated. */
+    format?: 'json' | 'toml' | 'yaml';
 }
 /** Every place a client config is known to live, whether or not it exists. */
 export declare function configCandidates(env: {
@@ -60,6 +75,8 @@ export declare function configCandidates(env: {
     platform: NodeJS.Platform;
     appData?: string;
 }): ConfigCandidate[];
+/** Parse one config file's text in the format its candidate declares. */
+export declare function parseConfigText(text: string, format?: ConfigCandidate['format']): unknown;
 export interface LoadedConfig {
     client: string;
     source: string;
@@ -84,7 +101,7 @@ export interface LoadedConfig {
     allDisabled?: string[];
 }
 /** Read + parse the candidates that exist. Unreadable files are reported, not thrown. */
-export declare function loadConfigs(candidates: ConfigCandidate[], cwd: string): LoadedConfig[];
+export declare function loadConfigs(candidates: ConfigCandidate[], cwd: string, processEnv?: Record<string, string | undefined>): LoadedConfig[];
 /** One file Claude Code reads its `env` block from. */
 export interface SettingsCandidate {
     scope: ToolSearchScope;

package/dist/audit/config.js

@@ -3,21 +3,37 @@
  *
  * The leaderboard measures servers one at a time; `audit` measures the set a
  * person actually has installed. That set lives in a client config file, and
- * every client spells it slightly differently:
+ * every client spells it slightly differently — each shape below is the one
+ * its client's own documentation shows, read on the date given:
  *
- *   Claude Desktop / Claude Code / Cursor / Windsurf   { "mcpServers": { ... } }
- *   VS Code (.vscode/mcp.json)                         { "servers": { ... } }
- *   Claude Code (~/.claude.json)                       also { "projects": { "<dir>": { "mcpServers": ... } } }
+ *   Claude Desktop / Claude Code / Cursor / Windsurf / Kiro   { "mcpServers": { ... } }   JSON
+ *   VS Code (.vscode/mcp.json)                                { "servers": { ... } }      JSON
+ *   Claude Code (~/.claude.json)                              also { "projects": { "<dir>": { "mcpServers": ... } } }
+ *   Gemini CLI (~/.gemini/settings.json, 2026-09-06)          { "mcpServers": { ... } }, remotes as `url` (SSE) or `httpUrl`
+ *   Zed (~/.config/zed/settings.json, 2026-09-06)             { "context_servers": { ... } }, comments allowed
+ *   Codex CLI (~/.codex/config.toml, 2026-09-06)              [mcp_servers.<name>]         TOML
+ *   Goose (~/.config/goose/config.yaml, 2026-09-06)           extensions: { <name>: { type: stdio | streamable_http } }   YAML
+ *
+ * A remote is `url` in most files, `serverUrl` in Windsurf's, `httpUrl` or
+ * `url` in Gemini's, `uri` in Goose's. An entry is off under `disabled: true`
+ * (Claude, Cursor, Kiro), `enabled = false` (Codex, Goose), a name in Gemini's
+ * `mcp.excluded` list, or a name in the project's `disabledMcpServers` list in
+ * `~/.claude.json`.
  *
  * Everything here is pure (paths in, servers out) so the discovery rules are
  * testable without touching a real home directory.
  *
  * Env var VALUES are read (a server usually needs its key to start) but are
  * never written to a report: report builders pick fields explicitly and only
- * `envVarNames` is ever serialized.
+ * `envVarNames` is ever serialized. Header values a remote entry carries (a
+ * static bearer token, or one Codex sources from an environment variable by
+ * name) are held to the same rule: sent with the request, never reported —
+ * only `headerNames` is.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { parse as parseToml } from 'smol-toml';
+import { parse as parseYaml } from 'yaml';
 import { TOOL_SEARCH_VARS, } from './deferral.js';
 /**
  * JSON with comments and trailing commas — VS Code's mcp.json allows both, and
@@ -78,23 +94,69 @@ export function parseJsonc(text) {
     }
     return JSON.parse(out);
 }
-function toServer(name, raw, client, source) {
-    if (raw.disabled === true)
+const firstString = (...vs) => vs.find((v) => typeof v === 'string' && v.trim() !== '');
+/**
+ * The headers a remote entry would send, by name and by value.
+ *
+ * Codex sources two of its forms from the environment by name
+ * (`bearer_token_env_var`, `env_http_headers`), so a name the config carries
+ * is recorded whether or not this process can see a value for it — the config
+ * says the header exists; only the process decides whether it can be sent.
+ */
+function collectHeaders(raw, processEnv) {
+    const values = {};
+    const names = new Set();
+    for (const block of [raw.headers, raw.http_headers]) {
+        for (const [k, v] of Object.entries(block ?? {})) {
+            names.add(k);
+            if (typeof v === 'string')
+                values[k] = v;
+        }
+    }
+    for (const [k, v] of Object.entries(raw.env_http_headers ?? {})) {
+        names.add(k);
+        const fromEnv = typeof v === 'string' ? processEnv[v] : undefined;
+        if (fromEnv !== undefined)
+            values[k] = fromEnv;
+    }
+    if (typeof raw.bearer_token_env_var === 'string') {
+        names.add('Authorization');
+        const token = processEnv[raw.bearer_token_env_var];
+        if (token !== undefined)
+            values.Authorization = `Bearer ${token}`;
+    }
+    return { names: [...names].sort(), values };
+}
+function toServer(name, raw, client, source, processEnv) {
+    if (raw.disabled === true || raw.enabled === false)
         return null;
     const env = {};
-    for (const [k, v] of Object.entries(raw.env ?? {})) {
+    for (const [k, v] of Object.entries(raw.env ?? raw.envs ?? {})) {
         if (typeof v === 'string')
             env[k] = v;
     }
     const envVarNames = Object.keys(env).sort();
-    // Remote entries carry a url (and sometimes type http/sse) instead of a command.
-    if (!raw.command && typeof raw.url === 'string') {
-        return { name, client, source, transport: 'remote', url: raw.url, envVarNames };
+    const pinned = raw.alwaysLoad === true ? { alwaysLoad: true } : {};
+    const command = firstString(raw.command, raw.cmd);
+    const url = firstString(raw.url, raw.serverUrl, raw.httpUrl, raw.uri);
+    // Remote entries carry an endpoint (and sometimes a type) instead of a command.
+    if (!command && url) {
+        const { names, values } = collectHeaders(raw, processEnv);
+        return {
+            name,
+            client,
+            source,
+            transport: 'remote',
+            url,
+            envVarNames,
+            ...(names.length ? { headerNames: names, headers: values } : {}),
+            ...pinned,
+        };
     }
-    if (typeof raw.command !== 'string' || raw.command.trim() === '')
+    if (!command)
         return null;
     const args = Array.isArray(raw.args) ? raw.args.filter((a) => typeof a === 'string') : [];
-    const argv = [raw.command, ...args];
+    const argv = [command, ...args];
     return {
         name,
         client,
@@ -105,6 +167,7 @@ function toServer(name, raw, client, source) {
         argv,
         envVarNames,
         env: envVarNames.length ? env : undefined,
+        ...pinned,
     };
 }
 /**
@@ -115,6 +178,9 @@ function toServer(name, raw, client, source) {
 export function extractServers(doc, meta) {
     return extractDeclaration(doc, meta).servers;
 }
+/** Goose extension types this file can launch; `builtin` and `platform` live inside goose itself. */
+const GOOSE_LAUNCHABLE = new Set(['stdio', 'streamable_http']);
+const stringList = (v) => Array.isArray(v) ? v.filter((x) => typeof x === 'string') : [];
 /**
  * What one config document declares, servers and switched-off entries both.
  *
@@ -130,29 +196,54 @@ export function extractDeclaration(doc, meta) {
     const d = doc;
     const out = [];
     const off = [];
-    const addBlock = (block) => {
+    const processEnv = meta.env ?? {};
+    // Names a list elsewhere in the same file switches off: Gemini's
+    // `mcp.excluded` ("Servers in this list will not be connected to"), and the
+    // per-project `disabledMcpServers` Claude Code writes into `~/.claude.json`
+    // when a server is toggled off in its /mcp panel (both read 2026-09-06).
+    const listedOff = new Set();
+    const mcp = d.mcp;
+    if (mcp && typeof mcp === 'object')
+        for (const n of stringList(mcp.excluded))
+            listedOff.add(n);
+    const project = meta.cwd && d.projects && typeof d.projects === 'object'
+        ? d.projects[meta.cwd]
+        : undefined;
+    if (project && typeof project === 'object')
+        for (const n of stringList(project.disabledMcpServers))
+            listedOff.add(n);
+    const addBlock = (block, launchable = () => true) => {
         if (!block || typeof block !== 'object')
             return;
         for (const [name, raw] of Object.entries(block)) {
             if (!raw || typeof raw !== 'object')
                 continue;
+            const entry = raw;
+            if (!launchable(entry))
+                continue;
             // Recorded before `toServer` drops it, which is the only difference this
             // can still see: an entry it returns null for because the person turned
             // it off, rather than because it is malformed or absent.
-            if (raw.disabled === true)
+            if (entry.disabled === true || entry.enabled === false || listedOff.has(name)) {
                 off.push(name);
-            const s = toServer(name, raw, meta.client, meta.source);
+                continue;
+            }
+            const s = toServer(name, entry, meta.client, meta.source, processEnv);
             if (s)
                 out.push(s);
         }
     };
     addBlock(d.mcpServers);
     addBlock(d.servers); // VS Code
-    if (meta.cwd && d.projects && typeof d.projects === 'object') {
-        const project = d.projects[meta.cwd];
-        if (project && typeof project === 'object')
-            addBlock(project.mcpServers);
-    }
+    // Zed: an `extension` entry is provided by an installed extension, and
+    // nothing in this file says how to launch it.
+    addBlock(d.context_servers, (raw) => raw.source !== 'extension');
+    addBlock(d.mcp_servers); // Codex
+    // Goose: only the two types that name a process or an endpoint are servers
+    // this file can reach; `builtin` and `platform` are goose's own.
+    addBlock(d.extensions, (raw) => typeof raw.type === 'string' && GOOSE_LAUNCHABLE.has(raw.type));
+    if (project && typeof project === 'object')
+        addBlock(project.mcpServers);
     // A name can legitimately appear in both blocks of the same file; keep the first.
     const seen = new Set();
     const servers = out.filter((s) => (seen.has(s.name) ? false : (seen.add(s.name), true)));
@@ -169,6 +260,14 @@ export function configCandidates(env) {
         : platform === 'win32'
             ? join(env.appData ?? join(home, 'AppData', 'Roaming'), 'Claude', 'claude_desktop_config.json')
             : join(home, '.config', 'Claude', 'claude_desktop_config.json');
+    // Paths each client's own documentation gives, read 2026-09-06. Zed's user
+    // settings path is documented for macOS and Linux only; Goose's Windows path
+    // is under %APPDATA%\Block\goose. A project-level file is nominated wherever
+    // the client documents one (Codex: trusted projects; Gemini, Zed, Kiro).
+    const appData = env.appData ?? join(home, 'AppData', 'Roaming');
+    const goose = platform === 'win32'
+        ? join(appData, 'Block', 'goose', 'config', 'config.yaml')
+        : join(home, '.config', 'goose', 'config.yaml');
     return [
         { client: 'claude-desktop', path: desktop },
         { client: 'claude-code', path: join(home, '.claude.json') },
@@ -177,10 +276,27 @@ export function configCandidates(env) {
         { client: 'cursor', path: join(cwd, '.cursor', 'mcp.json') },
         { client: 'vscode', path: join(cwd, '.vscode', 'mcp.json') },
         { client: 'windsurf', path: join(home, '.codeium', 'windsurf', 'mcp_config.json') },
+        { client: 'codex', path: join(home, '.codex', 'config.toml'), format: 'toml' },
+        { client: 'codex', path: join(cwd, '.codex', 'config.toml'), format: 'toml' },
+        { client: 'gemini', path: join(home, '.gemini', 'settings.json') },
+        { client: 'gemini', path: join(cwd, '.gemini', 'settings.json') },
+        ...(platform === 'win32' ? [] : [{ client: 'zed', path: join(home, '.config', 'zed', 'settings.json') }]),
+        { client: 'zed', path: join(cwd, '.zed', 'settings.json') },
+        { client: 'kiro', path: join(home, '.kiro', 'settings', 'mcp.json') },
+        { client: 'kiro', path: join(cwd, '.kiro', 'settings', 'mcp.json') },
+        { client: 'goose', path: goose, format: 'yaml' },
     ];
 }
+/** Parse one config file's text in the format its candidate declares. */
+export function parseConfigText(text, format = 'json') {
+    if (format === 'toml')
+        return parseToml(text);
+    if (format === 'yaml')
+        return parseYaml(text);
+    return parseJsonc(text);
+}
 /** Read + parse the candidates that exist. Unreadable files are reported, not thrown. */
-export function loadConfigs(candidates, cwd) {
+export function loadConfigs(candidates, cwd, processEnv = process.env) {
     const out = [];
     // Running from your home directory nominates `~/.cursor/mcp.json` twice —
     // once as the home candidate, once as the cwd one. Loaded twice it is
@@ -195,8 +311,8 @@ export function loadConfigs(candidates, cwd) {
             continue;
         seen.add(c.path);
         try {
-            const doc = parseJsonc(readFileSync(c.path, 'utf8'));
-            const { servers, disabled } = extractDeclaration(doc, { client: c.client, source: c.path, cwd });
+            const doc = parseConfigText(readFileSync(c.path, 'utf8'), c.format);
+            const { servers, disabled } = extractDeclaration(doc, { client: c.client, source: c.path, cwd, env: processEnv });
             // A config with no MCP block at all (e.g. a ~/.claude.json holding only
             // session history) is not worth a line in the report — it has no total.
             // It is still worth carrying: it is the evidence that a client is on this

package/dist/audit/deferral.d.ts

@@ -37,11 +37,34 @@
  *     generation; `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` "keeps tool search
  *     off. You can't override it by setting `ENABLE_TOOL_SEARCH` yourself."
  *     A server with `alwaysLoad: true` loads at session start regardless.
+ *   - The same page, re-read 2026-09-06 (the roadmap's dated re-read). The
+ *     value table stands as quoted, and four things moved around it:
+ *     (1) on Google Cloud's Agent Platform, tool search is on by default for
+ *     the Claude 4.5 generation and later "the same as on the Anthropic API"
+ *     — "Before v2.1.221, Claude Code disabled tool search for all models on
+ *     Google Cloud's Agent Platform unless you set ENABLE_TOOL_SEARCH=true";
+ *     the exception below already names only the earlier models. (2) Under
+ *     `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS`, "your organization can keep
+ *     tool search on through managed settings, on Claude Code v2.1.227 or
+ *     later" — on a direct connection or a gateway, not on a cloud provider.
+ *     This audit reads the managed settings file for the three variables and
+ *     nothing else, so that override is not read here and the variable is
+ *     still resolved as "off". (3) `alwaysLoad: true` is an entry field on
+ *     every server type, and a tool can carry `"anthropic/alwaysLoad": true`
+ *     in its `_meta`. The entry form is read from the config now
+ *     (`DeferralServer.alwaysLoad`) and counted rather than listed; the
+ *     per-tool form is still a listed condition. (4) "Claude Code truncates
+ *     tool descriptions and server instructions at 2KB each", which bounds what
+ *     a deferring session loads at start — noted beside the session-start
+ *     metric in METHODOLOGY, not applied to any number here.
  *
- * No default deferral is on record here for the other four clients this tool
- * discovers. That is an absence of a record, not a measurement of those
- * clients, and it is printed as such — the same rule the rest of this project
- * follows for a value it has not observed.
+ * No default deferral is on record here for the other clients this tool
+ * discovers — Claude Desktop, Cursor, VS Code, Windsurf, and from 2026-09-06
+ * Codex CLI, Gemini CLI, Zed, Kiro and Goose, whose configuration pages were
+ * read that day and say nothing about deferring tool definitions. That is an
+ * absence of a record, not a measurement of those clients, and it is printed
+ * as such — the same rule the rest of this project follows for a value it has
+ * not observed.
  */
 import type { DivergenceRun } from '../core/divergence.js';
 /** Share of the context window at which deferral activates under `auto`. */
@@ -267,8 +290,17 @@ export declare const PUBLISHED_WIRE_TO_CLIENT_RATIO: WireToClientRatio;
 export declare function wireToClientRatio(run?: DivergenceRun | null): WireToClientRatio;
 /** One measured server, as the deferral arithmetic needs it. */
 export interface DeferralServer {
+    /** For naming the servers a verdict singles out; the arithmetic never reads it. */
+    name?: string;
     /** o200k tokens over the wire capture — the audit's own unit. */
     tokens: number;
+    /**
+     * The entry is pinned `alwaysLoad: true`, so its tools load at session start
+     * whatever the tool-search setting says, and it does not count toward a
+     * threshold — the documented `auto` mode counts "the tools it would
+     * otherwise defer".
+     */
+    alwaysLoad?: boolean;
     /**
      * Anthropic's own count for this server from a current divergence row, when
      * `--claude` supplied one. `null` means no current match, `undefined` means
@@ -367,6 +399,15 @@ export interface DeferralVerdict {
     sharedMeasurements: number;
     /** Conditions this cannot read, under which a deferring client pays in full. */
     exceptions: string[];
+    /**
+     * Servers in this scope pinned `alwaysLoad: true` in their entry, and their
+     * wire tokens. Read from the config, so it is stated rather than listed as a
+     * condition: whatever the mode, these load at session start.
+     */
+    alwaysLoad: {
+        servers: string[];
+        tokens: number;
+    };
 }
 /**
  * Read one session's deferral position. Pure arithmetic over a built scope — no

package/dist/audit/deferral.js

@@ -286,8 +286,23 @@ export function wireToClientRatio(run) {
         return PUBLISHED_WIRE_TO_CLIENT_RATIO;
     return { low, high, fixedOverhead, servers, source: `the ${run.measuredAt} ${run.model} divergence run` };
 }
-/** Clients this tool discovers that have no default deferral on record. */
-const NO_DEFERRAL_ON_RECORD = new Set(['claude-desktop', 'cursor', 'vscode', 'windsurf']);
+/**
+ * Clients this tool discovers that have no default deferral on record. Each
+ * client's own MCP configuration page was read on the date config.ts gives
+ * and says nothing about deferring tool definitions — Windsurf's states a cap
+ * of 100 tools, which is a different thing and not a deferral.
+ */
+const NO_DEFERRAL_ON_RECORD = new Set([
+    'claude-desktop',
+    'cursor',
+    'vscode',
+    'windsurf',
+    'codex',
+    'gemini',
+    'zed',
+    'kiro',
+    'goose',
+]);
 /**
  * Where deferral does not apply even when the machine's setting says it should.
  * None of these can be read from the config or the environment, so they are
@@ -298,7 +313,7 @@ const EXCEPTIONS = [
     'a Microsoft Foundry deployment hosted on Azure, which rejects tool search server-side',
     "Google Cloud's Agent Platform on a model earlier than the Claude 4.5 generation",
     'a model without support for tool_reference blocks (before Sonnet 4.5 / Haiku 4.5 / Opus 4.5)',
-    'a server pinned with "alwaysLoad": true, whose tools load at session start regardless',
+    'a tool whose _meta carries "anthropic/alwaysLoad": true, which this audit does not read from a capture',
 ];
 function estimate(servers, ratio) {
     let low = 0;
@@ -341,6 +356,11 @@ export function evaluateDeferral(scope, opts) {
     const wireTokens = scope.servers.reduce((a, s) => a + s.tokens, 0);
     const isFloor = scope.skippedCount > 0;
     const sharedMeasurements = scope.sharedMeasurements;
+    const pinned = scope.servers.filter((s) => s.alwaysLoad === true);
+    const alwaysLoad = {
+        servers: pinned.map((s) => s.name ?? '(unnamed)'),
+        tokens: pinned.reduce((a, s) => a + s.tokens, 0),
+    };
     // Every field a verdict carries, at its "nothing to say" value. Each mode
     // below overrides only what it can actually answer.
     const base = {
@@ -364,6 +384,7 @@ export function evaluateDeferral(scope, opts) {
         distanceTokens: null,
         crosses: null,
         exceptions: [],
+        alwaysLoad,
     };
     if (scope.client !== 'claude-code') {
         return {
@@ -422,7 +443,9 @@ export function evaluateDeferral(scope, opts) {
         };
     }
     const ratio = wireToClientRatio(opts.divergence);
-    const clientTokens = estimate(scope.servers, ratio);
+    // Only what the client would otherwise defer is held against the threshold;
+    // a pinned server loads either way and is not part of the question.
+    const clientTokens = estimate(scope.servers.filter((s) => s.alwaysLoad !== true), ratio);
     // At-or-above, on the documented "defers all of them once the definitions
     // reach 10%". A range that is entirely over is over even if it is a floor:
     // more unmeasured tokens cannot take it back under.

package/dist/audit/remote.d.ts

@@ -0,0 +1,56 @@
+/**
+ * What a remote MCP endpoint says to a request that carries no credential.
+ *
+ * `audit` used to skip every `url` entry as `remote-not-measurable`, which
+ * under-counted exactly the stacks the audit is for — vendors are moving to
+ * hosted endpoints. The obvious fix, handing every url to the `mcp-remote`
+ * bridge the sweep already measures open endpoints through, is wrong on a
+ * developer machine: against an OAuth-walled endpoint mcp-remote opens a
+ * browser window and waits for the callback (its README says so), which an
+ * audit has no business doing once per server in someone's config; and in a
+ * headless run it waits until this harness's timeout, so the row would read
+ * `timeout` — a word that blames the clock for a credential.
+ *
+ * So the endpoint is asked first, with the request every MCP session begins
+ * with: `initialize` over streamable HTTP, then a GET with an event-stream
+ * `accept` for an SSE endpoint that refuses POST. Probed 2026-09-06 from this
+ * repository: `mcp.linear.app/mcp`, `mcp.zapier.com/api/mcp/mcp` and
+ * `mcp.vercel.com` each answer `401` with a `WWW-Authenticate: Bearer …`
+ * header naming the OAuth resource; `mcp.deepwiki.com/mcp`, `learn.microsoft.com/api/mcp`,
+ * `docs.mcp.cloudflare.com/sse` and `huggingface.co/mcp` answer `200` with a
+ * session or a stream. Nothing is inferred from a hostname: the status line
+ * and the header are the server's own words, and the report quotes them.
+ *
+ * Only an endpoint that answered without a credential is handed to the
+ * bridge, so the bridge never has a reason to open a browser. Header VALUES a
+ * config carries (a static bearer token) are sent with the probe and the
+ * bridge, exactly as env values are spawned into a stdio server, and never
+ * written to a report — see `ConfiguredServer.headers` in config.ts.
+ */
+export interface RemoteProbe {
+    /**
+     * `open`: answered the unauthenticated request as an MCP endpoint does.
+     * `auth-walled`: answered 401 or 403 — it works, and it wants a credential
+     * this audit does not hold. `unreachable`: no MCP answer arrived — a
+     * connection failure, a timeout, or a status that is neither of the above.
+     */
+    kind: 'open' | 'auth-walled' | 'unreachable';
+    /** The HTTP status that decided it, when a response arrived at all. */
+    status?: number;
+    /** The `WWW-Authenticate` header, verbatim (clipped), when the server sent one. */
+    wwwAuthenticate?: string;
+    /** One line a report can print: the server's own words, or the failure's. */
+    detail: string;
+}
+/** What a probe waits for an answer, unless the caller says otherwise. */
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 15000;
+/**
+ * Ask one endpoint, once, and report what it said.
+ *
+ * Never throws: an endpoint this could not reach is a probe result, not a
+ * crash, because the audit goes on to the next server either way.
+ */
+export declare function probeRemote(url: string, opts?: {
+    headers?: Record<string, string>;
+    timeoutMs?: number;
+}): Promise<RemoteProbe>;

package/dist/audit/remote.js

@@ -0,0 +1,126 @@
+/**
+ * What a remote MCP endpoint says to a request that carries no credential.
+ *
+ * `audit` used to skip every `url` entry as `remote-not-measurable`, which
+ * under-counted exactly the stacks the audit is for — vendors are moving to
+ * hosted endpoints. The obvious fix, handing every url to the `mcp-remote`
+ * bridge the sweep already measures open endpoints through, is wrong on a
+ * developer machine: against an OAuth-walled endpoint mcp-remote opens a
+ * browser window and waits for the callback (its README says so), which an
+ * audit has no business doing once per server in someone's config; and in a
+ * headless run it waits until this harness's timeout, so the row would read
+ * `timeout` — a word that blames the clock for a credential.
+ *
+ * So the endpoint is asked first, with the request every MCP session begins
+ * with: `initialize` over streamable HTTP, then a GET with an event-stream
+ * `accept` for an SSE endpoint that refuses POST. Probed 2026-09-06 from this
+ * repository: `mcp.linear.app/mcp`, `mcp.zapier.com/api/mcp/mcp` and
+ * `mcp.vercel.com` each answer `401` with a `WWW-Authenticate: Bearer …`
+ * header naming the OAuth resource; `mcp.deepwiki.com/mcp`, `learn.microsoft.com/api/mcp`,
+ * `docs.mcp.cloudflare.com/sse` and `huggingface.co/mcp` answer `200` with a
+ * session or a stream. Nothing is inferred from a hostname: the status line
+ * and the header are the server's own words, and the report quotes them.
+ *
+ * Only an endpoint that answered without a credential is handed to the
+ * bridge, so the bridge never has a reason to open a browser. Header VALUES a
+ * config carries (a static bearer token) are sent with the probe and the
+ * bridge, exactly as env values are spawned into a stdio server, and never
+ * written to a report — see `ConfiguredServer.headers` in config.ts.
+ */
+/** The first request of every MCP session, which is all a probe needs to send. */
+const INITIALIZE = JSON.stringify({
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'initialize',
+    params: {
+        protocolVersion: '2025-06-18',
+        capabilities: {},
+        clientInfo: { name: 'mcp-context-cost', version: '0' },
+    },
+});
+/** Long enough to be quoted whole in a report, short enough not to be the report. */
+const CLIP = 300;
+const clip = (s) => {
+    const one = s.replace(/\s+/g, ' ').trim();
+    return one.length > CLIP ? `${one.slice(0, CLIP)}…` : one;
+};
+/** What a probe waits for an answer, unless the caller says otherwise. */
+export const DEFAULT_PROBE_TIMEOUT_MS = 15_000;
+/**
+ * Ask one endpoint, once, and report what it said.
+ *
+ * Never throws: an endpoint this could not reach is a probe result, not a
+ * crash, because the audit goes on to the next server either way.
+ */
+export async function probeRemote(url, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+    const configured = opts.headers ?? {};
+    const attempt = async (init) => {
+        const res = await fetch(url, { ...init, signal: AbortSignal.timeout(timeoutMs), redirect: 'follow' });
+        // The headers are the answer. The body is not read — an event stream
+        // stays open for the life of a session, and this is not a session.
+        try {
+            await res.body?.cancel();
+        }
+        catch {
+            /* a body that refuses to be cancelled changes nothing the headers said */
+        }
+        return res;
+    };
+    try {
+        let res = await attempt({
+            method: 'POST',
+            headers: {
+                ...configured,
+                'content-type': 'application/json',
+                accept: 'application/json, text/event-stream',
+                'mcp-protocol-version': '2025-06-18',
+            },
+            body: INITIALIZE,
+        });
+        // The older SSE transport opens its stream on GET and may refuse the POST
+        // outright; an endpoint that does is asked the way it expects to be.
+        if (res.status === 404 || res.status === 405) {
+            res = await attempt({ method: 'GET', headers: { ...configured, accept: 'text/event-stream' } });
+        }
+        return classify(res);
+    }
+    catch (e) {
+        return { kind: 'unreachable', detail: describeFailure(e, timeoutMs) };
+    }
+}
+function classify(res) {
+    const www = res.headers.get('www-authenticate');
+    const type = (res.headers.get('content-type') ?? '').split(';')[0].trim().toLowerCase();
+    if (res.status === 401 || res.status === 403) {
+        return {
+            kind: 'auth-walled',
+            status: res.status,
+            ...(www ? { wwwAuthenticate: clip(www) } : {}),
+            detail: `HTTP ${res.status}${www ? ` — WWW-Authenticate: ${clip(www)}` : ''}`,
+        };
+    }
+    if (res.ok) {
+        // A JSON-RPC answer or an event stream is what an MCP endpoint sends. A
+        // 200 carrying HTML is a login page or a docs site at that address.
+        if (type === 'application/json' || type === 'text/event-stream') {
+            return { kind: 'open', status: res.status, detail: `HTTP ${res.status} ${type}` };
+        }
+        return {
+            kind: 'unreachable',
+            status: res.status,
+            detail: `HTTP ${res.status} with ${type || 'no content-type'}, which is not an MCP response`,
+        };
+    }
+    return { kind: 'unreachable', status: res.status, detail: `HTTP ${res.status}` };
+}
+function describeFailure(e, timeoutMs) {
+    const err = e;
+    if (err?.name === 'TimeoutError' || err?.name === 'AbortError')
+        return `no answer within ${timeoutMs}ms`;
+    // Node's fetch wraps the socket error: "fetch failed" with the code underneath.
+    const code = err?.cause?.code;
+    if (code)
+        return code;
+    return err?.cause?.message ?? err?.message ?? String(e);
+}

package/dist/audit/run.d.ts

@@ -4,7 +4,8 @@ import { type ToolShapeBaseline } from '../core/tool-shape.js';
 import { type CaptureIndex } from '../core/capture-index.js';
 import { type AuditReport } from './audit.js';
 import { type ToolSearchEnv, type ToolSearchSource } from './deferral.js';
-import { type LoadedConfig } from './config.js';
+import { type RemoteProbe } from './remote.js';
+import { type ConfiguredServer, type LoadedConfig } from './config.js';
 /** Where the published `tools-delta/v1` run lives when `--claude` doesn't override it. */
 export declare const DEFAULT_DIVERGENCE_URL = "https://raw.githubusercontent.com/athakur3/mcp-context-cost/main/results/divergence.json";
 /** Where the published `tool-shape/v1` baseline lives when `--suggest` doesn't override it. */
@@ -45,6 +46,12 @@ export interface AuditOptions {
      * those files off the machine being audited (`discoverSettings`).
      */
     settings?: ToolSearchSource[];
+    /**
+     * What each remote endpoint said to an unauthenticated `initialize`, keyed
+     * like `measureAll`'s map. `runAudit` probes them (`probeRemotes`); a test can
+     * state the answers instead of reaching a network.
+     */
+    remotes?: Map<string, RemoteProbe>;
     onProgress?: (name: string, done: number, total: number) => void;
 }
 /** Fetch and parse the published capture index. Never throws: a failure is a report problem, not a crash. */
@@ -72,6 +79,29 @@ export declare function discover(opts?: AuditOptions): LoadedConfig[];
  * launched this audit answers for the wrong machine.
  */
 export declare function discoverSettings(opts?: AuditOptions): ToolSearchSource[];
-/** Measure every distinct stdio server across the given configs, once each. */
+/**
+ * Ask every distinct remote endpoint what it says to an unauthenticated
+ * `initialize`, once each. This comes before any launch — remote.ts says why an
+ * endpoint is asked before the bridge is pointed at it.
+ */
+export declare function probeRemotes(configs: LoadedConfig[], opts?: AuditOptions): Promise<Map<string, RemoteProbe>>;
+/**
+ * The bridge launch for an endpoint that answered without a credential.
+ *
+ * `argv` is exact, for the host path; `command` is the same launch as one
+ * shell line, for the docker path, which runs it through `sh -lc` (docker.ts).
+ * Both carry the entry's header values, as a stdio launch carries env values.
+ * `display` carries the names only, and is the form a report may print.
+ */
+export declare function bridgeLaunch(s: ConfiguredServer): {
+    argv: string[];
+    command: string;
+    display: string;
+};
+/**
+ * Measure every distinct server across the given configs, once each: each
+ * stdio server by its launch, and each remote endpoint the probe found open
+ * through the bridge. A walled or unreachable endpoint is not launched at all.
+ */
 export declare function measureAll(configs: LoadedConfig[], opts?: AuditOptions): Promise<Map<string, Measurement>>;
 export declare function runAudit(opts?: AuditOptions): Promise<AuditReport>;

package/dist/audit/run.js

@@ -11,6 +11,7 @@ import { parseToolShapeBaseline } from '../core/tool-shape.js';
 import { parseCaptureIndex } from '../core/capture-index.js';
 import { buildReport, serverKey } from './audit.js';
 import { toolSearchEnv } from './deferral.js';
+import { DEFAULT_PROBE_TIMEOUT_MS, probeRemote } from './remote.js';
 import { configCandidates, loadConfigs, loadSettingsSources, settingsCandidates, } from './config.js';
 /** Where the published `tools-delta/v1` run lives when `--claude` doesn't override it. */
 export const DEFAULT_DIVERGENCE_URL = 'https://raw.githubusercontent.com/athakur3/mcp-context-cost/main/results/divergence.json';
@@ -78,12 +79,63 @@ export function discoverSettings(opts = {}) {
     const home = opts.home ?? homedir();
     return loadSettingsSources(settingsCandidates({ home, cwd, platform: process.platform, programData: process.env.ProgramData }));
 }
-/** Measure every distinct stdio server across the given configs, once each. */
+/**
+ * Ask every distinct remote endpoint what it says to an unauthenticated
+ * `initialize`, once each. This comes before any launch — remote.ts says why an
+ * endpoint is asked before the bridge is pointed at it.
+ */
+export async function probeRemotes(configs, opts = {}) {
+    const unique = new Map();
+    for (const cfg of configs) {
+        for (const s of cfg.servers) {
+            if (s.transport !== 'remote' || !s.url)
+                continue;
+            if (!unique.has(serverKey(s)))
+                unique.set(serverKey(s), s);
+        }
+    }
+    const out = new Map();
+    // One HTTP exchange each; the launch timeout is the wrong bound for it.
+    const timeoutMs = Math.min(opts.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS, DEFAULT_PROBE_TIMEOUT_MS);
+    await Promise.all([...unique].map(async ([key, s]) => {
+        out.set(key, await probeRemote(s.url, { headers: s.headers, timeoutMs }));
+    }));
+    return out;
+}
+/**
+ * The bridge launch for an endpoint that answered without a credential.
+ *
+ * `argv` is exact, for the host path; `command` is the same launch as one
+ * shell line, for the docker path, which runs it through `sh -lc` (docker.ts).
+ * Both carry the entry's header values, as a stdio launch carries env values.
+ * `display` carries the names only, and is the form a report may print.
+ */
+export function bridgeLaunch(s) {
+    const url = s.url ?? '';
+    const argv = ['npx', '-y', 'mcp-remote', url];
+    const display = [...argv];
+    // mcp-remote refuses a plain-http endpoint unless told it is on purpose.
+    if (/^http:/i.test(url)) {
+        argv.push('--allow-http');
+        display.push('--allow-http');
+    }
+    for (const [k, v] of Object.entries(s.headers ?? {})) {
+        argv.push('--header', `${k}: ${v}`);
+        display.push('--header', k);
+    }
+    const shellQuote = (a) => (/^[A-Za-z0-9_@%+=:,./-]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`);
+    return { argv, command: argv.map(shellQuote).join(' '), display: display.join(' ') };
+}
+/**
+ * Measure every distinct server across the given configs, once each: each
+ * stdio server by its launch, and each remote endpoint the probe found open
+ * through the bridge. A walled or unreachable endpoint is not launched at all.
+ */
 export async function measureAll(configs, opts = {}) {
     const unique = new Map();
     for (const cfg of configs) {
         for (const s of cfg.servers) {
-            if (s.transport !== 'stdio')
+            if (s.transport === 'remote' && opts.remotes?.get(serverKey(s))?.kind !== 'open')
                 continue;
             // Two clients pointing at the same argv are one measurement, not two.
             if (!unique.has(serverKey(s)))
@@ -97,8 +149,9 @@ export async function measureAll(configs, opts = {}) {
     const worker = async () => {
         for (let next = queue.shift(); next; next = queue.shift()) {
             const [key, s] = next;
-            const m = await measureServer(s.name, s.command ?? '', {
-                argv: s.argv,
+            const launch = s.transport === 'remote' ? bridgeLaunch(s) : null;
+            const m = await measureServer(s.name, launch ? launch.command : (s.command ?? ''), {
+                argv: launch ? launch.argv : s.argv,
                 env: s.env,
                 timeoutMs: opts.timeoutMs ?? 60_000,
                 docker: opts.docker,
@@ -113,7 +166,8 @@ export async function measureAll(configs, opts = {}) {
 }
 export async function runAudit(opts = {}) {
     const configs = discover(opts);
-    const measured = await measureAll(configs, opts);
+    const remotes = opts.remotes ?? (await probeRemotes(configs, opts));
+    const measured = await measureAll(configs, { ...opts, remotes });
     let divergence = null;
     let divergenceProblem;
     if (opts.claude) {
@@ -143,6 +197,7 @@ export async function runAudit(opts = {}) {
         captureIndex,
         env: opts.env ?? toolSearchEnv(process.env),
         settings: opts.settings ?? discoverSettings(opts),
+        remotes,
     });
     if (divergenceProblem)
         report.problems.push(divergenceProblem);

package/dist/cli.js

@@ -342,7 +342,8 @@ if (cmd === 'audit') {
             console.error(`no MCP config found at the path(s) given: ${all('config').join(', ')}. ` +
                 `Nothing else was searched, because --config was set.`);
         else
-            console.error(`no MCP config found. Looked in the standard Claude Desktop / Claude Code / Cursor / VS Code / Windsurf locations.${where}\n` +
+            console.error(`no MCP config found. Looked in the standard Claude Desktop / Claude Code / Cursor / VS Code / Windsurf / ` +
+                `Codex CLI / Gemini CLI / Zed / Kiro / Goose locations.${where}\n` +
                 `Point at one explicitly: mcp-context-cost audit --config <path/to/mcp.json>`);
         process.exit(1);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-context-cost",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Measure what your MCP servers cost in context tokens — audit your own config, or badge the server you publish",
   "type": "module",
   "license": "MIT",
@@ -53,6 +53,7 @@
   },
   "dependencies": {
     "js-tiktoken": "^1.0.21",
+    "smol-toml": "1.8.0",
     "yaml": "^2.9.0"
   },
   "devDependencies": {