mcp-context-cost 0.16.0 → 0.17.0

package/README.md

@@ -130,6 +130,40 @@ On a machine where none of them is set, the same stack reads:
     a tool whose _meta carries "anthropic/alwaysLoad": true, which this audit does not read from a capture
 ```
 
+**Do not take that table on trust — your own client will tell you.** Everything above is read
+from Anthropic's documentation, and documentation about someone else's product is exactly the
+kind of claim this project refuses to leave unchecked elsewhere. Claude Code writes its own
+decision to a debug log, before it sends anything, so you can check your machine rather than
+believe this page. In a directory with an `.mcp.json`:
+
+```bash
+claude --debug-file /tmp/cc.txt -p "ok"
+grep -E 'ToolSearch|Dynamic tool loading|Auto tool search' /tmp/cc.txt
+```
+
+Three line shapes answer three different questions:
+
+| the line | what it tells you |
+|---|---|
+| `[ToolSearch:optimistic] mode=…, ENABLE_TOOL_SEARCH=…, result=…` | which mode it picked at startup, and the value it read. **Optimistic is its own word for a guess** — it can be revised below |
+| `Dynamic tool loading: 0/N deferred tools included` | the one that settles it: how many of the `N` deferrable tools went into the request. `0/N` is deferral actually happening |
+| `[ToolSearch:optimistic] disabled: ANTHROPIC_BASE_URL=… is not a first-party Anthropic host` | the fallback in the table above, firing, in the client's own words |
+
+Read the *later* requests, not the first. A stdio server can finish connecting after the first
+request has already gone, so an early low count is a race rather than a finding.
+
+**The mode most likely to surprise you is `auto`.** It reads as the careful setting and it is the
+one that loads everything up front at ordinary sizes: below the threshold it does not defer, by
+design, and a line reading `Auto tool search disabled: … (threshold: …)` is that decision being
+made. The threshold is a *percentage of the context window*, so a model with a larger window has
+a proportionally larger one — pass `--context` to `audit` to compare against the window you
+actually run.
+
+None of this is free, and it is one trivial request. These are Claude Code's own debug lines
+rather than a documented interface, so they can change; the table above is what this project
+holds to a dated re-read. No other client discovered by `audit` writes anything comparable,
+which is why their rows say an absence of a record rather than a measurement.
+
 Set `ENABLE_TOOL_SEARCH=false` in that shell and the same config reports the opposite —
 `loads every tool definition up front here`, naming the variable and the place it was read
 from. Deferring is also not free: what a deferring client *does* load at session start —
@@ -312,7 +346,7 @@ now measured against a pinned model and published beside the badge, and they do
 
 | server | badge (o200k) | Claude (`claude-opus-5`) | |
 |---|---:|---:|---|
-| github | 54,622 | **18,728** | most of the capture is `annotations`/`outputSchema` metadata Claude never sees |
+| github | 54,622 | **18,728** | 78% of the capture is `icons` metadata Claude never sees |
 | notion | 17,500 | **33,560** | almost no metadata to drop, so the tokenizer difference dominates |
 
 So the heaviest server on the badge is not the heaviest server on Claude. Per-server

package/dist/core/canonical.d.ts

@@ -1,4 +1,4 @@
-import type { Measurement, MeasurementStatus } from './types.js';
+import type { Measurement, MeasurementStatus, ToolMeasurement } from './types.js';
 export declare const METHODOLOGY_VERSION = "1.0";
 /**
  * Canonical form: JSON.stringify over the PARSED tools array (no whitespace,
@@ -10,6 +10,21 @@ export declare const METHODOLOGY_VERSION = "1.0";
 export declare function canonicalString(tools: unknown[]): string;
 export declare function sha256Hex(text: string): string;
 export declare function countTokens(text: string): number;
+/**
+ * One tool's diagnostic breakdown, from the tool object alone.
+ *
+ * Exported and used by `measureTools` rather than inlined there, because two
+ * other callers have to agree with it exactly: the backfill that fills these
+ * fields in on records written before they existed, and the test that re-derives
+ * every published record's breakdown from that record's own capture. A second
+ * implementation of this arithmetic would be a second answer to the same
+ * question.
+ *
+ * A tool that ships no `outputSchema` or `annotations` records `0`. An absent
+ * key means something else — a record written before this existed — which is
+ * why `ToolMeasurement` makes them optional.
+ */
+export declare function measureTool(t: unknown): ToolMeasurement;
 /**
  * totalTokens is authoritative (tokens of the whole canonical array — array
  * punctuation included); per-tool numbers are diagnostic and won't sum to it.

package/dist/core/canonical.js

@@ -20,21 +20,38 @@ export function countTokens(text) {
     // descriptions are counted as ordinary text instead of throwing.
     return enc.encode(text, undefined, []).length;
 }
+/**
+ * One tool's diagnostic breakdown, from the tool object alone.
+ *
+ * Exported and used by `measureTools` rather than inlined there, because two
+ * other callers have to agree with it exactly: the backfill that fills these
+ * fields in on records written before they existed, and the test that re-derives
+ * every published record's breakdown from that record's own capture. A second
+ * implementation of this arithmetic would be a second answer to the same
+ * question.
+ *
+ * A tool that ships no `outputSchema` or `annotations` records `0`. An absent
+ * key means something else — a record written before this existed — which is
+ * why `ToolMeasurement` makes them optional.
+ */
+export function measureTool(t) {
+    const tool = t;
+    return {
+        name: tool.name ?? '(unnamed)',
+        tokens: countTokens(JSON.stringify(t)),
+        descriptionTokens: tool.description ? countTokens(tool.description) : 0,
+        inputSchemaTokens: tool.inputSchema ? countTokens(JSON.stringify(tool.inputSchema)) : 0,
+        outputSchemaTokens: tool.outputSchema ? countTokens(JSON.stringify(tool.outputSchema)) : 0,
+        annotationsTokens: tool.annotations ? countTokens(JSON.stringify(tool.annotations)) : 0,
+    };
+}
 /**
  * totalTokens is authoritative (tokens of the whole canonical array — array
  * punctuation included); per-tool numbers are diagnostic and won't sum to it.
  */
 export function measureTools(tools, meta) {
     const canonical = canonicalString(tools);
-    const perTool = tools.map((t) => {
-        const tool = t;
-        return {
-            name: tool.name ?? '(unnamed)',
-            tokens: countTokens(JSON.stringify(t)),
-            descriptionTokens: tool.description ? countTokens(tool.description) : 0,
-            inputSchemaTokens: tool.inputSchema ? countTokens(JSON.stringify(tool.inputSchema)) : 0,
-        };
-    });
+    const perTool = tools.map(measureTool);
     return {
         methodologyVersion: METHODOLOGY_VERSION,
         provider: 'tiktoken',

package/dist/core/types.d.ts

@@ -16,6 +16,20 @@ export interface ToolMeasurement {
     tokens: number;
     descriptionTokens: number;
     inputSchemaTokens: number;
+    /**
+     * The two fields that used to sit inside `tokens` with nothing naming them.
+     * Across the measured set output schemas are about a sixth of every published
+     * token and annotations another thirtieth, so a reader could see that a tool
+     * was expensive without being able to see that its output schema was why.
+     *
+     * Optional because absent and zero are different claims, the same distinction
+     * `serverInstructions` draws below: `0` means the tool ships no such field,
+     * absent means the record predates the attribution. Every record written
+     * since carries both, and `tools/backfill-tool-attribution.ts` re-derives
+     * them for older ones out of the capture stored in the same file.
+     */
+    outputSchemaTokens?: number;
+    annotationsTokens?: number;
 }
 /**
  * The full reproducibility record published next to every badge.

package/dist/sweep/client.d.ts

@@ -58,9 +58,51 @@ export declare function evidenceTail(stderr: string, limit?: number, required?:
  * one character of growth in somebody else's error message.
  */
 export declare function clampNotes(text: string, limit: number, required?: string): string;
+/**
+ * A client posture: what it declares at `initialize`, and how it answers the
+ * requests that declaration invites. The two live in one object because they
+ * are one decision — a client that declares `roots` and then returns
+ * "method not found" to `roots/list` has told the server something untrue, and
+ * a server is entitled to shape its tool list around the answer.
+ *
+ * This exists because the default posture, `{}`, is not neutral. A server may
+ * gate tools on what the client can do: measured 2026-09-06, the reference
+ * `everything` server exposes 13 tools to a client declaring nothing and 15 to
+ * one declaring roots and elicitation. So the published number for such a
+ * server is a floor, and which posture the sweep runs with is a measurement
+ * decision rather than a detail.
+ *
+ * `sampling` is deliberately absent. Declaring it says this client can ask a
+ * model for a completion, and it cannot; there is no honest minimal answer to
+ * `sampling/createMessage`, unlike an empty root list or a declined
+ * elicitation, both of which are ordinary states a real client can be in.
+ */
+export interface ClientPosture {
+    /** Sent verbatim as `capabilities` in `initialize`. */
+    capabilities: Record<string, unknown>;
+    /** Answers to server-initiated requests, by method. Every declared capability needs one. */
+    answers: Record<string, unknown>;
+}
+/** What the sweep has always declared: nothing, and so nothing to answer. */
+export declare const MINIMAL_POSTURE: ClientPosture;
+/**
+ * The two capabilities this harness can answer truthfully.
+ *
+ * `roots/list` returns an empty list: this client exposes no filesystem roots,
+ * which is a true statement about it rather than a refusal. `elicitation/create`
+ * declines: the protocol provides for a user declining to answer, and an
+ * unattended sweep has no user, so declining is the honest reply and not a
+ * failure to implement one.
+ */
+export declare const DECLARING_POSTURE: ClientPosture;
 export declare class McpStdioClient {
     /** Phrase this entry's declared status depends on — see `evidenceTail`. */
     private keepEvidence?;
+    /**
+     * Answers to server-initiated requests, one per declared capability. Empty
+     * by default, which is correct only while `initialize` declares nothing.
+     */
+    private answers;
     private child;
     private buffer;
     private nextId;
@@ -69,7 +111,12 @@ export declare class McpStdioClient {
     private exited;
     constructor(command: string, args: string[], env: Record<string, string | undefined>, 
     /** Phrase this entry's declared status depends on — see `evidenceTail`. */
-    keepEvidence?: string | undefined);
+    keepEvidence?: string | undefined, 
+    /**
+     * Answers to server-initiated requests, one per declared capability. Empty
+     * by default, which is correct only while `initialize` declares nothing.
+     */
+    answers?: Record<string, unknown>);
     private onData;
     private send;
     private deadReason;
@@ -89,6 +136,12 @@ export declare function captureTools(spec: string | {
     timeoutMs?: number;
     env?: Record<string, string>;
     keepEvidence?: string;
+    /**
+     * What to declare at `initialize`, and how to answer what that invites.
+     * Defaults to declaring nothing, which is what every published measurement
+     * was taken with.
+     */
+    posture?: ClientPosture;
 }): Promise<WireCapture>;
 /** Shell-free command splitting: honors single/double quotes, no expansion. */
 export declare function splitCommand(line: string): string[];

package/dist/sweep/client.js

@@ -212,8 +212,27 @@ function drop(text, isNoise, isProtected = () => false) {
         .trim();
     return kept || text.trim();
 }
+/** What the sweep has always declared: nothing, and so nothing to answer. */
+export const MINIMAL_POSTURE = { capabilities: {}, answers: {} };
+/**
+ * The two capabilities this harness can answer truthfully.
+ *
+ * `roots/list` returns an empty list: this client exposes no filesystem roots,
+ * which is a true statement about it rather than a refusal. `elicitation/create`
+ * declines: the protocol provides for a user declining to answer, and an
+ * unattended sweep has no user, so declining is the honest reply and not a
+ * failure to implement one.
+ */
+export const DECLARING_POSTURE = {
+    capabilities: { roots: { listChanged: false }, elicitation: {} },
+    answers: {
+        'roots/list': { roots: [] },
+        'elicitation/create': { action: 'decline' },
+    },
+};
 export class McpStdioClient {
     keepEvidence;
+    answers;
     child;
     buffer = '';
     nextId = 1;
@@ -222,8 +241,14 @@ export class McpStdioClient {
     exited;
     constructor(command, args, env, 
     /** Phrase this entry's declared status depends on — see `evidenceTail`. */
-    keepEvidence) {
+    keepEvidence, 
+    /**
+     * Answers to server-initiated requests, one per declared capability. Empty
+     * by default, which is correct only while `initialize` declares nothing.
+     */
+    answers = {}) {
         this.keepEvidence = keepEvidence;
+        this.answers = answers;
         this.child = spawn(command, args, {
             env: { ...env },
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -279,6 +304,8 @@ export class McpStdioClient {
                 if (msg.id !== undefined && msg.id !== null) {
                     if (msg.method === 'ping')
                         this.send({ jsonrpc: '2.0', id: msg.id, result: {} });
+                    else if (Object.hasOwn(this.answers, msg.method))
+                        this.send({ jsonrpc: '2.0', id: msg.id, result: this.answers[msg.method] });
                     else
                         this.send({ jsonrpc: '2.0', id: msg.id, error: { code: -32601, message: 'method not found' } });
                 }
@@ -345,12 +372,13 @@ export class McpStdioClient {
  */
 export async function captureTools(spec, opts = {}) {
     const timeoutMs = opts.timeoutMs ?? 60_000;
+    const posture = opts.posture ?? MINIMAL_POSTURE;
     const [cmd, ...args] = typeof spec === 'string' ? splitCommand(spec) : [spec.command, ...spec.argv];
-    const client = new McpStdioClient(cmd, args, { PATH: process.env.PATH, HOME: process.env.HOME, ...opts.env }, opts.keepEvidence);
+    const client = new McpStdioClient(cmd, args, { PATH: process.env.PATH, HOME: process.env.HOME, ...opts.env }, opts.keepEvidence, posture.answers);
     try {
         const init = await client.request('initialize', {
             protocolVersion: PROTOCOL_VERSION,
-            capabilities: {},
+            capabilities: posture.capabilities,
             clientInfo: { name: 'mcp-context-cost', version: '0.1.0' },
         }, timeoutMs);
         client.notify('notifications/initialized');

package/dist/sweep/published-stats.d.ts

@@ -32,6 +32,17 @@ export interface PublishedStats {
         github: {
             badgeTokens: number;
             claudeTokens: number | null;
+            /**
+             * The single heaviest field in github's capture that an Anthropic tools
+             * array has nowhere to put, and its share of the capture. Derived rather
+             * than described, because the sentence it feeds was wrong for as long as
+             * it was hand-written: it named `annotations`/`outputSchema` as "most of
+             * the capture" while github ships no `outputSchema` at all and 1.7% of
+             * annotations. The dropped weight was `icons`, at 78%. A claim about
+             * which bytes are dropped has to come from the bytes.
+             */
+            dropField: string;
+            dropSharePct: number;
         };
         notion: {
             badgeTokens: number;
@@ -77,6 +88,24 @@ export interface PublishedStats {
 }
 /** Named in README's sample table — the choice is editorial, the numbers are not. */
 export declare const SAMPLE_SERVERS: readonly ['github', 'xcodebuildmcp', 'brave-search', 'notion', 'playwright', 'filesystem', 'markitdown'];
+/**
+ * The heaviest field in a capture that an Anthropic request has nowhere to put,
+ * and what share of the capture it is.
+ *
+ * This exists because the README sentence it feeds was hand-written and wrong.
+ * It said most of github's capture was `annotations`/`outputSchema` metadata;
+ * github ships no `outputSchema` at all and 1.7% of annotations, and the weight
+ * being dropped was `icons` at 78%. The claim was plausible, unmaintained, and
+ * describing a different server's shape — so it is derived now, and it moves
+ * when the capture does.
+ *
+ * Ties break on the field name so the sentence does not flip between two
+ * equal-weight fields from one regeneration to the next.
+ */
+export declare function heaviestDroppedField(capture: unknown[] | null, totalTokens: number): {
+    dropField: string;
+    dropSharePct: number;
+};
 export declare function floorToTwoSignificant(n: number): number;
 export declare function computePublishedStats(entries: ServerEntry[], root?: string): PublishedStats;
 export type PageFile = 'README.md' | 'docs/index.md' | 'docs/METHODOLOGY.md';

package/dist/sweep/published-stats.js

@@ -29,6 +29,7 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { DEFAULT_CONTEXT_WINDOW } from '../audit/audit.js';
 import { BAND_PRECISION, wireToClientRatio } from '../audit/deferral.js';
+import { countTokens } from '../core/canonical.js';
 import { fieldSelectionShare, isCurrent } from '../core/divergence.js';
 import { sessionStartLoad } from '../core/session-start.js';
 import { isGood } from './harness-guard.js';
@@ -44,6 +45,40 @@ export const SAMPLE_SERVERS = [
     'filesystem',
     'markitdown',
 ];
+/**
+ * The three fields an Anthropic tool definition carries. Everything else a
+ * server ships in `tools/list` is dropped before the request — see
+ * docs/METHODOLOGY.md#claude-divergence.
+ */
+const ANTHROPIC_TOOL_FIELDS = new Set(['name', 'description', 'inputSchema']);
+/**
+ * The heaviest field in a capture that an Anthropic request has nowhere to put,
+ * and what share of the capture it is.
+ *
+ * This exists because the README sentence it feeds was hand-written and wrong.
+ * It said most of github's capture was `annotations`/`outputSchema` metadata;
+ * github ships no `outputSchema` at all and 1.7% of annotations, and the weight
+ * being dropped was `icons` at 78%. The claim was plausible, unmaintained, and
+ * describing a different server's shape — so it is derived now, and it moves
+ * when the capture does.
+ *
+ * Ties break on the field name so the sentence does not flip between two
+ * equal-weight fields from one regeneration to the next.
+ */
+export function heaviestDroppedField(capture, totalTokens) {
+    const tally = new Map();
+    for (const tool of capture ?? []) {
+        for (const [k, v] of Object.entries((tool ?? {}))) {
+            if (ANTHROPIC_TOOL_FIELDS.has(k))
+                continue;
+            tally.set(k, (tally.get(k) ?? 0) + countTokens(JSON.stringify(v)));
+        }
+    }
+    const top = [...tally].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))[0];
+    if (!top || totalTokens <= 0)
+        return { dropField: 'none', dropSharePct: 0 };
+    return { dropField: top[0], dropSharePct: Math.round((100 * top[1]) / totalTokens) };
+}
 export function floorToTwoSignificant(n) {
     const whole = Math.floor(n);
     if (whole < 100)
@@ -153,7 +188,11 @@ export function computePublishedStats(entries, root = process.cwd()) {
             runSize: Object.keys(div.servers).length,
             currentCount: withClaude.length,
             heaviestClaudeName: heaviest?.entry.name ?? null,
-            github: { badgeTokens: badgeTokensOf('github'), claudeTokens: currentDivRow('github')?.claudeDelta ?? null },
+            github: {
+                badgeTokens: badgeTokensOf('github'),
+                claudeTokens: currentDivRow('github')?.claudeDelta ?? null,
+                ...heaviestDroppedField(githubRow.m.rawToolsCapture, githubRow.m.totalTokens),
+            },
             notion: { badgeTokens: badgeTokensOf('notion'), claudeTokens: currentDivRow('notion')?.claudeDelta ?? null },
             widest: { server: widest[0], full: widest[1].o200kFull, mapped: widest[1].o200kMapped },
             shareMin: Math.min(...shares),
@@ -289,8 +328,13 @@ export const PAGE_CLAIMS = [
     {
         file: 'README.md',
         id: 'claude-table:github',
-        template: '| github | {n} | **{q}** | most of the capture is `annotations`/`outputSchema` metadata Claude never sees |',
-        values: (s) => [fmt(s.claude.github.badgeTokens), q(s.claude.github.claudeTokens)],
+        template: '| github | {n} | **{q}** | {d}% of the capture is `{w}` metadata Claude never sees |',
+        values: (s) => [
+            fmt(s.claude.github.badgeTokens),
+            q(s.claude.github.claudeTokens),
+            String(s.claude.github.dropSharePct),
+            s.claude.github.dropField,
+        ],
     },
     {
         file: 'README.md',

package/dist/sweep/report.d.ts

@@ -60,6 +60,40 @@ export interface ServerEntry {
      * context cost nobody is watching.
      */
     deprecated?: Deprecation;
+    /**
+     * A different project of the same name that this row does **not** measure.
+     *
+     * `name` is the only thing the leaderboard shows about an entry — the package
+     * id and the repo are on the server page, one click away — so a row whose
+     * name is shared with a better-known project reads as that project to anyone
+     * who does not click. That is not hypothetical: `octocode` here is the npm
+     * package `octocode-mcp` from `bgauryy/octocode`, and someone who works on
+     * `Muvon/octocode`, an unrelated Rust project with the same name, read the
+     * row as theirs and posted a public correction about how their server had
+     * been filed.
+     *
+     * Declared per entry rather than detected, because there is no way to detect
+     * it: two unrelated projects picking one word is a fact about the world, and
+     * the only honest source is someone noticing. Renaming the entry is the
+     * alternative and a much larger one — `name` keys `results/<name>/`,
+     * `badges/<name>.json`, the capture index and every history row, so it is a
+     * change to a published identifier rather than to a label.
+     */
+    nameCollision?: NameCollision;
+}
+/**
+ * The other project, as a dated reading — the same shape a deprecation takes,
+ * for the same reason: it is a claim about something outside this repository,
+ * so it carries where it was read and when. A project can be renamed, archived
+ * or absorbed without anything here moving.
+ */
+export interface NameCollision {
+    /** The other project, as its own owner writes it — e.g. `Muvon/octocode`. */
+    project: string;
+    /** Where it was read. */
+    source: string;
+    /** The day it was read. */
+    readOn: string;
 }
 /**
  * A deprecation as a dated reading, like every other reading here. `version`
@@ -89,6 +123,8 @@ export declare function mdCell(s: unknown): string;
  * Returns '' for an entry with no deprecation, so a caller can splice it in
  * without branching.
  */
+/** `https://github.com/owner/repo` → `owner/repo`; anything else is left alone. */
+export declare function shortRepo(url: string): string;
 export declare function deprecationText(entry: ServerEntry): string;
 export declare function loadRows(entries: ServerEntry[], root?: string): Row[];
 /** results/divergence.json if a divergence run has been recorded, else null. */

package/dist/sweep/report.js

@@ -22,6 +22,11 @@ const mdLink = (url) => encodeURI(String(url ?? '')).replace(/\)/g, '%29');
  * Returns '' for an entry with no deprecation, so a caller can splice it in
  * without branching.
  */
+/** `https://github.com/owner/repo` → `owner/repo`; anything else is left alone. */
+export function shortRepo(url) {
+    const m = /^https?:\/\/(?:www\.)?github\.com\/([^/]+\/[^/#?]+)/.exec(url);
+    return m ? m[1].replace(/\.git$/, '') : url;
+}
 export function deprecationText(entry) {
     const d = entry.deprecated;
     if (!d)
@@ -240,6 +245,31 @@ export function writeLeaderboard(entries, root = process.cwd(), regressions) {
         }
         md.push('');
     }
+    // Same rule as the deprecation section above: derived, and gone when no entry
+    // declares one. It is a section rather than a column because the fact belongs
+    // to a handful of rows and a column would put an empty cell on the other
+    // hundred — and because what a reader needs here is a sentence, not a cell.
+    const collided = rows.filter((r) => r.entry.nameCollision);
+    if (collided.length > 0) {
+        md.push('## Same name, different project');
+        md.push('');
+        md.push(`A row here is named for the package it launches, and ${collided.length === 1 ? 'one name is' : 'these names are'} ` +
+            `shared with an unrelated project. The table above shows only the name, so ` +
+            `${collided.length === 1 ? 'that row' : 'those rows'} can be read as the wrong software by anyone who does not ` +
+            `open the page — which has already happened once, publicly. What each row actually measures is its launch ` +
+            `command and its source repository, both on its detail page.`);
+        md.push('');
+        md.push('| server | measures | not to be confused with |');
+        md.push('|---|---|---|');
+        for (const r of collided) {
+            const c = r.entry.nameCollision;
+            const measures = r.entry.repo
+                ? `\`${mdCell(r.entry.package ?? r.entry.command)}\` — [${mdCell(shortRepo(r.entry.repo))}](${mdLink(r.entry.repo)})`
+                : `\`${mdCell(r.entry.package ?? r.entry.command)}\``;
+            md.push(`| ${mdCell(r.entry.name)} | ${measures} | [${mdCell(c.project)}](${mdLink(c.source)}), read ${mdCell(c.readOn)} |`);
+        }
+        md.push('');
+    }
     if (unmeasured.length > 0) {
         md.push('## Not measured (and why)');
         md.push('');

package/dist/sweep/run.d.ts

@@ -1,3 +1,4 @@
+import { type ClientPosture } from './client.js';
 import type { Measurement } from '../core/types.js';
 /**
  * Which kind of failure a dead server's own words describe.
@@ -105,6 +106,14 @@ export interface MeasureOptions {
      * `audit` runs in the user's own directory and must not litter it.
      */
     persist?: boolean;
+    /**
+     * What the client declares at `initialize`, and how it answers what that
+     * invites. Every published measurement was taken declaring nothing, which is
+     * the default; a probe passes a different posture to find out whether a
+     * server gates tools on it. Changing the default would change published
+     * numbers, so it is a measurement decision and not a flag to flip lightly.
+     */
+    posture?: ClientPosture;
 }
 /**
  * Whether a launch command is already its own `docker run`.

package/dist/sweep/run.js

@@ -231,7 +231,7 @@ export async function measureServer(name, command, opts = {}) {
             // The declared evidence travels with the launch, because the truncation
             // that could lose it happens inside the client, before anything here sees
             // the message it will be classified from.
-            const captureOpts = { ...attemptOpts, keepEvidence: opts.notApplicable?.evidence };
+            const captureOpts = { ...attemptOpts, keepEvidence: opts.notApplicable?.evidence, posture: opts.posture };
             const first = await captureTools(buildSpec(noSharedCache), captureOpts);
             const second = await captureTools(buildSpec(noSharedCache), captureOpts);
             r = measureTools(first.tools, {

package/dist/sweep/server-pages.js

@@ -27,13 +27,28 @@ const fmt = (n) => n.toLocaleString('en-US');
 function isMeasured(m) {
     return !!m && (m.status === 'measured' || m.status === 'dynamic') && typeof m.totalTokens === 'number';
 }
+/**
+ * The conditions a number was made under, including the machine.
+ *
+ * `isolation.arch` has been recorded since 0.12.0 and was rendered nowhere, so
+ * a reader could see the image and the network a measurement ran under but not
+ * the architecture — the one condition that decides whether a package could run
+ * at all. `local-mcp` is why the field exists: it was published as a broken
+ * server on the strength of a run whose real finding was the machine.
+ *
+ * Absent is printed as "architecture not on record" rather than omitted,
+ * because the record's own rule is that absent means unknown and never "the
+ * same as yours". Thirty-two of the published records predate the field and
+ * will say so until the rotation re-measures them.
+ */
 function isolationText(m) {
     const iso = m.isolation;
     if (!iso)
         return 'not recorded';
+    const arch = iso.arch ?? 'architecture not on record';
     if (!iso.docker)
-        return 'host process (no container)';
-    return ['docker', iso.image, iso.network ? `network ${iso.network}` : '', iso.note]
+        return `host process (no container) · ${arch}`;
+    return ['docker', iso.image, iso.network ? `network ${iso.network}` : '', arch, iso.note]
         .filter(Boolean)
         .join(' · ');
 }
@@ -99,6 +114,15 @@ export function renderServerPage(entry, m, history = [], divergence = null) {
         md.push(`| category | ${mdCell(entry.category)} |`);
     if (entry.repo)
         md.push(`| source | ${mdCell(entry.repo)} |`);
+    // The page already names the package, the launch command and the repo, so a
+    // reader who reads it can tell which project this is. This row is for the
+    // reader who arrives from a badge, sees a familiar name in the heading, and
+    // has no reason to suspect there are two — which is the person the collision
+    // actually caught.
+    if (entry.nameCollision) {
+        md.push(`| not to be confused with | ${mdCell(entry.nameCollision.project)} ` +
+            `(${mdCell(entry.nameCollision.source)}, read ${mdCell(entry.nameCollision.readOn)}) — an unrelated project of the same name, not measured here |`);
+    }
     md.push('');
     if (m.status === 'dynamic') {
         md.push('> This server\'s `tools/list` differed between two consecutive captures, so the number ' +
@@ -107,10 +131,20 @@ export function renderServerPage(entry, m, history = [], divergence = null) {
     }
     md.push('## Where the tokens are');
     md.push('');
-    md.push('| tool | tokens | share | description | schema |');
-    md.push('|---|---:|---:|---:|---:|');
+    // The output-schema column appears only on pages that have one. It is the
+    // field most likely to explain an expensive tool — about a sixth of every
+    // published token across the set, and the largest thing the breakdown used to
+    // leave unnamed — but only a third of measured servers ship one, and a column
+    // of zeroes on the rest would cost every reader something to tell them
+    // nothing. `annotations` is recorded per tool for the same reason and
+    // deliberately gets no column: at roughly 3% of the set it almost never
+    // explains a row, and it is in the measurement file for anyone who looks.
+    const hasOutput = shown.some((t) => (t.outputSchemaTokens ?? 0) > 0);
+    md.push(`| tool | tokens | share | description | input schema |${hasOutput ? ' output schema |' : ''}`);
+    md.push(`|---|---:|---:|---:|---:|${hasOutput ? '---:|' : ''}`);
     for (const t of shown) {
-        md.push(`| ${mdCell(t.name)} | ${fmt(t.tokens)} | ${pct(t.tokens)} | ${fmt(t.descriptionTokens)} | ${fmt(t.inputSchemaTokens)} |`);
+        md.push(`| ${mdCell(t.name)} | ${fmt(t.tokens)} | ${pct(t.tokens)} | ${fmt(t.descriptionTokens)} | ${fmt(t.inputSchemaTokens)} |` +
+            (hasOutput ? ` ${fmt(t.outputSchemaTokens ?? 0)} |` : ''));
     }
     md.push('');
     if (tools.length > shown.length) {

package/dist/sweep/servers-schema.d.ts

@@ -29,6 +29,7 @@ declare const FIELDS: {
     readonly envValues: 'optional';
     readonly notApplicable: 'optional';
     readonly deprecated: 'optional';
+    readonly nameCollision: 'optional';
 };
 export declare const knownFields: (keyof typeof FIELDS)[];
 /**

package/dist/sweep/servers-schema.js

@@ -51,6 +51,7 @@ const FIELDS = {
     envValues: 'optional',
     notApplicable: 'optional',
     deprecated: 'optional',
+    nameCollision: 'optional',
 };
 export const knownFields = Object.keys(FIELDS);
 /**
@@ -218,6 +219,35 @@ export function validateEntry(raw, index) {
             }
         }
     }
+    const coll = e.nameCollision;
+    if (coll !== undefined) {
+        if (!isPlainObject(coll))
+            bad('must be a mapping with project, source and readOn', 'nameCollision');
+        else {
+            for (const key of ['project', 'source', 'readOn']) {
+                const v = coll[key];
+                if (typeof v !== 'string' || v.trim() === '')
+                    bad(`${key} is required and must be non-empty`, 'nameCollision');
+            }
+            // Same rule as a deprecation, and for the same reason: this is a claim
+            // about a project outside this repository, so it names where it was read.
+            if (typeof coll.source === 'string' && !/^https?:\/\//.test(coll.source)) {
+                bad('source must be a URL — a published claim carries its evidence', 'nameCollision');
+            }
+            if (typeof coll.readOn === 'string' && !/^\d{4}-\d{2}-\d{2}$/.test(coll.readOn)) {
+                bad('readOn must be YYYY-MM-DD', 'nameCollision');
+            }
+            // The whole point of the field is to name something this row is *not*.
+            // A declaration pointing at the entry's own repository says nothing.
+            if (typeof coll.source === 'string' && typeof e.repo === 'string' && coll.source === e.repo) {
+                bad('source is this entry\'s own repo — the field names a different project', 'nameCollision');
+            }
+            for (const key of Object.keys(coll)) {
+                if (!['project', 'source', 'readOn'].includes(key))
+                    bad(`unknown key ${key}`, 'nameCollision');
+            }
+        }
+    }
     return problems;
 }
 /** Shape-check the whole document, including the invariants that span entries. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-context-cost",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Measure what your MCP servers cost in context tokens — audit your own config, or badge the server you publish",
   "type": "module",
   "license": "MIT",