mcp-tollbooth 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 mcp-tollbooth contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,93 @@
+# MCP Tollbooth 🧾
+
+**How much context window are your MCP servers actually costing you — and are any of them doing the same job twice?**
+
+MCP Tollbooth scans your local [Model Context Protocol](https://modelcontextprotocol.io) configuration (Claude Desktop, Claude Code, Cursor, VS Code) and answers two questions nobody else is answering well:
+
+- 🧮 **Token budget** — how many tokens each server silently costs you before your agent does anything useful, and what the total toll is across your whole setup
+- 🔁 **Overlap detection** — do you have three different servers all fighting to do "GitHub stuff"? Pick one, save the budget.
+- 🔒 A lightweight **trust signal** (repo activity, stars, license) as a secondary check, clearly labeled as a heuristic — not a security scanner
+
+## Why this, and not a security scanner
+
+By mid-2026 the MCP ecosystem has real security tooling already: [`@wigu/mcp-doctor`](https://www.npmjs.com/package/@wigu/mcp-doctor) does secret-leak and permission scanning with a GitHub Action; other tools do agent-friendliness diagnostics. That space is getting crowded, and doing it shallowly wouldn't add much.
+
+What's still missing is the boring-but-real cost problem: **every server you add eats context before your agent types a word.** A handful of servers can burn 50,000+ tokens of budget, and most people have no idea which ones are the expensive ones — or that they've installed the same capability twice under two different names. Tollbooth answers exactly that, and nothing more than that, well.
+
+## Install & use
+
+```bash
+npx mcp-tollbooth
+```
+
+No install, no config. It scans the standard locations:
+
+- `.mcp.json` (Claude Code, project-scoped)
+- `~/.claude.json` (Claude Code, user-scoped)
+- `claude_desktop_config.json` (Claude Desktop — macOS/Windows/Linux paths)
+- `.cursor/mcp.json` and `~/.cursor/mcp.json` (Cursor)
+- `.vscode/mcp.json` (VS Code)
+
+Or point it at a specific file:
+
+```bash
+npx mcp-tollbooth --config ./my-config.json
+```
+
+Raw JSON for scripting / CI:
+
+```bash
+npx mcp-tollbooth --json
+```
+
+### Example output
+
+```
+  MCP Tollbooth  — what your MCP servers are costing your context window
+
+Scanned config files:
+  • Claude Code (project .mcp.json) (/you/project/.mcp.json) — 5 server(s)
+
+┌──────────────────┬────────────────────┬─────────────┬────────────┬───────────┬────────┐
+│ Server           │ Category           │ Est. Tokens │ Trust*     │ Last Push │ Stars  │
+├──────────────────┼────────────────────┼─────────────┼────────────┼───────────┼────────┤
+│ playwright       │ browser-automation │ ~3,200      │ 95 Healthy │ 8d ago    │ 34,813 │
+│ github           │ vcs                │ ~2,400      │ 60 Caution │ unknown   │ —      │
+│ filesystem       │ filesystem         │ ~900        │ 95 Healthy │ 1d ago    │ 88,173 │
+│ some-random-tool │ other              │ ~800*       │ 40 Risky   │ unknown   │ —      │
+└──────────────────┴────────────────────┴─────────────┴────────────┴───────────┴────────┘
+
+Overlap detected — you're paying twice for the same job:
+  • vcs: github, some-other-git-tool — do you need all of these?
+
+Total context toll: ~7,300 tokens  across 4 server(s)  ·  avg trust 72/100
+```
+
+## How it works
+
+**Token estimates** for well-known servers are based on their documented tool counts. For everything else, Tollbooth falls back to a conservative heuristic based on the server's transport type — flagged with `*`, and clearly an *estimate, not a measurement*. Live connection mode (actually counting tool schemas) is on the roadmap.
+
+**Overlap detection** groups servers by inferred category (vcs, filesystem, browser-automation, etc.) and flags any category with more than one server.
+
+**Trust score** (0-100) is a secondary, clearly-labeled heuristic: official npm scope, days since last commit, GitHub stars, archived status, license presence. It is not a security scan — it doesn't read source code, run the server, or detect malicious behavior. If you want real security scanning, use a dedicated tool for that (see above).
+
+## Limitations
+
+- Token estimates for unlisted servers are heuristics, not measurements.
+- GitHub/npm lookups depend on the package's `repository` field being accurate.
+- Unauthenticated GitHub API calls are rate-limited — set `GITHUB_TOKEN` if auditing a lot of servers at once.
+
+## Roadmap
+
+- [ ] `--precise` live connection mode for exact token counts (connect and count real tool schemas)
+- [ ] `--fix` mode to interactively disable low-value / redundant servers
+- [ ] GitHub Action for CI-time token-budget regression checks on team MCP configs
+- [ ] Per-server historical token trend (did that update just double your bill?)
+
+## Contributing
+
+Issues and PRs welcome — especially the known-server token cost table in `src/heuristics.ts` and category keyword coverage.
+
+## License
+
+MIT

package/dist/auditor.js

@@ -0,0 +1,122 @@
+import { categorize, estimateTokens } from "./heuristics.js";
+import { classifyServer, fetchGithubRepoInfo, fetchNpmPackageInfo } from "./registryInfo.js";
+const OFFICIAL_SCOPES = ["@modelcontextprotocol", "@anthropic-ai", "@upstash", "@notionhq", "@playwright"];
+function computeTrustScore(params) {
+    const notes = [];
+    let score = 50; // neutral baseline
+    const { githubLookup, kind, packageName } = params;
+    if (kind === "unknown") {
+        notes.push("Could not determine how this server runs — treat as untrusted until verified manually.");
+        return { score: 20, notes, rateLimited: false };
+    }
+    if (packageName && OFFICIAL_SCOPES.some((scope) => packageName.startsWith(scope))) {
+        score += 20;
+        notes.push("Published under a recognized official/vendor npm scope.");
+    }
+    if (githubLookup?.status === "rate-limited") {
+        notes.push("GitHub rate limit hit — repo activity/stars not verified this run (set GITHUB_TOKEN).");
+        return { score: clamp(score), notes, rateLimited: true };
+    }
+    if (githubLookup?.status === "error") {
+        notes.push("Could not reach GitHub to verify repo activity — network or API error.");
+        return { score: clamp(score), notes, rateLimited: false };
+    }
+    if (!githubLookup || githubLookup.status === "not-found") {
+        notes.push("No public GitHub repo found — could not verify maintenance status.");
+        score -= 10;
+        return { score: clamp(score), notes, rateLimited: false };
+    }
+    const githubInfo = githubLookup.info;
+    if (githubInfo.archived) {
+        score -= 40;
+        notes.push("Repository is archived — no further security fixes expected.");
+    }
+    if (githubInfo.daysSinceLastPush > 365) {
+        score -= 25;
+        notes.push(`No commits in ${Math.floor(githubInfo.daysSinceLastPush / 30)}+ months — likely unmaintained.`);
+    }
+    else if (githubInfo.daysSinceLastPush > 180) {
+        score -= 10;
+        notes.push(`Last commit was ${Math.floor(githubInfo.daysSinceLastPush / 30)} months ago.`);
+    }
+    else {
+        score += 10;
+        notes.push("Actively maintained (commit within the last 6 months).");
+    }
+    if (githubInfo.stars >= 1000) {
+        score += 15;
+        notes.push(`Well-established: ${githubInfo.stars.toLocaleString()} GitHub stars.`);
+    }
+    else if (githubInfo.stars < 20) {
+        score -= 10;
+        notes.push(`Low visibility: only ${githubInfo.stars} GitHub stars — limited community scrutiny.`);
+    }
+    if (!githubInfo.hasLicense) {
+        score -= 10;
+        notes.push("No OSS license detected on the repo.");
+    }
+    return { score: clamp(score), notes, rateLimited: false };
+}
+function clamp(n) {
+    return Math.max(0, Math.min(100, Math.round(n)));
+}
+export async function auditConfigFiles(configFiles) {
+    const warnings = [];
+    const jobs = [];
+    for (const file of configFiles) {
+        for (const [serverName, rawCfg] of Object.entries(file.servers)) {
+            jobs.push({ file, serverName, rawCfg });
+        }
+    }
+    const results = await Promise.all(jobs.map(async ({ file, serverName, rawCfg }) => {
+        const { kind, packageName, rawCommandLine } = classifyServer(rawCfg);
+        let packageInfo;
+        let githubLookup;
+        if (packageName) {
+            packageInfo = (await fetchNpmPackageInfo(packageName)) ?? { name: packageName };
+            githubLookup = await fetchGithubRepoInfo(packageInfo.repositoryUrl);
+        }
+        const { tokens, confidence } = estimateTokens(packageName, kind);
+        const category = categorize(serverName, packageName);
+        const { score, notes } = computeTrustScore({ githubLookup, kind, packageName });
+        return {
+            configSource: file.source,
+            serverName,
+            kind,
+            rawCommandLine,
+            packageInfo,
+            githubInfo: githubLookup?.status === "found" ? githubLookup.info : null,
+            category,
+            estimatedTokens: tokens,
+            tokenConfidence: confidence,
+            trustScore: score,
+            trustNotes: notes,
+            rateLimited: githubLookup?.status === "rate-limited",
+        };
+    }));
+    const servers = results.map(({ rateLimited, ...rest }) => rest);
+    const anyRateLimited = results.some((r) => r.rateLimited);
+    if (anyRateLimited) {
+        warnings.push("GitHub API rate limit was hit while checking repo activity — some trust scores are less precise this run. Set a GITHUB_TOKEN env var for higher limits.");
+    }
+    const totalEstimatedTokens = servers.reduce((sum, s) => sum + s.estimatedTokens, 0);
+    const overallScore = servers.length
+        ? Math.round(servers.reduce((sum, s) => sum + s.trustScore, 0) / servers.length)
+        : 100;
+    // Overlap detection: same category, more than one server, excluding "other"
+    const byCategory = new Map();
+    for (const s of servers) {
+        if (s.category === "other")
+            continue;
+        const list = byCategory.get(s.category) ?? [];
+        list.push(s.serverName);
+        byCategory.set(s.category, list);
+    }
+    const overlapGroups = [...byCategory.entries()]
+        .filter(([, names]) => names.length > 1)
+        .map(([category, serverNames]) => ({ category: category, serverNames }));
+    if (totalEstimatedTokens > 40000) {
+        warnings.push(`Your MCP servers use an estimated ~${totalEstimatedTokens.toLocaleString()} tokens of context before you type a single message. Consider trimming to your 3-5 most-used servers.`);
+    }
+    return { servers, totalEstimatedTokens, overallScore, overlapGroups, warnings };
+}

package/dist/configLocator.js

@@ -0,0 +1,97 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+function candidatePaths() {
+    const home = homedir();
+    const cwd = process.cwd();
+    const plat = platform();
+    const candidates = [
+        // Project-scoped configs (Claude Code / Cursor convention)
+        { source: "Claude Code (project .mcp.json)", path: join(cwd, ".mcp.json") },
+        { source: "Cursor (project .cursor/mcp.json)", path: join(cwd, ".cursor", "mcp.json") },
+        { source: "VS Code (project .vscode/mcp.json)", path: join(cwd, ".vscode", "mcp.json") },
+        // User-scoped configs
+        { source: "Claude Code (user ~/.claude.json)", path: join(home, ".claude.json") },
+        { source: "Cursor (user ~/.cursor/mcp.json)", path: join(home, ".cursor", "mcp.json") },
+    ];
+    if (plat === "darwin") {
+        candidates.push({
+            source: "Claude Desktop (macOS)",
+            path: join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+        });
+    }
+    else if (plat === "win32") {
+        const appData = process.env.APPDATA ?? join(home, "AppData", "Roaming");
+        candidates.push({
+            source: "Claude Desktop (Windows)",
+            path: join(appData, "Claude", "claude_desktop_config.json"),
+        });
+    }
+    else {
+        candidates.push({
+            source: "Claude Desktop (Linux)",
+            path: join(home, ".config", "Claude", "claude_desktop_config.json"),
+        });
+    }
+    return candidates;
+}
+function extractServers(raw) {
+    if (!raw || typeof raw !== "object")
+        return {};
+    const obj = raw;
+    const servers = obj.mcpServers ?? obj.servers;
+    if (!servers || typeof servers !== "object")
+        return {};
+    return servers;
+}
+/** Thrown only for an explicitly-passed --config path, so failures are never confused with "nothing found in usual locations". */
+export class ExplicitConfigError extends Error {
+}
+/**
+ * Scans known MCP config locations (Claude Desktop, Claude Code, Cursor, VS Code)
+ * and returns every config file that actually exists and declares servers.
+ *
+ * If `explicitPath` is given, a missing file, unreadable/invalid JSON, or a
+ * valid file with zero servers all throw ExplicitConfigError with a specific
+ * reason — silently falling through to "no configs found" would be misleading
+ * when the user pointed us at a file directly.
+ */
+export function discoverConfigFiles(explicitPath) {
+    if (explicitPath) {
+        if (!existsSync(explicitPath)) {
+            throw new ExplicitConfigError(`No file found at "${explicitPath}".`);
+        }
+        let parsed;
+        try {
+            const content = readFileSync(explicitPath, "utf-8");
+            parsed = JSON.parse(content);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new ExplicitConfigError(`Could not read/parse "${explicitPath}" as JSON: ${reason}`);
+        }
+        const servers = extractServers(parsed);
+        if (Object.keys(servers).length === 0) {
+            throw new ExplicitConfigError(`"${explicitPath}" is valid JSON but has no "mcpServers" (or "servers") entries.`);
+        }
+        return [{ source: "Custom path", path: explicitPath, servers }];
+    }
+    const found = [];
+    for (const candidate of candidatePaths()) {
+        if (!existsSync(candidate.path))
+            continue;
+        try {
+            const content = readFileSync(candidate.path, "utf-8");
+            const parsed = JSON.parse(content);
+            const servers = extractServers(parsed);
+            if (Object.keys(servers).length > 0) {
+                found.push({ source: candidate.source, path: candidate.path, servers });
+            }
+        }
+        catch {
+            // Skip unreadable/invalid JSON in auto-discovered files rather than crashing the whole scan —
+            // here it's reasonable to stay silent since we're speculatively probing several locations.
+        }
+    }
+    return found;
+}

package/dist/heuristics.js

@@ -0,0 +1,80 @@
+/**
+ * Rough tool-count-derived token estimates for well-known MCP servers, based on
+ * publicly documented tool counts (each tool definition costs roughly 150-400
+ * tokens of context depending on schema complexity). These are estimates, not
+ * measurements — use `--precise` in a future version to connect and measure directly.
+ */
+const KNOWN_SERVER_TOKEN_COSTS = {
+    "@modelcontextprotocol/server-github": 2400,
+    "@modelcontextprotocol/server-filesystem": 900,
+    "@modelcontextprotocol/server-slack": 1200,
+    "@modelcontextprotocol/server-postgres": 800,
+    "@modelcontextprotocol/server-sqlite": 700,
+    "@modelcontextprotocol/server-puppeteer": 1400,
+    "@modelcontextprotocol/server-brave-search": 500,
+    "@modelcontextprotocol/server-memory": 400,
+    "@modelcontextprotocol/server-everything": 2000,
+    "@modelcontextprotocol/server-fetch": 350,
+    "@modelcontextprotocol/server-sequential-thinking": 300,
+    "@modelcontextprotocol/server-google-maps": 900,
+    "@modelcontextprotocol/server-everart": 500,
+    "@playwright/mcp": 3200,
+    "firecrawl-mcp": 1600,
+    "@notionhq/notion-mcp-server": 2800,
+    "figma-developer-mcp": 1800,
+    "@upstash/context7-mcp": 600,
+    "@sentry/mcp-server": 1100,
+    "mcp-server-linear": 1300,
+    "@modelcontextprotocol/server-redis": 600,
+    "mongodb-mcp-server": 1500,
+    "@supabase/mcp-server-supabase": 1400,
+    "@cloudflare/mcp-server-cloudflare": 1900,
+    "stripe-mcp": 1700,
+    "@asana/mcp-server": 1200,
+};
+/**
+ * Category keywords are matched as whole tokens against the server/package name,
+ * split on non-alphanumeric characters — NOT as loose substrings. Substring
+ * matching previously caused false positives like "digital-ocean" -> vcs (via
+ * "git" inside "digital"), "research-helper" -> search-web (via "search" inside
+ * "research"), and "example-mcp" -> search-web (via "exa" inside "example").
+ */
+const CATEGORY_KEYWORDS = [
+    [["github", "gitlab", "bitbucket", "git"], "vcs"],
+    [["filesystem", "fs"], "filesystem"],
+    [["playwright", "puppeteer", "browserbase", "browser"], "browser-automation"],
+    [["postgres", "postgresql", "sqlite", "mysql", "mongo", "mongodb", "supabase", "dynamodb", "neon", "redis"], "database"],
+    [["brave", "search", "exa", "perplexity", "firecrawl"], "search-web"],
+    [["notion", "confluence", "obsidian", "docs", "context7", "drive"], "docs-knowledge"],
+    [["linear", "jira", "asana", "monday", "trello"], "project-management"],
+    [["slack", "discord", "teams", "email", "gmail"], "communication"],
+    [["figma", "framer", "webflow", "design"], "design"],
+    [["stripe", "payment", "payments"], "payments"],
+    [["aws", "cloudflare", "azure", "gcp", "terraform"], "cloud-infra"],
+    [["datadog", "sentry", "last9", "observability", "logs"], "observability"],
+];
+function tokenize(s) {
+    return new Set(s
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter(Boolean));
+}
+export function estimateTokens(packageName, kind) {
+    if (packageName && KNOWN_SERVER_TOKEN_COSTS[packageName] !== undefined) {
+        return { tokens: KNOWN_SERVER_TOKEN_COSTS[packageName], confidence: "known" };
+    }
+    // Heuristic fallback by server "shape"
+    if (kind === "remote-http")
+        return { tokens: 1500, confidence: "heuristic" };
+    if (kind === "local-binary")
+        return { tokens: 1000, confidence: "heuristic" };
+    return { tokens: 800, confidence: "heuristic" };
+}
+export function categorize(name, packageName) {
+    const tokens = tokenize(`${name} ${packageName ?? ""}`);
+    for (const [keywords, category] of CATEGORY_KEYWORDS) {
+        if (keywords.some((k) => tokens.has(k)))
+            return category;
+    }
+    return "other";
+}

package/dist/index.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { auditConfigFiles } from "./auditor.js";
+import { discoverConfigFiles, ExplicitConfigError } from "./configLocator.js";
+import { printBanner, printDiscoveredFiles, printNoConfigsFound, printReport, } from "./report.js";
+import chalk from "chalk";
+const program = new Command();
+program
+    .name("mcp-tollbooth")
+    .description("Measure the context-window toll of your MCP servers and flag duplicates. (Trust/staleness checks included as a secondary signal.)")
+    .version("0.1.0")
+    .option("-c, --config <path>", "path to a specific MCP config file to audit")
+    .option("--json", "output raw JSON instead of a formatted report")
+    .action(async (opts) => {
+    let configFiles;
+    try {
+        configFiles = discoverConfigFiles(opts.config);
+    }
+    catch (err) {
+        if (err instanceof ExplicitConfigError) {
+            if (opts.json) {
+                console.log(JSON.stringify({ error: err.message }, null, 2));
+            }
+            else {
+                if (!opts.json)
+                    printBanner();
+                console.log(chalk.red(`✗ ${err.message}`));
+            }
+            process.exitCode = 1;
+            return;
+        }
+        throw err;
+    }
+    if (!opts.json)
+        printBanner();
+    if (configFiles.length === 0) {
+        if (opts.json) {
+            console.log(JSON.stringify({ servers: [], message: "no config files found" }, null, 2));
+        }
+        else {
+            printNoConfigsFound();
+        }
+        return;
+    }
+    if (!opts.json)
+        printDiscoveredFiles(configFiles);
+    const report = await auditConfigFiles(configFiles);
+    if (opts.json) {
+        console.log(JSON.stringify(report, null, 2));
+    }
+    else {
+        printReport(report);
+    }
+});
+program.parseAsync(process.argv);

package/dist/registryInfo.js

@@ -0,0 +1,111 @@
+const NPM_REGISTRY = "https://registry.npmjs.org";
+const GITHUB_API = "https://api.github.com";
+/** Figures out roughly what kind of server this is, and pulls out an npm package name if present. */
+export function classifyServer(cfg) {
+    if (cfg.url) {
+        return { kind: "remote-http", rawCommandLine: `${cfg.transport ?? "http"} ${cfg.url}` };
+    }
+    const command = cfg.command ?? "";
+    const args = cfg.args ?? [];
+    const rawCommandLine = [command, ...args].join(" ").trim();
+    if (command === "npx") {
+        // npx -y <package> [...rest]   — first non-flag arg after -y is the package
+        const pkg = args.find((a) => !a.startsWith("-"));
+        if (pkg) {
+            return { kind: "npx-package", packageName: stripVersion(pkg), rawCommandLine };
+        }
+    }
+    if (command === "uvx" || command === "pipx") {
+        const pkg = args.find((a) => !a.startsWith("-"));
+        if (pkg) {
+            return { kind: "npx-package", packageName: stripVersion(pkg), rawCommandLine };
+        }
+    }
+    if (command) {
+        return { kind: "local-binary", rawCommandLine };
+    }
+    return { kind: "unknown", rawCommandLine: rawCommandLine || "(no command)" };
+}
+/** Strips a trailing "@version" pin from an npx-style package spec, respecting scoped packages (@scope/name@version). */
+function stripVersion(pkg) {
+    const searchFrom = pkg.startsWith("@") ? 1 : 0;
+    const atIndex = pkg.indexOf("@", searchFrom);
+    return atIndex === -1 ? pkg : pkg.slice(0, atIndex);
+}
+function parseGithubUrl(url) {
+    if (!url)
+        return null;
+    const cleaned = url
+        .replace(/^git\+/, "")
+        .replace(/\.git$/, "")
+        .replace(/^git:\/\//, "https://");
+    const match = cleaned.match(/github\.com[/:]([^/]+)\/([^/]+?)(?:\/|$)/i);
+    if (!match)
+        return null;
+    return { owner: match[1], repo: match[2] };
+}
+export async function fetchNpmPackageInfo(packageName) {
+    try {
+        const res = await fetch(`${NPM_REGISTRY}/${encodeURIComponent(packageName)}`);
+        if (!res.ok)
+            return null;
+        const data = await res.json();
+        const latestVersion = data["dist-tags"]?.latest;
+        const versionData = latestVersion ? data.versions?.[latestVersion] : undefined;
+        const repository = versionData?.repository ?? data.repository;
+        const repoUrl = typeof repository === "string" ? repository : repository?.url;
+        return {
+            name: packageName,
+            version: latestVersion,
+            repositoryUrl: repoUrl,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function fetchGithubRepoInfo(repoUrl) {
+    const parsed = parseGithubUrl(repoUrl);
+    if (!parsed)
+        return { status: "not-found" };
+    try {
+        const headers = {
+            Accept: "application/vnd.github+json",
+            "User-Agent": "mcp-tollbooth",
+        };
+        if (process.env.GITHUB_TOKEN) {
+            headers.Authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
+        }
+        const res = await fetch(`${GITHUB_API}/repos/${parsed.owner}/${parsed.repo}`, { headers });
+        if (res.status === 404)
+            return { status: "not-found" };
+        if (res.status === 403 || res.status === 429) {
+            // GitHub distinguishes rate-limit from auth-scope 403s via this header.
+            const remaining = res.headers.get("x-ratelimit-remaining");
+            if (remaining === "0" || res.status === 429)
+                return { status: "rate-limited" };
+            return { status: "error" };
+        }
+        if (!res.ok)
+            return { status: "error" };
+        const data = await res.json();
+        const pushedAt = data.pushed_at;
+        const daysSinceLastPush = Math.floor((Date.now() - new Date(pushedAt).getTime()) / (1000 * 60 * 60 * 24));
+        return {
+            status: "found",
+            info: {
+                owner: parsed.owner,
+                repo: parsed.repo,
+                stars: data.stargazers_count ?? 0,
+                openIssues: data.open_issues_count ?? 0,
+                archived: Boolean(data.archived),
+                hasLicense: Boolean(data.license),
+                daysSinceLastPush,
+                pushedAt,
+            },
+        };
+    }
+    catch {
+        return { status: "error" };
+    }
+}

package/dist/report.js

@@ -0,0 +1,96 @@
+import chalk from "chalk";
+import Table from "cli-table3";
+function scoreColor(score) {
+    if (score >= 75)
+        return chalk.green;
+    if (score >= 50)
+        return chalk.yellow;
+    return chalk.red;
+}
+function scoreLabel(score) {
+    if (score >= 75)
+        return "Healthy";
+    if (score >= 50)
+        return "Caution";
+    return "Risky";
+}
+export function printBanner() {
+    console.log(chalk.bold.cyan("\n  MCP Tollbooth") + chalk.dim("  — what your MCP servers are costing your context window\n"));
+}
+export function printNoConfigsFound() {
+    console.log(chalk.yellow("No MCP config files with servers were found in the usual locations."));
+    console.log(chalk.dim("Checked Claude Desktop, Claude Code (.mcp.json / ~/.claude.json), Cursor and VS Code configs."));
+    console.log(chalk.dim("Pass --config <path> to point at a specific file.\n"));
+}
+export function printDiscoveredFiles(files) {
+    console.log(chalk.bold("Scanned config files:"));
+    for (const f of files) {
+        console.log(`  ${chalk.dim("•")} ${f.source} ${chalk.dim(`(${f.path})`)} — ${Object.keys(f.servers).length} server(s)`);
+    }
+    console.log("");
+}
+export function printReport(report) {
+    const table = new Table({
+        head: [
+            chalk.bold("Server"),
+            chalk.bold("Category"),
+            chalk.bold("Est. Tokens"),
+            chalk.bold("Trust*"),
+            chalk.bold("Last Push"),
+            chalk.bold("Stars"),
+        ],
+        style: { head: [], border: [] },
+    });
+    // Lead with token cost — that's the number every server silently taxes you on,
+    // whether or not it turns out to be well-maintained.
+    const sorted = [...report.servers].sort((a, b) => b.estimatedTokens - a.estimatedTokens);
+    for (const s of sorted) {
+        const color = scoreColor(s.trustScore);
+        const lastPush = s.githubInfo
+            ? `${s.githubInfo.daysSinceLastPush}d ago`
+            : chalk.dim("unknown");
+        const stars = s.githubInfo ? s.githubInfo.stars.toLocaleString() : chalk.dim("—");
+        const tokenStr = s.tokenConfidence === "known"
+            ? chalk.bold(`~${s.estimatedTokens.toLocaleString()}`)
+            : chalk.dim(`~${s.estimatedTokens.toLocaleString()}*`);
+        table.push([
+            s.serverName,
+            chalk.dim(s.category),
+            tokenStr,
+            color(`${s.trustScore} ${scoreLabel(s.trustScore)}`),
+            lastPush,
+            stars,
+        ]);
+    }
+    console.log(table.toString());
+    console.log(chalk.dim("\n* Trust is a rough heuristic (repo activity, stars, license) — not a security scan. Token estimates marked with a trailing * are heuristic, not measured live (see README).\n"));
+    if (report.overlapGroups.length > 0) {
+        console.log(chalk.bold("Overlap detected — you're paying twice for the same job:"));
+        for (const group of report.overlapGroups) {
+            console.log(`  ${chalk.dim("•")} ${chalk.yellow(group.category)}: ${group.serverNames.join(", ")} — do you need all of these?`);
+        }
+        console.log("");
+    }
+    const lowTrust = sorted.filter((s) => s.trustScore < 50 && s.trustNotes.length > 0);
+    if (lowTrust.length > 0) {
+        console.log(chalk.bold("Worth a second look:\n"));
+        for (const s of lowTrust) {
+            const color = scoreColor(s.trustScore);
+            console.log(color.bold(`${s.serverName}`) + chalk.dim(`  (${s.configSource})`));
+            for (const note of s.trustNotes) {
+                console.log(`  ${chalk.dim("-")} ${note}`);
+            }
+            console.log("");
+        }
+    }
+    for (const warning of report.warnings) {
+        console.log(chalk.yellow("⚠ ") + warning);
+    }
+    const overallColor = scoreColor(report.overallScore);
+    console.log("\n" +
+        chalk.bold("Total context toll: ") +
+        chalk.bold(`~${report.totalEstimatedTokens.toLocaleString()} tokens`) +
+        chalk.dim(`  across ${report.servers.length} server(s)`) +
+        chalk.dim(`  ·  avg trust ${overallColor(`${report.overallScore}/100`)}`));
+    console.log("");
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "mcp-tollbooth",
+  "version": "0.1.0",
+  "description": "How much context are your MCP servers actually costing you? Token budget + duplicate-server detection for Claude Desktop, Claude Code, Cursor and VS Code.",
+  "keywords": ["mcp", "model-context-protocol", "claude", "claude-code", "cursor", "ai-agents", "context-window", "token-budget", "cli"],
+  "license": "MIT",
+  "type": "module",
+  "author": "Ereb-Blade",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ereb-Blade/mcp-tollbooth.git"
+  },
+  "homepage": "https://github.com/Ereb-Blade/mcp-tollbooth#readme",
+  "bugs": {
+    "url": "https://github.com/Ereb-Blade/mcp-tollbooth/issues"
+  },
+  "bin": {
+    "mcp-tollbooth": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node -e \"try{require('fs').chmodSync('dist/index.js',0o755)}catch(e){}\"",
+    "start": "node dist/index.js",
+    "dev": "tsx src/index.ts"
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "cli-table3": "^0.6.5",
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.9",
+    "tsx": "^4.16.2",
+    "typescript": "^5.5.3"
+  }
+}