mcpcost 0.2.0 → 0.3.0

package/README.md

@@ -11,7 +11,7 @@ Every MCP server you configure hands your agent its tool definitions at the star
 ```
 $ npx mcpcost --config .mcp.json --tools 3
 
-mcpcost 0.2.0 · tool definitions your agent loads before the first prompt
+mcpcost 0.3.0 · tool definitions your agent loads before the first prompt
   .mcp.json
 
   server      source     result               tools  tokens  of 200k

package/dist/auth-cli.d.ts

@@ -0,0 +1 @@
+export declare function authCommand(argv: string[]): Promise<number>;

package/dist/auth-cli.js

@@ -0,0 +1,194 @@
+/**
+ * `mcpcost auth`: the consent step for a server that needs auth, once, in the
+ * user's browser. The result lands in the credentials file; every later
+ * measurement of that URL uses it and refreshes the token on its own.
+ */
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { parseArgs } from 'node:util';
+import { auth } from '@modelcontextprotocol/sdk/client/auth.js';
+import { credentialKey, createProvider, credentialsFor, defaultCredentialsPath, describeEntry, loadCredentials, saveCredentials } from './credentials.js';
+import { probeRemote } from './probe.js';
+const HELP = `mcpcost auth: store credentials for a server that needs auth
+
+Usage
+  mcpcost auth <url>                        OAuth: register, open the browser for the consent, store the tokens
+  mcpcost auth <url> --header "Name: value" store a static header instead (repeatable)
+  mcpcost auth --list                       what the credentials file holds, without the secrets
+  mcpcost auth <url> --remove               forget the entry for this URL
+
+Options
+  --credentials <file>   the credentials file (default ~/.mcpcost/credentials.json, or $MCPCOST_CREDENTIALS)
+  --scope <scope>        scope to ask for in the OAuth flow
+  --no-open              print the authorization URL, do not open the browser
+  --timeout <ms>         how long to wait for the consent (default 300000)
+
+After the consent the server is measured once with the new credentials, so you see that it works.
+The daily board uses the same file through its MCPCOST credentials table; see the README.`;
+function openBrowser(url) {
+    const [cmd, args] = process.platform === 'darwin' ? ['open', [url]] : process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url.replace(/&/g, '^&')]] : ['xdg-open', [url]];
+    try {
+        const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
+        child.on('error', () => undefined);
+        child.unref();
+    }
+    catch {
+        // The URL is printed too.
+    }
+}
+/** Waits for one GET /callback?code=…&state=… on a local port. */
+function callbackServer(expectedState, timeoutMs) {
+    return new Promise((resolveServer, rejectServer) => {
+        let resolveCode = () => undefined;
+        let rejectCode = () => undefined;
+        const code = new Promise((res, rej) => {
+            resolveCode = res;
+            rejectCode = rej;
+        });
+        const server = createServer((req, res) => {
+            const u = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (u.pathname !== '/callback') {
+                res.writeHead(404).end();
+                return;
+            }
+            const error = u.searchParams.get('error');
+            const received = u.searchParams.get('code');
+            const state = u.searchParams.get('state');
+            res.setHeader('content-type', 'text/html; charset=utf-8');
+            if (error || !received) {
+                res.writeHead(400).end(`<p>mcpcost: the authorization failed: ${error ?? 'no code'}. You can close this tab.</p>`);
+                rejectCode(new Error(`authorization failed: ${error ?? 'no code in the callback'} ${u.searchParams.get('error_description') ?? ''}`.trim()));
+                return;
+            }
+            if (expectedState() && state !== expectedState()) {
+                res.writeHead(400).end('<p>mcpcost: the state did not match. You can close this tab.</p>');
+                rejectCode(new Error('the state in the callback did not match'));
+                return;
+            }
+            res.writeHead(200).end('<p>mcpcost: authorized. You can close this tab and go back to the terminal.</p>');
+            resolveCode(received);
+        });
+        const timer = setTimeout(() => rejectCode(new Error(`no callback within ${Math.round(timeoutMs / 1000)} s`)), timeoutMs);
+        timer.unref();
+        server.on('error', rejectServer);
+        server.listen(0, '127.0.0.1', () => {
+            const port = server.address().port;
+            resolveServer({ redirectUrl: `http://127.0.0.1:${port}/callback`, code, close: () => { clearTimeout(timer); server.close(); } });
+        });
+    });
+}
+export async function authCommand(argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        options: {
+            header: { type: 'string', multiple: true },
+            credentials: { type: 'string' },
+            list: { type: 'boolean', default: false },
+            remove: { type: 'boolean', default: false },
+            scope: { type: 'string' },
+            'no-open': { type: 'boolean', default: false },
+            timeout: { type: 'string', default: '300000' },
+            help: { type: 'boolean', default: false }
+        },
+        allowPositionals: true
+    });
+    if (values.help) {
+        console.log(HELP);
+        return 0;
+    }
+    const file = values.credentials ?? defaultCredentialsPath();
+    const store = await loadCredentials(file);
+    if (values.list) {
+        const keys = Object.keys(store.servers);
+        if (!keys.length)
+            console.log(`${file}: no credentials stored`);
+        for (const k of keys)
+            console.log(`${k}\n  ${describeEntry(store.servers[k])}`);
+        return 0;
+    }
+    const raw = positionals[0];
+    if (!raw) {
+        console.error(HELP);
+        return 2;
+    }
+    let key;
+    try {
+        key = credentialKey(raw);
+    }
+    catch {
+        console.error(`${raw} is not a URL`);
+        return 2;
+    }
+    if (values.remove) {
+        if (store.servers[key]) {
+            delete store.servers[key];
+            await saveCredentials(store, file);
+            console.log(`${key}: removed from ${file}`);
+        }
+        else
+            console.log(`${key}: nothing stored`);
+        return 0;
+    }
+    if (values.header?.length) {
+        const entry = (store.servers[key] ??= {});
+        entry.headers ??= {};
+        for (const h of values.header) {
+            const i = h.indexOf(':');
+            if (i <= 0) {
+                console.error(`--header wants "Name: value", got ${JSON.stringify(h)}`);
+                return 2;
+            }
+            entry.headers[h.slice(0, i).trim()] = h.slice(i + 1).trim();
+        }
+        await saveCredentials(store, file);
+        console.log(`${key}: ${describeEntry(entry)} stored in ${file}`);
+        return verify(store, key);
+    }
+    // The OAuth flow: discovery, registration, the consent in the browser, the token.
+    const timeoutMs = Number(values.timeout) || 300_000;
+    const cb = await callbackServer(() => provider.lastState, timeoutMs);
+    const provider = createProvider(store, key, {
+        redirectUrl: cb.redirectUrl,
+        scope: values.scope,
+        onRedirect: (url) => {
+            console.log(`\nOpen this URL and allow the access:\n  ${url}\n`);
+            if (!values['no-open'])
+                openBrowser(url.toString());
+            console.log('Waiting for the consent…');
+        }
+    });
+    try {
+        const first = await auth(provider, { serverUrl: key });
+        if (first === 'REDIRECT') {
+            const code = await cb.code;
+            const second = await auth(provider, { serverUrl: key, authorizationCode: code });
+            if (second !== 'AUTHORIZED')
+                throw new Error(`unexpected result ${second}`);
+        }
+        await saveCredentials(store, file);
+        console.log(`${key}: ${describeEntry(store.servers[key])} stored in ${file}`);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (provider.changed)
+            await saveCredentials(store, file);
+        console.error(`${key}: the OAuth flow failed: ${message}`);
+        console.error('If the server takes an API key instead, store it with: mcpcost auth <url> --header "Authorization: Bearer …"');
+        return 1;
+    }
+    finally {
+        cb.close();
+    }
+    return verify(store, key);
+}
+/** One measurement with the stored credentials, so the user sees the result. */
+async function verify(store, key) {
+    const creds = credentialsFor(store, key);
+    const type = /\/sse\/?$/.test(new URL(key).pathname) ? 'sse' : 'streamable-http';
+    const r = await probeRemote({ url: key, type }, { timeoutMs: 20_000, headers: creds?.headers, authProvider: creds?.authProvider, includeTools: false });
+    if (r.status === 'ok')
+        console.log(`measured: alive, ${r.toolCount} tools, ${r.toolsTokens?.toLocaleString('en-US')} tokens (o200k estimate)`);
+    else
+        console.log(`measured: ${r.status}${r.httpStatus ? ` (HTTP ${r.httpStatus})` : ''}${r.error ? `: ${r.error.split('\n')[0].slice(0, 160)}` : ''}`);
+    return r.status === 'ok' ? 0 : 1;
+}

package/dist/cli.js

@@ -7,11 +7,13 @@ import { discoverConfigs, readConfigFile } from './configs.js';
 import { probeRemote, VERSION } from './probe.js';
 import { probeStdio } from './stdio.js';
 import { TOKENIZER } from './tokens.js';
+import { loadCredentials, saveCredentials, credentialsFor, defaultCredentialsPath } from './credentials.js';
 const HELP = `mcpcost ${VERSION}: how many tokens do your MCP servers cost before the first prompt?
 
 Usage
   mcpcost [options]                 measure every server in the configs it can find
   mcpcost mcp                       serve the same measurements as an MCP server over stdio
+  mcpcost auth <url>                store credentials for a server that needs auth (see mcpcost auth --help)
   mcpcost --config <file>           measure one config file (repeatable)
   mcpcost --url <url>               measure one remote server (repeatable)
   mcpcost --stdio "<command args>"  measure one local server (repeatable)
@@ -22,14 +24,18 @@ Options
   --tools <n>          list the n most expensive tools of each server (default 0)
   --claude             exact counts from the Anthropic count_tokens endpoint (free, needs ANTHROPIC_API_KEY)
   --model <id>         model for --claude (default claude-opus-5-5)
+  --gemini             exact counts from the Gemini countTokens endpoint (free, needs GEMINI_API_KEY)
+  --gemini-model <id>  model for --gemini (default gemini-3.8-flash)
   --timeout <ms>       per server (default 15000)
   --no-stdio           do not start local servers, only measure remote ones
+  --credentials <file> credentials for servers that need auth (default ~/.mcpcost/credentials.json)
   --json               machine-readable output
   --help, --version
 
 Config files it looks for: .mcp.json, ~/.claude.json, Claude Desktop, Cursor, VS Code, Windsurf, Gemini CLI.
 Without --claude, tokens are an estimate: ${TOKENIZER} over name, description and input schema of each tool.
 With --claude, the exact count for the model is shown too, as published and with the Claude Code mcp__<server>__ prefix.
+With --gemini, the exact count for Gemini is shown too. With both, --budget and the percentages use the Claude count.
 The same probe runs the public board at https://mcpcost.ulehla.dev`;
 export async function main(argv) {
     if (argv[0] === 'mcp') {
@@ -37,6 +43,10 @@ export async function main(argv) {
         await serveStdio();
         return new Promise(() => undefined);
     }
+    if (argv[0] === 'auth') {
+        const { authCommand } = await import('./auth-cli.js');
+        return authCommand(argv.slice(1));
+    }
     const { values } = parseArgs({
         args: argv,
         options: {
@@ -48,8 +58,11 @@ export async function main(argv) {
             tools: { type: 'string', default: '0' },
             timeout: { type: 'string', default: '15000' },
             'no-stdio': { type: 'boolean', default: false },
+            credentials: { type: 'string' },
             claude: { type: 'boolean', default: false },
             model: { type: 'string' },
+            gemini: { type: 'boolean', default: false },
+            'gemini-model': { type: 'string' },
             json: { type: 'boolean', default: false },
             help: { type: 'boolean', default: false },
             version: { type: 'boolean', default: false }
@@ -74,6 +87,12 @@ export async function main(argv) {
         return 2;
     }
     const claudeFor = (serverName) => (values.claude && apiKey ? { apiKey, model: values.model, serverName } : undefined);
+    const geminiKey = process.env.GEMINI_API_KEY;
+    if (values.gemini && !geminiKey) {
+        console.error('--gemini needs GEMINI_API_KEY in the environment. Only the free countTokens endpoint is called.');
+        return 2;
+    }
+    const gemini = values.gemini && geminiKey ? { apiKey: geminiKey, model: values['gemini-model'] } : undefined;
     const servers = [];
     const sources = [];
     if (values.config?.length) {
@@ -105,6 +124,17 @@ export async function main(argv) {
             return 2;
         }
     }
+    // Credentials for servers that need auth. The file is optional; a missing default file means none.
+    const credentialsFile = values.credentials ?? defaultCredentialsPath();
+    let store = null;
+    try {
+        store = await loadCredentials(credentialsFile);
+    }
+    catch (e) {
+        console.error(`cannot read ${credentialsFile}: ${e instanceof Error ? e.message : String(e)}`);
+        return 2;
+    }
+    const providers = [];
     const rows = [];
     const running = [];
     for (const s of servers) {
@@ -118,26 +148,47 @@ export async function main(argv) {
             row.skipped = 'local server, --no-stdio';
             continue;
         }
+        let headers = s.headers;
+        let authProvider;
+        if (s.kind === 'remote' && store) {
+            const creds = credentialsFor(store, s.url);
+            if (creds) {
+                // Headers from the config win; the stored ones fill in what the config leaves out.
+                if (creds.headers)
+                    headers = { ...creds.headers, ...(s.headers ?? {}) };
+                authProvider = creds.authProvider;
+                if (authProvider)
+                    providers.push(authProvider);
+                row.withCredentials = true;
+            }
+        }
         const job = s.kind === 'remote'
-            ? probeRemote({ url: s.url, type: s.type ?? 'streamable-http' }, { timeoutMs, headers: s.headers, claude: claudeFor(s.name) })
-            : probeStdio({ command: s.command, args: s.args, env: s.env, cwd: s.cwd }, { timeoutMs, claude: claudeFor(s.name) });
+            ? probeRemote({ url: s.url, type: s.type ?? 'streamable-http' }, { timeoutMs, headers, authProvider, claude: claudeFor(s.name), gemini })
+            : probeStdio({ command: s.command, args: s.args, env: s.env, cwd: s.cwd }, { timeoutMs, claude: claudeFor(s.name), gemini });
         running.push(job.then((r) => void (row.result = r)));
     }
     await Promise.all(running);
+    // A refreshed token goes back to the file.
+    if (store && providers.some((p) => p.changed))
+        await saveCredentials(store, credentialsFile).catch((e) => console.error(`cannot write ${credentialsFile}: ${e instanceof Error ? e.message : String(e)}`));
     const measured = rows.filter((r) => r.result?.status === 'ok');
-    const exact = values.claude;
-    /** The number a row is ranked and budgeted by: the exact Claude count with --claude, else the estimate. */
-    const cost = (r) => (exact ? r.result?.claude?.tokens : r.result?.toolsTokens);
+    /** The number a row is ranked and budgeted by: the exact Claude count with --claude, else the Gemini count with --gemini, else the estimate. */
+    const basis = values.claude ? 'claude' : values.gemini ? 'gemini' : 'estimate';
+    const exact = basis !== 'estimate';
+    const cost = (r) => (basis === 'claude' ? r.result?.claude?.tokens : basis === 'gemini' ? r.result?.gemini?.tokens : r.result?.toolsTokens);
     const total = measured.reduce((a, r) => a + (cost(r) ?? 0), 0);
     const totalEstimate = measured.reduce((a, r) => a + (r.result?.toolsTokens ?? 0), 0);
     const totalTools = measured.reduce((a, r) => a + (r.result?.toolCount ?? 0), 0);
-    const model = measured.find((r) => r.result?.claude?.model)?.result?.claude?.model ?? values.model ?? 'claude-opus-5-5';
+    const model = basis === 'gemini'
+        ? (measured.find((r) => r.result?.gemini?.model)?.result?.gemini?.model ?? values['gemini-model'] ?? 'gemini-3.8-flash')
+        : (measured.find((r) => r.result?.claude?.model)?.result?.claude?.model ?? values.model ?? 'claude-opus-5-5');
+    const geminiModel = measured.find((r) => r.result?.gemini?.model)?.result?.gemini?.model ?? values['gemini-model'] ?? 'gemini-3.8-flash';
     rows.sort((a, b) => (cost(b) ?? -1) - (cost(a) ?? -1));
     if (values.json) {
         console.log(JSON.stringify({
             version: VERSION,
             tokenizer: TOKENIZER,
-            exact: exact ? { endpoint: 'count_tokens', model } : null,
+            exact: basis === 'claude' ? { endpoint: 'count_tokens', model, provider: 'anthropic' } : basis === 'gemini' ? { endpoint: 'countTokens', model, provider: 'google' } : null,
             window,
             sources,
             total: { servers: measured.length, tools: totalTools, tokens: total, tokensEstimate: totalEstimate, shareOfWindow: total / window },
@@ -147,13 +198,19 @@ export async function main(argv) {
                 kind: r.kind,
                 target: r.target,
                 skipped: r.skipped,
+                withCredentials: r.withCredentials || undefined,
                 status: r.result?.status,
                 error: r.result?.error,
                 toolCount: r.result?.toolCount,
+                /** The number the row is ranked and budgeted by, on the basis above. */
+                tokens: cost(r),
                 toolsTokens: r.result?.toolsTokens,
                 claudeTokens: r.result?.claude?.tokens,
                 claudeTokensClaudeCode: r.result?.claude?.tokensClaudeCode,
                 claudeError: r.result?.claude?.error,
+                geminiTokens: r.result?.gemini?.tokens,
+                geminiModel: r.result?.gemini?.model,
+                geminiError: r.result?.gemini?.error,
                 shareOfWindow: cost(r) != null ? cost(r) / window : undefined,
                 initializeMs: r.result?.latencyMs.initialize,
                 toolsListMs: r.result?.latencyMs.toolsList,
@@ -163,7 +220,7 @@ export async function main(argv) {
         }, null, 2));
     }
     else {
-        console.log(render(rows, { window, total, totalTools, topTools, sources, exact, model, cost }));
+        console.log(render(rows, { window, total, totalTools, topTools, sources, basis, model, geminiModel, withGemini: Boolean(gemini), cost }));
     }
     if (budget !== undefined && total > budget) {
         console.error(`\nOver budget: ${fmt(total)} tokens, the budget is ${fmt(budget)}.`);
@@ -190,9 +247,9 @@ function statusText(r) {
     if (!s)
         return '';
     if (s === 'ok')
-        return 'alive';
+        return r.withCredentials ? 'alive (credentials)' : 'alive';
     if (s === 'auth')
-        return `needs auth${r.result?.authScheme ? ` (${r.result.authScheme})` : ''}`;
+        return `needs auth${r.result?.authScheme ? ` (${r.result.authScheme})` : ''}${r.withCredentials ? ', stored credentials refused' : ''}`;
     if (s === 'payment')
         return 'payment required';
     if (s === 'newer_protocol')
@@ -202,6 +259,7 @@ function statusText(r) {
     return s.replace('_', ' ');
 }
 function render(rows, o) {
+    const claude = o.basis === 'claude';
     const lines = [];
     lines.push(`mcpcost ${VERSION} · tool definitions your agent loads before the first prompt`);
     if (o.sources.length)
@@ -212,28 +270,38 @@ function render(rows, o) {
         return lines.join('\n');
     }
     const table = [
-        o.exact
-            ? ['server', 'source', 'result', 'tools', 'claude', 'claude code', 'o200k', `of ${Math.round(o.window / 1000)}k`]
-            : ['server', 'source', 'result', 'tools', 'tokens', `of ${Math.round(o.window / 1000)}k`]
+        [
+            'server', 'source', 'result', 'tools',
+            ...(claude ? ['claude', 'claude code'] : []),
+            ...(o.withGemini ? ['gemini'] : []),
+            o.basis === 'estimate' ? 'tokens' : 'o200k',
+            `of ${Math.round(o.window / 1000)}k`
+        ]
     ];
+    const exactCell = (n, error) => (n != null ? fmt(n) : error ? 'refused' : '');
     for (const r of rows) {
         const ok = r.result?.status === 'ok';
         const c = r.result?.claude;
+        const g = r.result?.gemini;
         table.push([
             r.name.length > 28 ? r.name.slice(0, 27) + '…' : r.name,
             shortSource(r.source).replace(/^.*\//, ''),
             statusText(r),
             ok ? fmt(r.result?.toolCount) : '',
-            ...(o.exact ? [ok ? (c?.tokens != null ? fmt(c.tokens) : c?.error ? 'refused' : '') : '', ok ? fmt(c?.tokensClaudeCode) : ''] : []),
+            ...(claude ? [ok ? exactCell(c?.tokens, c?.error) : '', ok ? fmt(c?.tokensClaudeCode) : ''] : []),
+            ...(o.withGemini ? [ok ? exactCell(g?.tokens, g?.error) : ''] : []),
             ok ? fmt(r.result?.toolsTokens) : '',
             ok && o.cost(r) != null ? pct(o.cost(r), o.window) : ''
         ]);
     }
     const totalEstimate = rows.reduce((a, r) => a + (r.result?.status === 'ok' ? (r.result.toolsTokens ?? 0) : 0), 0);
     const totalCc = rows.reduce((a, r) => a + (r.result?.claude?.tokensClaudeCode ?? 0), 0);
+    const totalClaude = rows.reduce((a, r) => a + (r.result?.claude?.tokens ?? 0), 0);
+    const totalGemini = rows.reduce((a, r) => a + (r.result?.gemini?.tokens ?? 0), 0);
     table.push([
         'total', '', `${rows.filter((r) => r.result?.status === 'ok').length} of ${rows.length} measured`, fmt(o.totalTools),
-        ...(o.exact ? [fmt(o.total), fmt(totalCc)] : []),
+        ...(claude ? [fmt(totalClaude), fmt(totalCc)] : []),
+        ...(o.withGemini ? [fmt(totalGemini)] : []),
         fmt(totalEstimate), pct(o.total, o.window)
     ]);
     const widths = table[0].map((_, i) => Math.max(...table.map((row) => row[i].length)));
@@ -261,12 +329,16 @@ function render(rows, o) {
             }
         }
     }
-    if (o.exact) {
-        lines.push('', `  claude: exact count from the Anthropic count_tokens endpoint for ${o.model}. claude code: the same with the mcp__<server>__ prefix on each tool name.`);
+    if (o.basis !== 'estimate') {
+        lines.push('');
+        if (claude)
+            lines.push(`  claude: exact count from the Anthropic count_tokens endpoint for ${o.model}. claude code: the same with the mcp__<server>__ prefix on each tool name.`);
+        if (o.withGemini)
+            lines.push(`  gemini: exact count from the Gemini countTokens endpoint for ${o.geminiModel}.`);
         lines.push(`  o200k: the estimate without a key, ${TOKENIZER} over name, description and input schema. "refused": the endpoint did not accept the schema.`);
-        const refused = rows.filter((r) => r.result?.claude?.error);
+        const refused = rows.filter((r) => r.result?.claude?.error || r.result?.gemini?.error);
         for (const r of refused)
-            lines.push(`  ${r.name}: ${r.result.claude.error.slice(0, 160)}`);
+            lines.push(`  ${r.name}: ${(r.result.claude?.error ?? r.result.gemini?.error).slice(0, 160)}`);
     }
     else {
         lines.push('', `  Estimated with ${TOKENIZER} over name, description and input schema of each tool. Claude counts about 1.9 times this. Add --claude for the exact count.`);

package/dist/core.d.ts

@@ -1,7 +1,8 @@
 import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
 import type { ProbeResult, ProbeStatus, RemoteTransport } from './types.js';
-export declare const VERSION = "0.2.0";
-export declare const USER_AGENT = "mcpcost/0.2.0 (mcpcost; +https://github.com/ondraulehla/mcpcost)";
+export declare const VERSION = "0.3.0";
+export declare const USER_AGENT = "mcpcost/0.3.0 (mcpcost; +https://github.com/ondraulehla/mcpcost)";
 export interface RawTool {
     name: string;
     description?: string;
@@ -12,6 +13,8 @@ export interface CoreOptions {
     timeoutMs?: number;
     /** Extra request headers, for example an Authorization header from your config. */
     headers?: Record<string, string>;
+    /** An OAuth client with stored tokens; the transport sends them and refreshes them. See credentials.ts. */
+    authProvider?: OAuthClientProvider;
     fetch?: typeof fetch;
 }
 export interface RawProbe {

package/dist/core.js

@@ -6,7 +6,7 @@
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
-export const VERSION = '0.2.0';
+export const VERSION = '0.3.0';
 export const USER_AGENT = `mcpcost/${VERSION} (mcpcost; +https://github.com/ondraulehla/mcpcost)`;
 export function emptyResult(url, transport) {
     return { url, transport, probedAt: new Date().toISOString(), status: 'error', latencyMs: {} };
@@ -44,8 +44,8 @@ export async function probeRemoteRaw(remote, options = {}) {
     // Follow redirects across origins too: a server that moved should be measured where it lives.
     const requestInit = { headers: options.headers };
     const transport = remote.type === 'sse'
-        ? new SSEClientTransport(url, { fetch: observingFetch, requestInit, redirectPolicy: 'follow' })
-        : new StreamableHTTPClientTransport(url, { fetch: observingFetch, requestInit, redirectPolicy: 'follow' });
+        ? new SSEClientTransport(url, { fetch: observingFetch, requestInit, redirectPolicy: 'follow', authProvider: options.authProvider })
+        : new StreamableHTTPClientTransport(url, { fetch: observingFetch, requestInit, redirectPolicy: 'follow', authProvider: options.authProvider });
     const tools = await measure(transport, result, timeoutMs);
     if (result.status === 'ok') {
         result.httpStatus = first?.status;

package/dist/credentials.d.ts

@@ -0,0 +1,52 @@
+import type { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+export interface OAuthEntry {
+    clientInformation?: OAuthClientInformationMixed;
+    tokens?: OAuthTokens;
+    discovery?: OAuthDiscoveryState;
+    scope?: string;
+    /** When the user last went through the consent step. */
+    authorizedAt?: string;
+}
+export interface CredentialEntry {
+    /** Static request headers, for example an Authorization header with an API key. */
+    headers?: Record<string, string>;
+    /** The state of the MCP OAuth flow for this server. */
+    oauth?: OAuthEntry;
+}
+export interface CredentialStore {
+    version: 1;
+    servers: Record<string, CredentialEntry>;
+}
+export declare function defaultCredentialsPath(): string;
+/** The key of a server in the store: its URL without fragment or trailing slash. */
+export declare function credentialKey(url: string): string;
+export declare function emptyStore(): CredentialStore;
+export declare function loadCredentials(file?: string): Promise<CredentialStore>;
+/** Writes the store with mode 0600; the directory is created when needed. */
+export declare function saveCredentials(store: CredentialStore, file?: string): Promise<void>;
+export declare function entryFor(store: CredentialStore, url: string): CredentialEntry | undefined;
+/** What an entry holds, without a secret value in it. */
+export declare function describeEntry(entry: CredentialEntry): string;
+export interface ProviderOptions {
+    /** Where the authorization server sends the user back. Any URL for a non-interactive provider. */
+    redirectUrl?: string;
+    /** Called with the authorization URL when the user has to consent. Without it the provider refuses, so a batch run never hangs. */
+    onRedirect?: (url: URL) => void | Promise<void>;
+    /** Called after every write to the store. */
+    onChange?: () => void;
+    scope?: string;
+}
+export interface FileProvider extends OAuthClientProvider {
+    /** True once the provider wrote to the store. */
+    readonly changed: boolean;
+    /** The state parameter of the authorization request, for the callback check. */
+    readonly lastState: string | undefined;
+}
+/** An OAuthClientProvider over one entry of the store. */
+export declare function createProvider(store: CredentialStore, url: string, options?: ProviderOptions): FileProvider;
+/** What a probe needs for a URL: static headers, an OAuth provider, or nothing. */
+export declare function credentialsFor(store: CredentialStore, url: string, options?: ProviderOptions): {
+    headers?: Record<string, string>;
+    authProvider?: FileProvider;
+} | undefined;

package/dist/credentials.js

@@ -0,0 +1,163 @@
+/**
+ * Credentials for servers that need auth: static headers, or OAuth client
+ * information and tokens from the MCP authorization flow. One JSON file,
+ * keyed by server URL, written with mode 0600. The provider below implements
+ * the SDK's OAuthClientProvider over that file, so a transport refreshes
+ * tokens on its own and the refreshed tokens land back in the file.
+ *
+ * Node only: the Worker never imports this file.
+ */
+import { existsSync } from 'node:fs';
+import { chmod, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import { homedir } from 'node:os';
+import path from 'node:path';
+export function defaultCredentialsPath() {
+    return process.env.MCPCOST_CREDENTIALS || path.join(homedir(), '.mcpcost', 'credentials.json');
+}
+/** The key of a server in the store: its URL without fragment or trailing slash. */
+export function credentialKey(url) {
+    const u = new URL(url);
+    u.hash = '';
+    return u.toString().replace(/\/$/, '');
+}
+export function emptyStore() {
+    return { version: 1, servers: {} };
+}
+export async function loadCredentials(file = defaultCredentialsPath()) {
+    if (!existsSync(file))
+        return emptyStore();
+    const parsed = JSON.parse(await readFile(file, 'utf8'));
+    return { version: 1, servers: parsed.servers ?? {} };
+}
+/** Writes the store with mode 0600; the directory is created when needed. */
+export async function saveCredentials(store, file = defaultCredentialsPath()) {
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    await writeFile(file, JSON.stringify(store, null, 2) + '\n', { mode: 0o600 });
+    if (process.platform !== 'win32')
+        await chmod(file, 0o600);
+}
+export function entryFor(store, url) {
+    try {
+        return store.servers[credentialKey(url)];
+    }
+    catch {
+        return undefined;
+    }
+}
+/** What an entry holds, without a secret value in it. */
+export function describeEntry(entry) {
+    const parts = [];
+    if (entry.headers)
+        parts.push(`headers: ${Object.keys(entry.headers).join(', ')}`);
+    if (entry.oauth) {
+        const t = entry.oauth.tokens;
+        parts.push(t
+            ? `oauth: ${t.refresh_token ? 'access and refresh token' : 'access token only'}${entry.oauth.authorizedAt ? `, authorized ${entry.oauth.authorizedAt.slice(0, 10)}` : ''}`
+            : entry.oauth.clientInformation
+                ? 'oauth: client registered, no token yet'
+                : 'oauth: nothing yet');
+    }
+    return parts.join('; ') || 'empty';
+}
+/** An OAuthClientProvider over one entry of the store. */
+export function createProvider(store, url, options = {}) {
+    const key = credentialKey(url);
+    const entry = (store.servers[key] ??= {});
+    const oauth = (entry.oauth ??= {});
+    if (options.scope)
+        oauth.scope = options.scope;
+    const redirectUrl = options.redirectUrl ?? 'http://127.0.0.1/callback';
+    let changed = false;
+    let verifier;
+    let state;
+    const touched = () => {
+        changed = true;
+        options.onChange?.();
+    };
+    return {
+        get changed() {
+            return changed;
+        },
+        get lastState() {
+            return state;
+        },
+        get redirectUrl() {
+            return redirectUrl;
+        },
+        get clientMetadata() {
+            return {
+                client_name: 'mcpcost',
+                client_uri: 'https://mcpcost.ulehla.dev',
+                redirect_uris: [redirectUrl],
+                grant_types: ['authorization_code', 'refresh_token'],
+                response_types: ['code'],
+                token_endpoint_auth_method: 'none',
+                ...(oauth.scope ? { scope: oauth.scope } : {})
+            };
+        },
+        state() {
+            state = randomBytes(16).toString('hex');
+            return state;
+        },
+        clientInformation() {
+            return oauth.clientInformation;
+        },
+        saveClientInformation(info) {
+            oauth.clientInformation = info;
+            touched();
+        },
+        tokens() {
+            return oauth.tokens;
+        },
+        saveTokens(tokens) {
+            oauth.tokens = tokens;
+            oauth.authorizedAt ??= new Date().toISOString();
+            touched();
+        },
+        async redirectToAuthorization(authorizationUrl) {
+            if (!options.onRedirect)
+                throw new Error(`${key} needs the consent step: run "mcpcost auth ${key}"`);
+            await options.onRedirect(authorizationUrl);
+        },
+        saveCodeVerifier(v) {
+            verifier = v;
+        },
+        codeVerifier() {
+            if (!verifier)
+                throw new Error('no code verifier: the authorization did not start in this process');
+            return verifier;
+        },
+        saveDiscoveryState(s) {
+            oauth.discovery = s;
+            touched();
+        },
+        discoveryState() {
+            return oauth.discovery;
+        },
+        invalidateCredentials(scope) {
+            if (scope === 'all' || scope === 'tokens')
+                delete oauth.tokens;
+            if (scope === 'all' || scope === 'client')
+                delete oauth.clientInformation;
+            if (scope === 'all' || scope === 'discovery')
+                delete oauth.discovery;
+            if (scope === 'all' || scope === 'verifier')
+                verifier = undefined;
+            if (scope !== 'verifier')
+                touched();
+        }
+    };
+}
+/** What a probe needs for a URL: static headers, an OAuth provider, or nothing. */
+export function credentialsFor(store, url, options = {}) {
+    const entry = entryFor(store, url);
+    if (!entry)
+        return undefined;
+    const out = {};
+    if (entry.headers && Object.keys(entry.headers).length)
+        out.headers = { ...entry.headers };
+    if (entry.oauth?.tokens || entry.oauth?.clientInformation)
+        out.authProvider = createProvider(store, url, options);
+    return out.headers || out.authProvider ? out : undefined;
+}

package/dist/gemini.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Exact token counts from the Gemini countTokens endpoint. The endpoint is free
+ * and calls no model. Same method as claude.ts: one request with a marker
+ * function plus the server's tools, one with the marker only, and the
+ * difference is what the tool definitions add for this model.
+ *
+ * Function declarations go in as `parametersJsonSchema`, so the server's JSON
+ * Schema is sent as it is, not converted to the OpenAPI subset.
+ *
+ * This file has no Node dependencies, so the Worker can import it too.
+ */
+import type { ToolLike } from './payload.js';
+import type { Limiter } from './claude.js';
+export declare const GEMINI_MODEL = "gemini-3.8-flash";
+export declare const GEMINI_API_URL = "https://generativelanguage.googleapis.com/v1beta/models";
+export interface GeminiCountOptions {
+    apiKey: string;
+    /** Model id. Default gemini-3.8-flash. */
+    model?: string;
+    fetch?: typeof fetch;
+    /** Retries on 429 and 5xx. Default 5. */
+    retries?: number;
+    /** Timeout for one request. Default 30 s. */
+    timeoutMs?: number;
+    /** Shared rate limiter from createLimiter, for many servers in one process. */
+    limiter?: Limiter;
+}
+export interface GeminiCount {
+    model: string;
+    /** Tokens the tool definitions add to a request. */
+    tokens: number;
+}
+/** The answer when Gemini refuses to count, for example on a schema it does not accept. */
+export declare class GeminiCountError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+/** The tool list as a Gemini function declaration list. Names are made safe and unique. */
+export declare function toGeminiDeclarations(tools: ToolLike[]): Array<{
+    name: string;
+    description: string;
+    parametersJsonSchema: unknown;
+}>;
+/** Exact tokens these tool definitions add to a request for this model. */
+export declare function countGeminiTokens(tools: ToolLike[], options: GeminiCountOptions): Promise<GeminiCount>;

package/dist/gemini.js

@@ -0,0 +1,86 @@
+export const GEMINI_MODEL = 'gemini-3.8-flash';
+export const GEMINI_API_URL = 'https://generativelanguage.googleapis.com/v1beta/models';
+/** The answer when Gemini refuses to count, for example on a schema it does not accept. */
+export class GeminiCountError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = 'GeminiCountError';
+    }
+}
+const MARKER = { name: 'mcpcost_marker', description: 'marker', parametersJsonSchema: { type: 'object', properties: {} } };
+const CONTENTS = [{ role: 'user', parts: [{ text: 'hi' }] }];
+/** Gemini function names: letters, digits, underscores, colons, dots and dashes, at most 64 characters. */
+const safeName = (name) => name.replace(/[^a-zA-Z0-9_:.-]/g, '_').slice(0, 64) || 'tool';
+/** The tool list as a Gemini function declaration list. Names are made safe and unique. */
+export function toGeminiDeclarations(tools) {
+    const seen = new Map();
+    return tools.map((t) => {
+        let name = safeName(t.name);
+        const n = seen.get(name) ?? 0;
+        seen.set(name, n + 1);
+        if (n)
+            name = `${name.slice(0, 60)}_${n + 1}`;
+        return {
+            name,
+            // The field is required; an empty description is sent as a space.
+            description: t.description || ' ',
+            parametersJsonSchema: t.inputSchema ?? { type: 'object', properties: {} }
+        };
+    });
+}
+async function countRequest(model, declarations, options) {
+    const doFetch = options.fetch ?? fetch;
+    const retries = options.retries ?? 5;
+    const body = { generateContentRequest: { model: `models/${model}`, contents: CONTENTS, tools: [{ functionDeclarations: declarations }] } };
+    for (let attempt = 0;; attempt++) {
+        if (options.limiter)
+            await options.limiter.wait();
+        let res;
+        try {
+            res = await doFetch(`${GEMINI_API_URL}/${model}:countTokens`, {
+                method: 'POST',
+                headers: { 'x-goog-api-key': options.apiKey, 'content-type': 'application/json' },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(options.timeoutMs ?? 30_000)
+            });
+        }
+        catch (e) {
+            if (attempt < retries) {
+                await new Promise((r) => setTimeout(r, 1000 * 2 ** attempt));
+                continue;
+            }
+            throw new GeminiCountError(e instanceof Error ? e.message : String(e), 0);
+        }
+        if ((res.status === 429 || res.status >= 500) && attempt < retries) {
+            const wait = Number(res.headers.get('retry-after')) * 1000 || 1500 * 2 ** attempt;
+            await new Promise((r) => setTimeout(r, Math.min(wait, 30_000)));
+            continue;
+        }
+        const json = (await res.json().catch(() => ({})));
+        if (!res.ok)
+            throw new GeminiCountError((json.error?.message ?? `HTTP ${res.status}`).slice(0, 300), res.status);
+        return json.totalTokens ?? 0;
+    }
+}
+const baselines = new Map();
+/** Tokens of the message plus the marker function, once per model and process. */
+function baseline(model, options) {
+    let p = baselines.get(model);
+    if (!p) {
+        p = countRequest(model, [MARKER], options);
+        p.catch(() => baselines.delete(model));
+        baselines.set(model, p);
+    }
+    return p;
+}
+/** Exact tokens these tool definitions add to a request for this model. */
+export async function countGeminiTokens(tools, options) {
+    const model = options.model ?? GEMINI_MODEL;
+    if (!tools.length)
+        return { model, tokens: 0 };
+    const base = await baseline(model, options);
+    const withTools = await countRequest(model, [MARKER, ...toGeminiDeclarations(tools)], options);
+    return { model, tokens: Math.max(0, withTools - base) };
+}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { fetchRegistry, primaryRemote, hostOf, REGISTRY_URL } from './registry.js';
 export { probeRemote, USER_AGENT, VERSION } from './probe.js';
-export type { ProbeOptions, ClaudeOptions } from './probe.js';
+export type { ProbeOptions, ClaudeOptions, GeminiOptions } from './probe.js';
 export { probeStdio, probeStdioRaw } from './stdio.js';
 export { measure, emptyResult } from './core.js';
 export type { RawTool } from './core.js';
@@ -11,6 +11,10 @@ export { toolCost, toolsCost, toolPayload, countTokens, TOKENIZER } from './toke
 export type { ToolLike } from './tokens.js';
 export { countClaudeTokens, countForServer, claudeCodePrefix, toApiTools, createLimiter, ClaudeCountError, CLAUDE_MODEL } from './claude.js';
 export type { ClaudeCountOptions, ClaudeCount, Limiter } from './claude.js';
+export { countGeminiTokens, toGeminiDeclarations, GeminiCountError, GEMINI_MODEL } from './gemini.js';
+export type { GeminiCountOptions, GeminiCount } from './gemini.js';
 export type * from './types.js';
 export { GATED_STATUSES } from './types.js';
 export { buildServer } from './mcp.js';
+export { loadCredentials, saveCredentials, defaultCredentialsPath, credentialKey, credentialsFor, createProvider, entryFor, describeEntry } from './credentials.js';
+export type { CredentialStore, CredentialEntry, OAuthEntry, FileProvider, ProviderOptions } from './credentials.js';

package/dist/index.js

@@ -5,5 +5,7 @@ export { measure, emptyResult } from './core.js';
 export { discoverConfigs, readConfigFile, normalizeServers, knownConfigPaths, expand } from './configs.js';
 export { toolCost, toolsCost, toolPayload, countTokens, TOKENIZER } from './tokens.js';
 export { countClaudeTokens, countForServer, claudeCodePrefix, toApiTools, createLimiter, ClaudeCountError, CLAUDE_MODEL } from './claude.js';
+export { countGeminiTokens, toGeminiDeclarations, GeminiCountError, GEMINI_MODEL } from './gemini.js';
 export { GATED_STATUSES } from './types.js';
 export { buildServer } from './mcp.js';
+export { loadCredentials, saveCredentials, defaultCredentialsPath, credentialKey, credentialsFor, createProvider, entryFor, describeEntry } from './credentials.js';

package/dist/probe.d.ts

@@ -10,12 +10,22 @@ export interface ClaudeOptions {
     /** The server key in the client config, for the Claude Code mcp__<server>__ prefix. Default: the host or the command. */
     serverName?: string;
 }
+export interface GeminiOptions {
+    /** Gemini API key. Only the free countTokens endpoint is called. */
+    apiKey: string;
+    /** Model id. Default gemini-3.8-flash. */
+    model?: string;
+}
 export interface ProbeOptions extends CoreOptions {
     /** Keep the per-tool list in the result. Default true. */
     includeTools?: boolean;
     /** Also ask the Anthropic count_tokens endpoint for the exact count. */
     claude?: ClaudeOptions;
+    /** Also ask the Gemini countTokens endpoint for the exact count. */
+    gemini?: GeminiOptions;
 }
+/** Adds the exact Gemini count to an alive result. A refused schema becomes `gemini.error`; a transport failure leaves `gemini` empty. */
+export declare function attachGemini(result: ProbeResult, tools: RawTool[], gemini: GeminiOptions | undefined): Promise<ProbeResult>;
 /** Adds the exact Claude count to an alive result. A refused schema becomes `claude.error`; a transport failure leaves `claude` empty. */
 export declare function attachClaude(result: ProbeResult, tools: RawTool[], claude: ClaudeOptions | undefined): Promise<ProbeResult>;
 /** Adds the token cost of the listed tools to a probe result. */

package/dist/probe.js

@@ -1,7 +1,24 @@
 import { probeRemoteRaw } from './core.js';
 import { toolsCost } from './tokens.js';
 import { countForServer, ClaudeCountError, CLAUDE_MODEL } from './claude.js';
+import { countGeminiTokens, GeminiCountError, GEMINI_MODEL } from './gemini.js';
 export { VERSION, USER_AGENT, emptyResult, measure, classify } from './core.js';
+/** Adds the exact Gemini count to an alive result. A refused schema becomes `gemini.error`; a transport failure leaves `gemini` empty. */
+export async function attachGemini(result, tools, gemini) {
+    if (!gemini || result.status !== 'ok')
+        return result;
+    const measuredAt = new Date().toISOString();
+    try {
+        const c = await countGeminiTokens(tools, { apiKey: gemini.apiKey, model: gemini.model });
+        result.gemini = { model: c.model, tokens: c.tokens, measuredAt };
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        if (e instanceof GeminiCountError && e.status >= 400 && e.status < 500 && e.status !== 429)
+            result.gemini = { model: gemini.model ?? GEMINI_MODEL, measuredAt, error: message };
+    }
+    return result;
+}
 /** Adds the exact Claude count to an alive result. A refused schema becomes `claude.error`; a transport failure leaves `claude` empty. */
 export async function attachClaude(result, tools, claude) {
     if (!claude || result.status !== 'ok')
@@ -35,5 +52,6 @@ export function priceTools(result, tools, includeTools = true) {
 export async function probeRemote(remote, options = {}) {
     const { result, tools } = await probeRemoteRaw(remote, options);
     priceTools(result, tools, options.includeTools ?? true);
-    return attachClaude(result, tools, options.claude);
+    await attachClaude(result, tools, options.claude);
+    return attachGemini(result, tools, options.gemini);
 }

package/dist/stdio.js

@@ -1,10 +1,11 @@
 import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/sdk/client/stdio.js';
-import { emptyResult, measure, priceTools, attachClaude } from './probe.js';
+import { emptyResult, measure, priceTools, attachClaude, attachGemini } from './probe.js';
 /** Starts a local MCP server over stdio, lists its tools and measures what it costs. */
 export async function probeStdio(target, options = {}) {
     const { result, tools } = await probeStdioRaw(target, options);
     priceTools(result, tools, options.includeTools ?? true);
     await attachClaude(result, tools, options.claude);
+    await attachGemini(result, tools, options.gemini);
     return result;
 }
 /** The same, with the tool definitions as the server sent them, for callers that count tokens their own way. */

package/dist/types.d.ts

@@ -102,6 +102,17 @@ export interface ProbeResult {
     tools?: ToolCost[];
     /** Exact count from the Anthropic count_tokens endpoint, when a key was available. */
     claude?: ClaudeTokens;
+    /** Exact count from the Gemini countTokens endpoint, when a key was available. */
+    gemini?: GeminiTokens;
+    error?: string;
+}
+export interface GeminiTokens {
+    /** Model id the count was made for, for example gemini-3.8-flash. */
+    model: string;
+    /** Tokens the tool definitions add, from the Gemini countTokens endpoint. */
+    tokens?: number;
+    measuredAt: string;
+    /** Why the count failed, for example a schema the API does not accept. */
     error?: string;
 }
 export interface ClaudeTokens {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcpcost",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "What do your MCP servers cost in context tokens? Measures every server in your config, exact counts for Claude, a budget for CI.",
   "keywords": [
     "mcp",