Every MCP server you connect ships a set of tool-definition schemas. Those schemas get injected into every single model request for the whole session — before you ask the agent anything. That's a fixed tax on your context window and your bill, and no MCP directory lists it.
So I measured it. I pulled 25 popular Model Context Protocol servers, spawned each one locally, ran the real tools/list handshake, and counted the tokens its tool schemas add per request (chars/4, the same heuristic tokenscope uses — labelled an estimate). 16 of the 25 register their tools without live credentials, so those are measured; the rest need OAuth/remote transport or real keys and are marked not measured, never estimated.
The context-tax, measured
| Server | Tools | Tokens / request |
|---|---|---|
| notion-mcp | 24 | 19,054 |
| kubernetes | 23 | 5,964 |
| github | 26 | 4,242 |
| memory | 9 | 2,875 |
| everything | 13 | 2,031 |
| tavily | 5 | 1,924 |
| sequential-thinking | 1 | 1,176 |
| browsermcp | 12 | 1,052 |
| slack | 8 | 822 |
| google-maps | 7 | 704 |
| puppeteer | 7 | 648 |
| exa | 2 | 535 |
| brave-search | 2 | 375 |
| gitlab | 9 | 371 |
| perplexity-ask | 1 | 149 |
| postgres | 1 | 35 |
That's a 544× spread — from 35 tokens to just over 19,000, paid on every request for the life of the session. Connect notion-mcp and github together and you're near ~23k tokens of pure schema overhead before a single user turn. On a long agent run that's not a rounding error; it's most of your context budget and a real line on the bill.
The lesson isn't "don't use big servers." It's that the cost is invisible at connect time and none of the directories that rank these servers by stars/installs will tell you. You find out from the invoice.
While I had the packages open, I also scanned what they do
Same 25 servers, static source scan (nothing executed): network egress, secret-env reads, exec/shell surface. A few things worth knowing:
-
16 of 25 read a secret env var; 8 have an exec/shell surface.
upstash-context7-mcpreadsOPENAI_APPS_CHALLENGE_TOKEN+CLIENT_IP_ENCRYPTION_KEYand egresseslogin.microsoftonline.com. -
4 of 25 ship a bundled/minified dist (
exahas 293k-char lines;notion582k). You can't statically separate a minified blob into call-site hosts vs embedded strings, so I label thosebundled — egress not statically resolvablerather than render a misleading "clean."exa's bundle references an undisclosedapi.agnost.aialongsideapi.exa.ai.
Getting the egress scan honest at 25 servers was most of the work — naive scans count comment/jsdoc URLs as egress (one server "phoned home" to wikipedia.org and rfc-editor.org... from doc-strings). A host only counts as egress if its URL literal sits at an actual network call site or a declared API base.
Measure your own
The context-tax above is server-side and fixed. Your own agent's per-session cost — which server's schemas are eating your window, what a run actually cost — you can measure directly:
npx @wartzar-bee/tokenscope --demo # zero-setup: a sample cost report, no session needed
npx @wartzar-bee/tokenscope # or point it at your most recent Claude Code session
And if you want to stop cost regressions before they ship, wartzar-bee/ci-guardrail gates token cost in CI the same way you'd gate a failing test.
Everything here is reproducible from published npm packages — npm pack the servers, run the scanner, spawn each for the live tools/list. Found a cell that's wrong? The method is open; correct it.
Part of wartzar-bee — tools for building and operating cost-efficient autonomous agents. Apache-2.0.
Top comments (1)
This is the number nobody prices in at connect time, and the 544x spread makes the point better than any warning could. The notion-mcp figure (19k tokens before a single user turn) is brutal because it's not just cost — it's context you've permanently spent that can't hold task state. Two things I've found help: first, most agents never call more than a handful of a big server's tools in a given task, so lazy/on-demand schema loading (advertise a compact index, fetch the full schema only when a tool is actually selected) reclaims most of the tax — the tradeoff is an extra round-trip. Second, the char/4 heuristic is fine for ranking but under-counts on servers with deeply nested JSON-schema
$refs, since providers often expand those before tokenizing; the real bill on notion is probably worse than 19k. The security half is the sleeper finding, though — a server that reads secret env vars and has an exec surface and ships a minified bundle you can't statically resolve is three yellow flags stacking into a red one. Is tokenscope planning to output a combined context+risk score per server? That composite is what a directory should actually rank on.