Savings · Speed · Security — one MCP proxy
A connector is never one tool — it's a package of tools: the official GitHub server alone bundles 40+, roughly 28,000 tokens of schemas. Every server you connect dumps its whole package into your model's context — every turn, whether you use it or not. TokenThrift fixes all three things that are wrong with that: savings — your whole fleet behind four meta-tools, ~98% less context; speed — schemas arrive pre-loaded, repeat answers come from cache, parallel sessions share one warm core; security — every tool and every result passes a gateway that quarantines poison and redacts secrets. And on a Claude plan the tax spends your plan, not just your wallet: idle schemas occupy context and count toward usage caps, so sessions compact earlier and the 5-hour window runs dry sooner.
$ npx -y tokenthrift-mcp tax
npx -y tokenthrift-mcp init fixes it, undo included · free for personal use · 24+ MCP clients
npx -y tokenthrift-mcp taxSavings — how it works
The model doesn't page through 150+ schemas. It asks for a capability, gets a confident answer, and pays only for the one tool it actually uses.
find_tools("create an issue ticket")Hybrid routing — keyword plus local embeddings, sharpened by your project's own usage history — returns the best matches with a confidence verdict. No match? It says so plainly, so the model never hallucinates a tool into existence.
load_tools([...]) — often skippedOnly requested schemas enter context, compressed. High-confidence matches come back already loaded — exact call signature included, so the next action is a correct call, never a guessed argument. Idle tools evict themselves.
Results over ~1,500 tokens stay in the proxy: the model gets a preview and a result_id, then extracts just what it needs — JSON paths, grep, even read-only SQL over tabular data.
Speed
One warm shared core, cached repeats, coalesced duplicates, prefetched schemas — and a router that learns your project, so the right tool arrives first.
Local embeddings blend with keyword scoring, and every project's load/call/success history feeds back into ranking. Routing gets sharper the longer you use it — all on your machine.
One core serves every session. Ten parallel agent sessions cost the downstream RAM of one, and the second boots instantly — schemas harvested, embeddings warm.
Every subagent gets its own loaded-tool list and pays only for what it loads, while sharing one process fleet, one answer cache, one learning history. Each swarm member starts at ~500 tokens, not your full tool bill.
Bundle a routine into one custom tool. TokenThrift runs the steps inside the proxy and returns only the final answer — a 3-step routine costs the same as 1 call.
Slow read-only server under load? It gets a replica. Client with a 40-tool cap connects? The ceiling clamps itself. Anything touching your config becomes a one-click Apply in the dashboard.
Identical read-only calls are served from cache, and callers join in-flight calls instead of executing twice. Ten sessions asking a slow server the same question cost one execution.
Tokens and dollars saved, per-server load, injection flags, one-click server toggles — on 127.0.0.1, loopback-only, out of the model's reach.
Edit the config mid-session; servers join and leave live via listChanged. No restarts, no client changes.
Resources, subscriptions, templates, prompts, completion, sampling, elicitation, roots, progress. Going through TokenThrift never costs a protocol feature you'd have had directly.
A developer pays the context tax once per turn. An agent swarm pays it per agent, per turn — every subagent spawned through direct MCP re-buys the full schema bill before it does any work. Through TokenThrift each subagent gets its own tiny tool surface while the whole swarm shares one server fleet, one answer cache, one learning history.
*schema overhead per swarm run at Fable 5 input rates ($10/MTok) — $17.79 on Opus, $10.67 on Sonnet. On the 18-server power fleet, the direct-MCP bill is $83.13 per run. Bonus: parallel subagents asking the same read-only question coalesce into a single downstream execution.
The security gateway
MCP is a new attack surface: poisoned tool descriptions, rug-pulled updates, injected results, leaked credentials. A proxy is the one choke point that sees everything before your model does — TokenThrift treats that as a responsibility.
Every schema is scanned for instruction hijacks, conceal-from-user directives, exfiltration phrasing, cross-tool shadowing, and invisible-Unicode smuggling before the model ever reads it. Flagged tools become undiscoverable and uncallable.
The first-seen contract of every tool is pinned. A server that swaps in a new description or schema later gets caught — warned about, or quarantined until you re-approve it.
The nastier vector is hidden instructions inside returned data. Results, resources, prompts — even relayed elicitation dialogs — are scanned; suspicious content is bannered as untrusted or blocked outright.
API keys, GitHub/Slack/Stripe tokens, JWTs, private keys are scrubbed from results before they can enter the model's context — or a provider's logs. Exempt your vault on purpose; everything else stays scrubbed.
One JSONL record per call: tool, server, duration, tokens, redactions, plus an args hash and tool-contract hash — incident response can prove which inputs and which version of a tool produced which result.
Per-server allow/deny globs decide which tools exist at all. minimalEnv launches servers with PATH/HOME-class basics instead of your entire shell environment. Supply-chain lint flags unpinned npx pkg@latest installs.
Remote mode
Claude on web and mobile, ChatGPT's Developer Mode, and Open WebUI never spawn local processes — they only accept a server URL. tokenthrift serve exposes the same fleet over Streamable HTTP behind a capability URL (the token rides the path, since hosted clients can't send headers), with Bearer auth for clients that can. Front it with a free tunnel for the https:// hosted clients require.
Remote sessions get the full treatment: per-session tool visibility, redaction, injection scanning, quarantine. --rotate-token revokes a leaked URL instantly.
Pricing
Free for personal and non-commercial use, forever. Commercial use takes a license — checkout is a Stripe link, your signed key arrives with the receipt, and tokenthrift license install takes ten seconds. Verified offline; no accounts, no phone-home. Launch pricing: early buyers keep their rate forever.
What the context tax costs on the models people actually use — measured on a typical 5-server fleet (34,974 schema tokens kept out of context, every turn):
| Model | Input price | Saved every turn | Saved per dev / day* | Power users / day |
|---|---|---|---|---|
| Claude Fable 5 | $10.00 / MTok | $0.35 | $34.97 | $82.53 |
| Claude Opus 4.8 | $5.00 / MTok | $0.17 | $17.49 | $41.27 |
| Claude Sonnet 5 | $3.00 / MTok | $0.10 | $10.49 | $24.76 |
| Claude Haiku 4.5 | $1.00 / MTok | $0.03 | $3.50 | $8.25 |
*100 turns per developer per day. Typical fleet = the 5 most popular servers (github, filesystem, git, memory, fetch), measured at 35,574 schema tokens/turn by the live daily tax index — surveys say most MCP users run 2–7 servers. Power users = the full 18-server, 190-tool bench fleet at 83,131 tokens/turn. Before prompt-caching discounts — and cached or not, those tokens still occupy your context window every turn: slower responses, earlier compaction, less room for actual work. Set pricePerMTok to your model's rate and the dashboard does this math live.
Full terms in LICENSE.md. Savings math in the table above — every number is measured, not modeled.
Questions
No. TokenThrift is a local proxy — routing, embeddings, learning history, caches, and the audit log all live in ~/.tokenthrift/ on your machine. There's no account, no telemetry, no cloud. Remote mode is you serving your own machine, behind a token you hold.
Yes — by watching it, which beats reading it. TokenThrift is fully local: point any network monitor at it and see that nothing leaves your machine, and turn on the JSONL audit log to get a signed-hash record of every call it relays. Security findings come to you, in the chat: notices ride the next tool result, a blocked tool change asks for your approval through your client's own prompt UI (the model can't answer it), and critical events fire a desktop notification the model never touches. The npm package is small (one runtime dependency — the official MCP SDK), and every release is gated by 116 end-to-end checks plus a docs-vs-code audit that fails the build when they drift.
The real complaint behind that debate is context bloat, not the protocol — and TokenThrift refuses the either/or. It removes MCP's context tax and hands you the CLI/skill ergonomics on the same config: tokenthrift find "create an issue" routes a task from the shell, tokenthrift call invokes the tool with zero schemas in context, and tokenthrift skill generates a Claude Skill that drives your entire fleet via Bash at ~zero tokens. Want per-server affordance instead? tokenthrift skills writes one focused skill per server — every tool's exact call signature inline, sanitized and injection-scanned — and keeps them honest: when a server updates its tools, the stale skill is detected against the live contract and regenerated (--check for CI, SKILL.md.bak + --rollback to undo). Hand-written skills go stale silently; generated ones can't. One config powers the chat client, the shell, and the skills — you don't have to choose.
No. Resources (with subscriptions and templates), prompts, argument completion, sampling, elicitation, roots, and progress notifications all pass through. Read-only hints are honored. If your client could do it directly, it can do it through TokenThrift.
Yes. Personal and non-commercial use is free forever. If you use it for work, buy a license — checkout is a Stripe link, and a signed license key arrives with your receipt: tokenthrift license install <key> and you're done. The key is verified offline (Ed25519, public key baked into the package) — no key servers, no phone-home, no accounts. Locally nothing is gated; the key sets remote mode's concurrent-session cap (personal & Builder 1, Studio 5, Platform uncapped). And if TokenThrift is earning its keep on personal projects and you feel like supporting it, there's no donation button — the Builder license is the way to say thanks.
That's the rug-pull scenario, and it's covered: TokenThrift pins every tool's first-seen contract and flags or quarantines any later change. Descriptions and results are scanned for injected instructions either way, secrets are redacted from results, and tokenthrift scan runs the same checks in CI.