Why your MCP servers are secretly eating 30,000 tokens per turn (and how to tree-shake them)

Christian Frascogna — Mon, 19 Oct 2026 16:55:26 +0000

If you use Claude Code, OpenAI Codex CLI, or Cursor with 4–5 MCP servers connected (GitHub, Playwright, Postgres, Notion, Linear), there is a hidden tax running on every single turn: MCP JSON tool schemas.

Before you even type a prompt, every connected MCP server dumps its full tools/list JSON schema into your context window. A single server with 20+ tools can consume 15,000 to 35,000 tokens per turn, degrading model reasoning and burning through your rate limits.

At the same time, multi-agent teams now have to maintain CLAUDE.md, hierarchical AGENTS.md (which OpenAI Codex CLI silently truncates at 32 KiB), and .cursor/rules/*.mdc — while making sure nobody accidentally commits an API key or a prompt-injection payload inside .mcp.json or .claude/skills.

To solve this locally with zero API keys and zero telemetry, I built CtxWise v1.0 (@framy2/ctxwise on npm, Apache-2.0).

What CtxWise v1.0 does in one CLI:

Live MCP Schema X-Ray & Tree-Shaking (mcp-xray)

   npx @framy2/ctxwise mcp-xray --probe-stdio

Queries your local MCP servers over stdio (tools/list), calculates the exact token cost of every individual tool schema, flags [BLOATED] tools, and lets you prune unused tools (mcp-prune) to cut startup context by 50–80%.

Supply-Chain & Prompt-Injection Firewall (shield)

   npx @framy2/ctxwise shield --fail-on-risk

Scans CLAUDE.md, AGENTS.md, .claude/skills, and .mcp.json for leaked credentials (sk-ant-..., sk-proj-..., AWS, GitHub PATs), prompt-injection overrides, and hidden Trojan Source Unicode characters.

Multi-Agent Rule Sync + Lossless Token Diet (sync --compress)

   npx @framy2/ctxwise sync --compress

Synchronizes CLAUDE.md <-> AGENTS.md <-> .cursor/rules/ctxwise.mdc and compresses comments, blank lines, and duplicate bullets (~18–30% token reduction) while keeping fenced code blocks intact.

OpenAI Codex CLI 32 KiB Doctor (codex-doctor)

   npx @framy2/ctxwise codex-doctor

Audits your directory chain of AGENTS.override.md and AGENTS.md against Codex CLI's 32,768-byte limit (project_doc_max_bytes) and validates .codex/config.toml.

1-Line GitHub Action (FramY2/ctxwise@v1) Drop uses: FramY2/ctxwise@v1 into .github/workflows/ci.yml to block secret leaks, prompt injections, and context bloat on every Pull Request with inline annotations and a Job Summary table.

Links:

GitHub Repository: https://github.com/FramY2/ctxwise (Stars and good first issue stack preset PRs are super welcome!)
npm Package: @framy2/ctxwise

How to audit MCP tool schema token bloat and sync CLAUDE.md with AGENTS.md locally

Christian Frascogna — Mon, 19 Oct 2026 16:16:40 +0000

If you connect 4–5 MCP servers to Claude Code or OpenAI Codex (GitHub, Playwright, Postgres, Notion), their tools/list JSON schemas silently consume 15,000–35,000 tokens on every turn before you even type a prompt.

On top of that, repositories using both Claude Code (CLAUDE.md) and OpenAI Codex (AGENTS.md) or Cursor (.cursor/rules) quickly suffer from rule drift or accidentally include exposed keys / covert prompt injections inside third-party skills.

I just released CtxWise v1.0 (@framy2/ctxwise, Apache-2.0, 100% local, zero API calls, zero telemetry) to inspect and fix all three in <50ms:


text
$ npx @framy2/ctxwise mcp-xray --probe-stdio
CtxWise mcp-xray · 4 MCP servers · 24 tool schemas · ~18,420 tokens/turn
  [BLOATED] ~2,840 tok · github/create_or_update_pull_request (19 params)
  [BLOATED] ~1,920 tok · playwright/browser_snapshot_dom (15 params)
  -> Tree-shaking savings: ~4,760 tokens saved on every single turn

$ npx @framy2/ctxwise agents && npx @framy2/ctxwise sync --compress
CtxWise multi-agent · parity: synced · Claude ~410 tok · Codex ~410 tok
  Synced AGENTS.md <-> CLAUDE.md <-> .cursor/rules/ctxwise.mdc (-34% Token Diet)

$ npx @framy2/ctxwise shield --fail-on-risk
  [HIGH] .mcp.json:14 — Hardcoded Anthropic API Key (sk-ant-api03-REDACTED)
  [HIGH] .claude/skills/helper/SKILL.md:42 — Covert HTML comment prompt injection
![ ](https://dev-to-uploads.s3.us-east-2.amazonaws.com/uploads/articles/sz8s53ecr7mnxhhl2hz2.png)

DEV Community: Christian Frascogna

Why your MCP servers are secretly eating 30,000 tokens per turn (and how to tree-shake them)

What CtxWise v1.0 does in one CLI:

How to audit MCP tool schema token bloat and sync CLAUDE.md with AGENTS.md locally