I scanned 25 popular MCP servers — the hidden context-tax spans 544

Every MCP server you connect ships a set of tool-definition schemas. Those schemas get injected into every single model request for the whole session — before you ask the agent anything. That's a fixed tax on your context window and your bill, and no MCP directory lists it.

So I measured it. I pulled 25 popular Model Context Protocol servers, spawned each one locally, ran the real tools/list handshake, and counted the tokens its tool schemas add per request (chars/4, the same heuristic tokenscope uses — labelled an estimate). 16 of the 25 register their tools without live credentials, so those are measured; the rest need OAuth/remote transport or real keys and are marked not measured, never estimated.

The context-tax, measured

Server	Tools	Tokens / request
notion-mcp	24	19,054
kubernetes	23	5,964
github	26	4,242
memory	9	2,875
everything	13	2,031
tavily	5	1,924
sequential-thinking	1	1,176
browsermcp	12	1,052
slack	8	822
google-maps	7	704
puppeteer	7	648
exa	2	535
brave-search	2	375
gitlab	9	371
perplexity-ask	1	149
postgres	1	35

That's a 544× spread — from 35 tokens to just over 19,000, paid on every request for the life of the session. Connect notion-mcp and github together and you're near ~23k tokens of pure schema overhead before a single user turn. On a long agent run that's not a rounding error; it's most of your context budget and a real line on the bill.

The lesson isn't "don't use big servers." It's that the cost is invisible at connect time and none of the directories that rank these servers by stars/installs will tell you. You find out from the invoice.

While I had the packages open, I also scanned what they do

Same 25 servers, static source scan (nothing executed): network egress, secret-env reads, exec/shell surface. A few things worth knowing:

• 16 of 25 read a secret env var; 8 have an exec/shell surface. upstash-context7-mcp reads OPENAI_APPS_CHALLENGE_TOKEN + CLIENT_IP_ENCRYPTION_KEY and egresses login.microsoftonline.com.
• 4 of 25 ship a bundled/minified dist (exa has 293k-char lines; notion 582k). You can't statically separate a minified blob into call-site hosts vs embedded strings, so I label those bundled — egress not statically resolvable rather than render a misleading "clean." exa's bundle references an undisclosed api.agnost.ai alongside api.exa.ai.

Getting the egress scan honest at 25 servers was most of the work — naive scans count comment/jsdoc URLs as egress (one server "phoned home" to wikipedia.org and rfc-editor.org... from doc-strings). A host only counts as egress if its URL literal sits at an actual network call site or a declared API base.

Measure your own

The context-tax above is server-side and fixed. Your own agent's per-session cost — which server's schemas are eating your window, what a run actually cost — you can measure directly:

npx @wartzar-bee/tokenscope

And if you want to stop cost regressions before they ship, wartzar-bee/ci-guardrail gates token cost in CI the same way you'd gate a failing test.

Everything here is reproducible from published npm packages — npm pack the servers, run the scanner, spawn each for the live tools/list. Found a cell that's wrong? The method is open; correct it.

Part of wartzar-bee — tools for building and operating cost-efficient autonomous agents. Apache-2.0.