MCP and the quiet tax on your context window

For chat-shaped workloads, MCP tool definitions took up 8.6% of the median prompt and 5.1% of the average, but the distribution is what matters: a quarter of prompts spent nearly 20% on schemas, and the worst cases spent almost 70%. Nothing in the conversation told you that. It was decided when you installed the server.

How the cost gets in

Every tool a server exposes arrives as a JSON schema that has to be in the prompt for the model to know the tool exists. Those schemas are re-sent on every turn, not once. A server with a generous tool list is therefore a permanent tax on every request you make, whether or not you ever call any of those tools.

Measurements across public registries put the shape of it like this: a small share of tools accounts for most of the tokens, with one high-volume integration alone responsible for over half of MCP tool tokens in one analysis. Read-only APIs with many tools and long descriptions dominate the top of the list.

A context window eaten by descriptions is context that is not holding your code. On a fixed-size window, installing servers is a decision about what you can afford to remember, and it is very easy to make that decision accidentally by adding one integration at a time.

Editorial data illustration, 16:9, flat vector. A descending bar chart of roughly twelve bars, with the first two bars dramatically taller than the rest (the long tail is very short and flat). A thin cumulative curve arcs over the top, flattening quickly. Charcoal (#121212) background, grey (#8c8c8c) outlines, the two tall bars in indigo (#5560d4) with ordered-dither dot texture, generous negative space. Mood: Pareto, decisive. No readable text, no logos, no watermark.

The second cost is not measured in tokens

Dependency scanning research published in 2026 covered 5,110 MCP servers across registries, catalogues and GitHub, and found that three quarters of servers in the official registry leaked credentials back to the publisher on the initial handshake. That includes credentials, the machine's hostname, the operating system, logged-in identity and recent tool activity.

Separately, manifest quality is poor: roughly 65% of servers ship a malformed manifest, and about a quarter of surveyed servers were flagged as actively dangerous. Most dangerous behaviour came from over-broad permission grants, credential disclosure and outright spoofing of familiar domains with non-Latin characters.

What to actually do

1. Ask what a server is for before installing it. If you have not used it in a week, disconnect it, because the schemas are still being billed every turn.
2. Prefer servers with few, well-named tools over ones that expose an entire API surface.
3. Put tools behind the same permission gate as file writes. MCP calls should not be a back door around your mode allowlist.
4. Watch for network egress during a handshake. Any credential sent before you have used the server is worth understanding.
5. Consider dropping MCP entirely for the tools you use constantly. One study found a single-skill agent beat the equivalent MCP setup, partly because the instructions had the agent plan before searching.

What Quaka does with MCP servers

Quaka connects to stdio MCP servers over JSON-RPC, prefixes their tools with mcp_, and gives each server an on or off toggle per thread. Tools injected by a server are indistinguishable from built-in ones in the log, and they pass through the same permission gate as the file and shell tools, so a server cannot grant itself something a mode has withheld.

The per-thread toggle is the cheap mitigation for the token problem: the thread that does not need your issue tracker does not carry its schemas. For what a thread's context is otherwise competing for, the cost post shows where the tokens go.

Get an invite

Quaka is in private beta.

One email when your invite is ready. macOS, Windows and Linux, bring your own key.

Email addressJoin waitlist↵

No spam. One email when your invite is ready.

Read the source on GitHub