Skip to content

feat(mcp): codeburn mcp server exposing usage + savings to AI agents#429

Open
iamtoruk wants to merge 10 commits into
mainfrom
feat/codeburn-mcp
Open

feat(mcp): codeburn mcp server exposing usage + savings to AI agents#429
iamtoruk wants to merge 10 commits into
mainfrom
feat/codeburn-mcp

Conversation

@iamtoruk
Copy link
Copy Markdown
Member

@iamtoruk iamtoruk commented Jun 2, 2026

Summary

Adds a codeburn mcp subcommand that runs a stdio MCP server exposing CodeBurn's usage/cost data to AI agents (Claude Code, Cursor, Claude Desktop). Two tools, each returning a ready-to-display markdown table and typed structured JSON:

  • get_usage(period?, by?, limit?, include_project_names?) — headline spend, or a breakdown by project | model | task | provider. Fast (skips the optimize pass).
  • get_savings(period?, include_project_names?) — optimize findings + retry tax + routing waste (the differentiated analysis competitors don't expose).

Try it: npx codeburn mcp, or configure { "command": "npx", "args": ["-y", "codeburn", "mcp"] }.

Design highlights

  • Reuses existing aggregation — extracted status --format menubar-json's logic into buildMenubarPayloadForRange(periodInfo, opts), parity-gated by the existing menubar test; status now calls it too (one shared path).
  • Long-lived in-process server so the existing 180s parser cache amortizes; in-flight coalescing dedupes concurrent calls; pre-warms today.
  • Cheap vs. optimize split — only get_savings runs the expensive scanAndDetect; get_usage skips it.
  • Privacy — project/session names hashed (project-<6hex>) by default; include_project_names: true reveals them; absolute paths never exposed.
  • MCP best practices — read-only/closed-world/idempotent annotations, zod input + output schemas (typed structuredContent), server instructions, isError for tool-level failures, friendly empty-state, token-capped output.
  • Build@modelcontextprotocol/sdk@^1.29 + zod added as deps and externalized in tsup (not inlined into the bundle).

Testing

  • tsc --noEmit clean; 1015 tests pass (13 new: aggregator, redact, tables, in-memory-transport server tests).
  • End-to-end smoke against the built dist/cli.js mcp: a real MCP client lists both tools and get_usage today returns live data; stdout is clean JSON-RPC.

Deferred (follow-up)

Per-provider graceful degradation (degraded[]) would require changing the shared parseAllSessions loop used by every command — deferred to avoid destabilizing the parser. Failures currently surface cleanly at the tool boundary via isError. This is a pre-existing parser behavior, not introduced here.

Design spec: docs/design/codeburn-mcp.md · Implementation plan: docs/design/codeburn-mcp-plan.md

iamtoruk added 10 commits June 2, 2026 01:20
- Add per-install random salt to pseudonym hash to prevent rainbow table
  reversal of common project names
- Redact session details (dates, models) when project names are hashed
  to prevent re-identification via cost fingerprinting
- Return structuredContent in error responses to satisfy strict MCP
  clients that validate against declared outputSchema
- Remove pre-warm fire-and-forget that raced with the inflight map
- Fix empty markdown table producing malformed cells
- Add tests for session detail redaction and cross-field consistency
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant