Mcpspend

io.github.andreisirbu91-labPublished by GitHub account andreisirbu91-labv0.2.1Updated Oct 24, 2026

Query your MCPSpend usage: cost today, top tools, recent sessions, budget projections.

VerifiedSTDIODesktop onlyDeveloper ToolsData & Analytics

Overview

AI-generated overview

Lets an assistant query MCPSpend usage data such as today's cost, top tools, recent sessions, and budget projections.

What you can do
This is the query-side MCP server for MCPSpend, a cost-tracking service for MCP tool calls. Added to an MCP client, it gives the agent tools such as get_today_cost and list_top_tools so it can report spend, most-used tools, recent sessions, and budget projections from the user's MCPSpend account. It only reads usage data; the separate proxy package is what records the calls.
When to use it
Use it when you already track MCP tool usage with MCPSpend and want to ask an assistant about cost and usage without opening the web dashboard. It is not useful on its own, since it only reads data that the MCPSpend proxy has already collected.
Requirements
Runs locally over stdio, typically via the npm package @mcpspend/mcp-server. Needs Node.js and an MCPSpend account. Tool calls require the MCPSPEND_API_KEY environment variable; the server starts and lists tools without it. MCPSPEND_ENDPOINT is optional and only needed for a self-hosted instance. Network access to the MCPSpend API is required.
Before you install
The MCPSPEND_API_KEY secret is required for tool calls and should be kept out of shared configuration. Usage data is read from a third-party service, so queries leave the machine. The server itself is read-only, but the wider MCPSpend setup includes paid plans and a proxy that streams usage metadata to the vendor.

Installation

In SourceWeft

  1. Open Mcpspend in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

MCPSpend

Know what your AI agents really cost. Real-time cost tracking for every MCP tool call across Cursor, Claude Desktop, Windsurf, and VS Code.

[smithery badge] [npm version] [Open VSX] [license] [MCPSpend MCP server]

mcpspend.com · Smithery · npm · Open VSX · Glama

[MCPSpend MCP server card]

One-command install

sh
npx --yes @mcpspend/proxy@latest init --key mcps_live_xxx

Auto-detects Claude Desktop, Cursor, Windsurf, VS Code (user + workspace), and Claude Code (user + project). Wraps every configured MCP server, leaves a .mcpspend.bak backup, and starts streaming usage to your dashboard at mcpspend.com.

Free tier: 25,000 tool calls/month, no credit card.

What's in this monorepo

PackageWhat it is
packages/proxy@mcpspend/proxy — the stdio observability proxy + wrap-http bridge for remote MCP servers. Published on npm.
packages/mcp-server@mcpspend/mcp-server — query your MCPSpend usage from inside any MCP client. Published on npm + Smithery.
packages/vscode-extensionmcpspend-vscode — IDE extension for Cursor, Windsurf, and VS Code. Published on Open VSX.
apps/apiExpress + Prisma + Postgres + BullMQ. The ingest endpoint, billing, and the new /api/mcp HTTP MCP server.
apps/dashboardNext.js dashboard at mcpspend.com.

Three ways to query your usage

Use caseHow
Web dashboardmcpspend.com/dashboard — overview, top tools, sessions, CSV export.
From any MCP client (stdio)Add @mcpspend/mcp-server to your client config — agent gains tools like get_today_cost, list_top_tools.
From any MCP client (HTTP)Point your client at https://api.mcpspend.com/api/mcp with Authorization: Bearer mcps_live_….

Pricing

PlanCalls/monthMonthlyYearly
Free25,000$0$0
Pro1,000,000$29$290 (2 months free)
Team10,000,000$99$990
Enterpriseunlimited$499$4,990

Every paid plan: 30–90 day retention, CSV/Slack export, budget alerts, role-based access.

Privacy

The proxy reports: tool name, server name, model, latency, success, approximate input/output sizes (tokens, derived from JSON length). It does not send the actual tool arguments or response bodies to MCPSpend. See Privacy Policy for the full sub-processor list (Stripe + Resend + Hostinger, all EU-hosted) and your GDPR rights.

Security

For automated scanners flagging this repo: the proxy uses child_process.spawn to wrap the user's own MCP server — that's the whole point of an observability proxy. The spawn args come from the user's local MCP-client config (Claude Desktop / Cursor / Windsurf / VS Code), never from network input. No RCE path, no privilege escalation, no arbitrary command execution. Full threat model in SECURITY.md.

  • API keys stored as SHA-256 hashes (never plaintext on the server)
  • Passwords bcrypt cost 12
  • Secrets at rest AES-256-GCM (APP_ENCRYPTION_KEY)
  • Transport HTTPS only, HSTS enabled, helmet CSP headers
  • No tool arguments or responses ever leave the user's machine
  • Per-tenant isolation every query scopes by organizationId
  • GDPR Art. 15 / 17 / 20 self-serve at mcpspend.com/dashboard/account/privacy
  • EU-hosted (Hostinger EU region)
  • SOC 2 Type I in progress with Vanta (Q4 2026)
  • DPA available for Enterprise customers

Report vulnerabilities: [email protected] · Machine-readable disclosure: https://mcpspend.com/.well-known/security.txt · Full policy: SECURITY.md · Live posture: https://mcpspend.com/security

Support the project

If MCPSpend saves you money or you just want to keep the proxy MIT and the free tier alive, you can sponsor any amount via Stripe — no account required:

💖 buy.stripe.com/00w8wPbUxe1qgK36CRbbG06

Every dollar goes back into hosting, security audits, and shipping features.

License

MIT. Use it, fork it, run it self-hosted.

© NewRzs SRL · CUI RO48756557 · Bucharest, Romania · [email protected]

Source: README.md at commit 4c18b82

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts