Your Agent Leaks on Three Surfaces. Here's How to See Each One.

We've spent a while building small tools to answer one nagging question: when you hand a coding agent the keys — MCP servers, file access, a shell — what is that actually costing you, beyond the obvious API bill? The answer turned out to have a clean shape. A coding agent runs on three surfaces, and each one leaks in its own quiet way: its config (what it's allowed to do), its context (what loads into the model before you type), and its session (what it actually did, turn by turn).

This is the field guide. Five small, dependency-free checks — bundled as agent-audit — one for each kind of leak. None of them is rocket science; the value is that nobody looks, because nothing tells you to.

Surface 1 — Config: the leak that steals your data

The scariest cost isn't tokens, it's a data-exfiltration path you assembled by accident. Simon Willison named the shape: the lethal trifecta. The moment your agent's granted capabilities cover all three of read private data, ingest untrusted content, and send data out — in one session — a prompt injection hidden in some web page or GitHub issue can read your secrets and ship them to an attacker. This isn't hypothetical; it shipped in production in 2025 (GitHub MCP, Supabase MCP, the EchoLeak Copilot CVE).

The trap is that no single line of your config is wrong. A scoped filesystem server, the official GitHub server, Read, WebFetch — each is fine. The danger is the union. So trifecta-scan reasons across your whole grant set (.mcp.json + the settings.json allowlist) and tells you when the three legs are all reachable — and which single grant to cut to break it (Meta's "rule of two"). Its sibling mcp-audit catches the cruder config smells: a token pasted into .mcp.json, an unpinned npx server you re-pull every session, a server pointed at $HOME.

agent-audit config .
  ● HIGH  LETHAL TRIFECTA COMPLETE — private + untrusted + exfil all reachable
  ● WARN  'github' runs an unpinned package — you execute whatever the registry serves

The fix is almost always "cut one leg" — and you can't see the leg until you measure the union.

Surface 2 — Context: the tax you pay before you type

Every MCP server you wire up ships its tools' full definitions — name, description, JSON schema — into the model's context on every turn, before your first prompt. That's a real, compounding tax. A Claude Code user measured MCP tools eating 49% of a 200k window before any work; Anthropic's own "tool search" work cites a 58-tool stack at ~55k tokens and flags >10k tokens or 10+ tools as the point to act.

mcp-budget connects to your servers the way a client does (tools/list over stdio), serializes each tool exactly as it's sent to the model, and counts it:

agent-audit context .
  ≈ 4,249 tok  github  — 26 tool(s)
  ≈ 1,020 tok  sequentialthinking — 1 tool(s)   ← one verbose tool = a whole server
  ● ≈9,665 tokens spent before your first prompt.

The lesson that surprised us: tool count isn't context cost. One tool with a 900-word description (sequentialthinking) costs as much as a nine-tool server. You have to measure the definitions, not eyeball the list. (And it's a truer number than Claude Code's /context, which over-reports MCP cost ~3× by double-counting a shared system prompt.)

Surface 3 — Session: the work you pay for twice

Once the agent starts, the transcript tells you what static config can't. Two findings, two tools.

First, redundant work. Agents re-read files they already read, re-read files they just edited (Claude Code's own harness literally says not to — the edit already confirmed it), re-run the same command. agent-waste audits a session for exactly this. On one real 3,174-turn session of ours, it found ~85,000 tokens of redundant tool results — including a MEMORY.md re-read 11 times after edits.

Second — and this is the one that reframed how we think about context — residence time. The model is stateless; every turn re-sends the entire accumulated context. So a tool result's true cost isn't its size, it's its size times how many turns it sticks around. context-carry weights every result by tokens × turns re-sent:

agent-audit session <transcript>
  ≈27,238,176 tok·turns  turn 426/3174 · an MCP result re-sent 2,748×
  ● ≈1,003,242,514 token-turns carried (1,661× the naive token sum)

A billion token-turns in one long session — because a handful of big reads loaded early and rode along on every later turn. The literature calls that ratio the amplification factor (median ~84× across 857 sessions; we didn't invent it). The actionable half: the expensive context is the big stuff that loads early, so read narrowly first, let subagents absorb big reads, and /compact before it compounds.

"But prompt caching makes this free"

The honest objection, and worth stating precisely because it's half true. Caching discounts a re-sent token to ~10% of its price, so the dollar cost of carry is real but ~10× smaller than the raw count. It is not free, it still grows with residence, and — this is the part people skip — caching does nothing for the two non-dollar costs: the re-sent tokens still fill your finite context window, and they still dilute attention ("lost in the middle" costs >30% recall when content is buried). Caching cuts the bleed, not the window pressure. So you'd still want to evict the whales even if the dollars were zero.

The whole picture, one command

Put together, the three surfaces answer three different "what is this costing me" questions:

agent-audit all .  ~/.claude/projects/<slug>/<session>.jsonl
  CONFIG   → is my grant set a data-theft path? any risky servers?
  CONTEXT  → how many tokens do my MCP servers spend before I type?
  SESSION  → what did the agent waste, and what's compounding every turn?

None of this is about distrusting agents — we run a whole company on them. It's that the convenience of "it can read anything, call anything" hides three meters you'd want on any system you're paying for. Now they're readable. Five small files, no dependencies; point them at your setup and look.

→ Talk to us if you're hardening or tuning an agent setup — it's most of what we do.

---

Each tool has its own deep-dive on deemwar.com/insights, with full prior-art credit (Willison's lethal trifecta, Invariant's MCP security work, Anthropic's context-engineering posts, the amplification-factor paper, ccusage). Everything here is heuristic and honestly labeled — estimates, not bills; the transcript format is undocumented and the tools degrade gracefully.