Your AI assistant may be spending a fortune
before you ask it anything.

We measured one tool server on one real machine. Not a vendor's slide — a .json catalogue on a laptop, counted with the same tokeniser the models use.

What we found

303,863

tokens, loaded before a word is typed

229 tools, with their full descriptions and input schemas — the way a tool server is normally connected.

1,050

tokens, same 229 tools

Listed by name, with each schema fetched only when the assistant actually reaches for that tool.

That is 289 times more expensive — and 303,863 tokens is 152% of a 200,000-token context window. Loaded the ordinary way, that one server does not fit in the model's head at all. There is no room left for your question.

The same thing, in money

Input price	Per request, before your question	At 100 requests a day
$3 per million	$0.91	$91 / day
$15 per million	$4.56	$456 / day
names only, $3 per million	$0.0032	$0.32 / day

An honest caveat we will not bury: prompt caching can cut the repeat cost of a stable prefix substantially, so the real bill is usually lower than the top row. It does not fix the other half of the problem — the window is still full, and what caching saves in money it does not give back in room to think.

Why it happens

To let an assistant use your tools, the usual approach hands it the manual for every tool up front: each name, each description, each parameter. Five ordinary apps run to tens of thousands of tokens. A large API runs to millions. Then every step of the work travels back through the model — fetch a row, return it, decide, fetch the next.

Cloudflare published the same arithmetic for their own API: 2,594 tools ≈ 1,170,000 tokens as ordinary tool definitions. Rebuilt so the assistant writes code instead, the whole API fits in two tools and about 1,000 tokens. Anthropic arrived at the same pattern independently.

What to do instead

Hand over names, not manuals. The assistant sees what exists and asks for the details of the one tool it needs. That single change is the 289× above.
Let it write a script, not forty messages. One piece of code does the whole errand in a sandbox; only the answer comes back. Models are far better at writing code than at conducting forty round trips.
Keep the keys outside the sandbox. The code should never see a credential — the supervisor holds the tokens and injects them.
Do not let code execution stand in for permission. Cloudflare says this plainly and so do we: a sandbox decides what can run, never what is allowed to. Authorisation stays in the tool handlers.

Repeat our measurement

Point this at your own tool catalogue. If your numbers differ from ours, yours are the ones that matter — that is the point of measuring.

import json, tiktoken
enc  = tiktoken.get_encoding("cl100k_base")
tools = json.load(open("your-mcp-catalog.json"))

defs  = [json.dumps({k: t[k] for k in ("name","description","inputSchema") if k in t})
         for t in tools]
print("loaded up front :", sum(len(enc.encode(s)) for s in defs))
print("names only      :", len(enc.encode(", ".join(t["name"] for t in tools))))

We build agents that do the work without eating the window.

Luxucleen builds and audits AI systems for small businesses. If something you are paying for feels slow, expensive, or forgetful, the cause is often measurable in an afternoon.

TALK TO US