Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/atuljha23/holocronWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/atuljha23/holocron/mcp-audit)<a href="https://agentmods.dev/commands/atuljha23/holocron/mcp-audit"><img src="https://agentmods.dev/badge/commands/atuljha23/holocron/mcp-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/atuljha23/holocron/mcp-audit"><img src="https://agentmods.dev/badge/commands/atuljha23/holocron/mcp-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00527 |
| Opus 5 | $0.00023 | $0.00264 |
| Sonnet 5 | $0.00009 | $0.00105 |
| Haiku 4.5 | $0.00005 | $0.00053 |
Grade A, and why
mcp-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- `~/.claude/settings.json` — user settings Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
What it actually says
/holocron:mcp-audit
Audit the MCP footprint.
Gather
-
Enumerate servers — look in these places for MCP configs (read whichever exist):
~/.claude.json— user-level MCP servers~/.claude/settings.json— user settings./.claude/settings.json— project settings./.mcp.json— project-level MCP registration- Plugin-level MCP configs under
~/.claude/plugins/marketplaces/*/\.mcp.jsonor~/.claude/plugins/cache/*/.mcp.json
-
For each server: list the tools it exposes (from the current session's tool manifest, which you see in your system prompt's tool list). For each tool, estimate schema size in tokens (roughly
JSON.stringify(schema).length / 4). -
Identify:
- Heavy servers — >2 MCP servers active, or a single server contributing >10 tools / >3k tokens of schema
- Unused servers — servers whose tools you haven't invoked in the current session (if you can tell)
- Duplicates — two servers that expose similar capability (e.g. two search providers)
Output
## MCP footprint
Total MCP servers: <N>
Total MCP tools: <N>
Estimated schema tokens per turn: ~<N>
## By server
- <server-name> — <N tools>, ~<N> tokens of schema
- <tool-a>, <tool-b>, ...
- Used this session: <tools invoked, or "none observed">
## Recommendations
- Disable: <server> — <reason>
- Keep: <server> — <reason>
- Consolidate: <server-a> and <server-b> — <reason>
Disabling an MCP server
In your Claude Code settings, add it to mcpServers.<name>.disabled: true, or remove the server entry entirely and reload.
Do not
- Recommend disabling a server you don't understand the purpose of. Ask.
- Flag servers as "heavy" without a concrete token estimate — "heavy" alone is noise.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 54 lines · 45 tokens per session scan A cb9abb0dda1e
mcp-audit is a command published in the GitHub repository atuljha23/holocron (2 stars, last pushed 4mo ago), licensed MIT. It adds 45 tokens to every session and 527 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
learn
Learn Claude Code best practices and capture lessons into persistent memory.
insights
Surface patterns from your pro-workflow learnings and session history.
wiki
Build, query, and maintain long-lived knowledge bases. Each wiki = markdown folder + SQLite FTS5 shadow index. Survives sessions, indexes auto-load on SessionStart.
commit
Create a well-crafted commit after running pro-workflow quality checks.
handoff
Generate a structured handoff document that another Claude session (or your future self) can consume immediately to continue where you left off.
context-optimizer
Diagnose and fix context window problems.