AI Usage
NPM · AI-USAGE-MCP · SCANNED SEP 20
Reports real token usage and cost from Claude Code and OpenCode data. Nothing leaves your machine.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 97 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to MohitBansal321/ai-usage-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3755 tokens (~312/item across 12 items; 9 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management57
- Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the AI Usage MCP server?
AI Usage runs locally as an npm package, launched with npx -y ai-usage-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · ai-usage-mcp
claude mcp add mohitbansal321-ai-usage-mcp -- npx -y ai-usage-mcp
{
"mcpServers": {
"mohitbansal321-ai-usage-mcp": {
"command": "npx",
"args": [
"-y",
"ai-usage-mcp"
]
}
}
} {
"servers": {
"mohitbansal321-ai-usage-mcp": {
"command": "npx",
"args": [
"-y",
"ai-usage-mcp"
]
}
}
} codex mcp add mohitbansal321-ai-usage-mcp -- npx -y ai-usage-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mohitbansal321-ai-usage-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"ai-usage-mcp"
],
"enabled": true
}
}
} openclaw mcp add mohitbansal321-ai-usage-mcp --command npx --arg -y --arg ai-usage-mcp
mcp_servers:
mohitbansal321-ai-usage-mcp:
command: "npx"
args: ["-y", "ai-usage-mcp"] {
"McpServers": {
"mohitbansal321-ai-usage-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"ai-usage-mcp"
]
}
}
} assistant mcp add mohitbansal321-ai-usage-mcp -t stdio -c npx -a -y ai-usage-mcp
{
"mcpServers": {
"mohitbansal321-ai-usage-mcp": {
"command": "npx",
"args": [
"-y",
"ai-usage-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.47 → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 0.8.0 → 0.9.0 functional
- 17 Sept 26 0
- Stability: 0.43 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Schema quality: 181 → 310 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 0.7.0 → 0.8.0 functional
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +26
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.85 ▲ functional
- 10 Sept 26 −22
- Known CVEs: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Schema quality: 164 → 181 ▼ functional
- Dependency health: 0.85 → unverified ▼ functional
- Stability: unverified → 0.23 ▲ functional
- Package version: 0.5.1 → 0.7.0 functional
- Package version: 0.5.1 → 0.6.0 functional
- 4 Sept 26 +10
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.85 ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/ai-usage-mcp@0.9.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | MohitBansal321/ai-usage-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/MohitBansal321/ai-usage-mcp/.github/workflows/release.yml@refs/tags/v0.9.0 |
| Rekor log index | 2883412474 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:f884a29d14e0f093584debcba127222e3e2cd70cf16f1c6244ff7b9fd9e3596d290ef6c8c8266cfd3114fb20dc97066db21917b0d50a79049f5a82108 |
Background: How many MCP packages publish verified provenance →
Dependencies 97 packages
| Packages resolved | 97 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
client_usage Usage by client ~386
Token usage and cost per coding agent (Claude Code vs OpenCode). Note that the two cost figures are not comparable as a single number: OpenCode reports actual charged cost, while the Claude Code figure is an API-equivalent estimate (a Pro/Max subscription has $0 marginal cost per request).
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Look back this many days, counted from local midnight. Omit for all time. |
| includeSubagents | boolean | – | Include subagent/sidechain turns. Defaults to true, because they are real spend. Set false to see only main-thread turns. |
| limit | integer | – | Rows to return. |
| models | array | – | Restrict to any of these model ids, exactly as the client recorded them. Use model_usage to see the ids present. |
| offset | integer | – | Rows to skip, for paging. Use the `nextOffset` from the previous result. |
| projectPath | string | – | Deprecated spelling of projectPaths, for one project. Still honoured. |
| projectPaths | array | – | Restrict to any of these projects, given as the absolute working directories the turns ran in. Each must match exactly; use project_usage to see the available paths. A value matching no record anywhe… |
| since | string | – | ISO 8601 start of the period (inclusive). |
| sort | string | – | Row ordering, descending. There is deliberately no plain "cost": reported and estimated cost are separate figures that are never summed, so ordering by one sorts every row priced on the other basis a… |
| today | boolean | – | Restrict to today, in local time. |
| until | string | – | ISO 8601 end of the period (exclusive). |
No output schema declared.
No examples provided.
counterfactual_cost Cost on another model ~528
What the tokens from a period would have cost at another model’s list rates, alongside what they actually cost. Use this for "would Sonnet have been cheaper than Opus for this". It re-prices the exact token counts that were recorded, grouped by client, model and speed so the fast-mode premium and the two different reasoning-token conventions are handled correctly. Also reports what the same tokens would have cost with NO prompt caching at all, per model -- which is the figure that says whether caching is paying for itself. IMPORTANT: the model scenarios are a counterfactual, not a saving — the same task on a different model generally takes a different number of turns with a different context on each, and nothing on disk can say what that would have been. Report it as such, keep every scenario labelled an estimate, and never subtract a scenario from the reported cost to claim a number.
| Name | Type | Req | Description |
|---|---|---|---|
| client | – | – | Restrict to any of these clients. A single client id is also accepted. |
| days | integer | – | Look back this many days, counted from local midnight. Omit for all time. |
| filterModels | array | – | Restrict which turns are included, by model id -- the same scope filter other tools spell `models`. Named apart here because `models` already meant "price against these" on this tool. Use both togeth… |
| includeSubagents | boolean | – | Include subagent/sidechain turns. Defaults to true, because they are real spend. Set false to see only main-thread turns. |
| models | array | – | Deprecated spelling of targetModels. Still honoured. |
| projectPath | string | – | Deprecated spelling of projectPaths, for one project. Still honoured. |
| projectPaths | array | – | Restrict to any of these projects, given as the absolute working directories the turns ran in. Each must match exactly; use project_usage to see the available paths. A value matching no record anywhe… |
| since | string | – | ISO 8601 start of the period (inclusive). |
| targetModels | array | – | Models to price the selected tokens AGAINST. Not a filter on which turns are included -- that is `filterModels`. Omit to compare every model the pricing table knows. A model with no price is omitted… |
| today | boolean | – | Restrict to today, in local time. |
| until | string | – | ISO 8601 end of the period (exclusive). |
No output schema declared.
No examples provided.
daily_usage Usage by day ~421
Token usage and cost bucketed on the time axis, newest first. Use this for "how much did I use yesterday", for a trend over a period, or -- with grain "hour-of-day" -- for "when during the day do I burn tokens". Buckets with NO activity are included and flagged `zeroFilled`, because omitting them hides the gaps and makes an ordinary bucket look like a spike beside one weeks earlier. All buckets are local time, so they agree with the period filter rather than drifting by a timezone offset. Cost is labelled reported vs estimated per bucket.
| Name | Type | Req | Description |
|---|---|---|---|
| client | – | – | Restrict to any of these clients. A single client id is also accepted. |
| days | integer | – | Look back this many days, counted from local midnight. Omit for all time. |
| grain | string | – | Time bucket (default day). "hour" is a finer timeline; "hour-of-day" collapses every day onto one 24-slot local clock, which is what answers "when during the day do I burn tokens". All are local time… |
| includeSubagents | boolean | – | Include subagent/sidechain turns. Defaults to true, because they are real spend. Set false to see only main-thread turns. |
| models | array | – | Restrict to any of these model ids, exactly as the client recorded them. Use model_usage to see the ids present. |
| projectPath | string | – | Deprecated spelling of projectPaths, for one project. Still honoured. |
| projectPaths | array | – | Restrict to any of these projects, given as the absolute working directories the turns ran in. Each must match exactly; use project_usage to see the available paths. A value matching no record anywhe… |
| since | string | – | ISO 8601 start of the period (inclusive). |
| today | boolean | – | Restrict to today, in local time. |
| until | string | – | ISO 8601 end of the period (exclusive). |
No output schema declared.
No examples provided.
model_usage Usage by model ~379
Per-model token usage and cost, highest token count first. Use this to answer "which model consumed the most tokens". Cost is labelled reported vs estimated per model.
| Name | Type | Req | Description |
|---|---|---|---|
| client | – | – | Restrict to any of these clients. A single client id is also accepted. |
| days | integer | – | Look back this many days, counted from local midnight. Omit for all time. |
| includeSubagents | boolean | – | Include subagent/sidechain turns. Defaults to true, because they are real spend. Set false to see only main-thread turns. |
| limit | integer | – | Rows to return. |
| models | array | – | Restrict to any of these model ids, exactly as the client recorded them. Use model_usage to see the ids present. |
| offset | integer | – | Rows to skip, for paging. Use the `nextOffset` from the previous result. |
| projectPath | string | – | Deprecated spelling of projectPaths, for one project. Still honoured. |
| projectPaths | array | – | Restrict to any of these projects, given as the absolute working directories the turns ran in. Each must match exactly; use project_usage to see the available paths. A value matching no record anywhe… |
| since | string | – | ISO 8601 start of the period (inclusive). |
| sort | string | – | Row ordering, descending. There is deliberately no plain "cost": reported and estimated cost are separate figures that are never summed, so ordering by one sorts every row priced on the other basis a… |
| today | boolean | – | Restrict to today, in local time. |
| until | string | – | ISO 8601 end of the period (exclusive). |
No output schema declared.
No examples provided.
project_usage Usage by project ~409
Per-project token usage and cost, highest token count first. A project is the working directory a turn ran in. Use this to answer "which repository is my spend going to". Turns whose project could not be resolved are grouped as (unknown) rather than dropped, and cost is labelled reported vs estimated per project.
| Name | Type | Req | Description |
|---|---|---|---|
| client | – | – | Restrict to any of these clients. A single client id is also accepted. |
| days | integer | – | Look back this many days, counted from local midnight. Omit for all time. |
| includeSubagents | boolean | – | Include subagent/sidechain turns. Defaults to true, because they are real spend. Set false to see only main-thread turns. |
| limit | integer | – | Rows to return. |
| models | array | – | Restrict to any of these model ids, exactly as the client recorded them. Use model_usage to see the ids present. |
| offset | integer | – | Rows to skip, for paging. Use the `nextOffset` from the previous result. |
| projectPath | string | – | Deprecated spelling of projectPaths, for one project. Still honoured. |
| projectPaths | array | – | Restrict to any of these projects, given as the absolute working directories the turns ran in. Each must match exactly; use project_usage to see the available paths. A value matching no record anywhe… |
| since | string | – | ISO 8601 start of the period (inclusive). |
| sort | string | – | Row ordering, descending. There is deliberately no plain "cost": reported and estimated cost are separate figures that are never summed, so ordering by one sorts every row priced on the other basis a… |
| today | boolean | – | Restrict to today, in local time. |
| until | string | – | ISO 8601 end of the period (exclusive). |
No output schema declared.
No examples provided.
recent_sessions Recent sessions ~377
Most recently active sessions with project path, client, model(s), duration, token breakdown and cost. Use the returned session id with session_usage for detail.
| Name | Type | Req | Description |
|---|---|---|---|
| client | – | – | Restrict to any of these clients. A single client id is also accepted. |
| days | integer | – | Look back this many days, counted from local midnight. Omit for all time. |
| includeSubagents | boolean | – | Include subagent/sidechain turns. Defaults to true, because they are real spend. Set false to see only main-thread turns. |
| limit | integer | – | Rows to return. |
| models | array | – | Restrict to any of these model ids, exactly as the client recorded them. Use model_usage to see the ids present. |
| offset | integer | – | Rows to skip, for paging. Use the `nextOffset` from the previous result. |
| projectPath | string | – | Deprecated spelling of projectPaths, for one project. Still honoured. |
| projectPaths | array | – | Restrict to any of these projects, given as the absolute working directories the turns ran in. Each must match exactly; use project_usage to see the available paths. A value matching no record anywhe… |
| since | string | – | ISO 8601 start of the period (inclusive). |
| sort | string | – | Row ordering, descending. There is deliberately no plain "cost": reported and estimated cost are separate figures that are never summed, so ordering by one sorts every row priced on the other basis a… |
| today | boolean | – | Restrict to today, in local time. |
| until | string | – | ISO 8601 end of the period (exclusive). |
No output schema declared.
No examples provided.
session_usage Session usage ~90
Usage for one session: client, model(s), duration, token breakdown and cost. Accepts a full session id or an unambiguous fragment of one. Subagent turns are reported separately from main-thread turns.
| Name | Type | Req | Description |
|---|---|---|---|
| includeSubagents | boolean | – | Include subagent turns in the totals. Defaults to true. |
| sessionId | string | yes | Session id, or an unambiguous part of one. |
No output schema declared.
No examples provided.
usage_breakdown Usage broken down by two dimensions ~519
Token usage and cost cut by two or more dimensions at once -- project x day, model x day, client x day -- as one tidy row set. Use this for "which of my projects is getting more expensive", which the single-axis tools cannot answer: project_usage gives a total with no trend, and daily_usage narrowed to one project gives one series, so answering it otherwise means enumerating projects and issuing one call each. Combinations with no activity are absent rather than returned as zero rows. Cost stays labelled reported vs estimated per row and the two are never summed.
| Name | Type | Req | Description |
|---|---|---|---|
| axes | array | yes | Dimensions to cross, in output order: client, model, provider, project, session, day, hour, hour-of-day. At most 3, and each at most once. The time axes bucket in local time, identically to daily_usa… |
| client | – | – | Restrict to any of these clients. A single client id is also accepted. |
| days | integer | – | Look back this many days, counted from local midnight. Omit for all time. |
| includeSubagents | boolean | – | Include subagent/sidechain turns. Defaults to true, because they are real spend. Set false to see only main-thread turns. |
| limit | integer | – | Rows to return. |
| models | array | – | Restrict to any of these model ids, exactly as the client recorded them. Use model_usage to see the ids present. |
| offset | integer | – | Rows to skip, for paging. Use the `nextOffset` from the previous result. |
| projectPath | string | – | Deprecated spelling of projectPaths, for one project. Still honoured. |
| projectPaths | array | – | Restrict to any of these projects, given as the absolute working directories the turns ran in. Each must match exactly; use project_usage to see the available paths. A value matching no record anywhe… |
| since | string | – | ISO 8601 start of the period (inclusive). |
| sort | string | – | Row ordering, descending. There is deliberately no plain "cost": reported and estimated cost are separate figures that are never summed, so ordering by one sorts every row priced on the other basis a… |
| today | boolean | – | Restrict to today, in local time. |
| until | string | – | ISO 8601 end of the period (exclusive). |
No output schema declared.
No examples provided.
usage_summary Usage summary ~438
Total token usage and cost for a period, split by client (Claude Code, OpenCode). Tokens are broken out into input / output / cache-read / cache-write / reasoning, because cache tokens typically dwarf input and a single blended total is misleading. Reported cost (from OpenCode) and estimated cost (computed for Claude Code, which records none) are always listed separately and must not be summed. Also reports the cache hit rate and reads-per-write, which are what say whether the cache is paying for itself -- the raw cache counts alone cannot.
| Name | Type | Req | Description |
|---|---|---|---|
| client | – | – | Restrict to any of these clients. A single client id is also accepted. |
| compare | string | – | Also report the window of equal length immediately before this one, with the delta. Requires a period of fixed length -- days, today, or since AND until together. An open-ended period (since alone, u… |
| days | integer | – | Look back this many days, counted from local midnight. Omit for all time. |
| includeSubagents | boolean | – | Include subagent/sidechain turns. Defaults to true, because they are real spend. Set false to see only main-thread turns. |
| models | array | – | Restrict to any of these model ids, exactly as the client recorded them. Use model_usage to see the ids present. |
| projectPath | string | – | Deprecated spelling of projectPaths, for one project. Still honoured. |
| projectPaths | array | – | Restrict to any of these projects, given as the absolute working directories the turns ran in. Each must match exactly; use project_usage to see the available paths. A value matching no record anywhe… |
| since | string | – | ISO 8601 start of the period (inclusive). |
| today | boolean | – | Restrict to today, in local time. |
| until | string | – | ISO 8601 end of the period (exclusive). |
No output schema declared.
No examples provided.
What is the AI Usage MCP server?
AI Usage is an MCP server listed in the public MCP registry as io.github.MohitBansal321/ai-usage-mcp. Reports real token usage and cost from Claude Code and OpenCode data. Nothing leaves your machine. This page covers its npm package (ai-usage-mcp).
Is the AI Usage MCP server safe to use?
AI Usage scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AI Usage MCP server expose?
AI Usage exposes 9 tools: usage_summary, session_usage, model_usage, client_usage, project_usage, and 4 more. Their descriptions and schemas cost roughly 3,547 tokens of context every time the server is loaded.
Is the AI Usage MCP server still maintained?
AI Usage is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the AI Usage MCP server under?
AI Usage declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.