Costwright Mcp
About
Static worst-case token-budget analysis of LLM-agent workflows
Details
- Author
- hernaninverso
- Downloads
- 208
- Categories
- AI
Jump to
- Static worst‑case token‑budget analysis for LLM agent workflows.
- Reports certifiable, default‑dependent, non‑certifiable, and runaway units.
- Issues Ed25519‑signed budget certificates logged to a transparency log.
- Pure AST analysis – no code execution required.
- Compatible with LangGraph, CrewAI, and OpenAI Agents SDK.
- Public verify and pubkey tools for offline verification.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Costwright McpCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Configure the MCP server using npx costwright-mcp with the COSTWRIGHT_API_KEY environment variable. Four tools are provided: costwright_check (static analysis), costwright_certify (signed certificate), costwright_verify (public certificate verification), and costwright_pubkey (retrieve public keys). The verify and pubkey tools require no API key.
costwright_check
Statically analyze an LLM-agent repo (LangGraph / CrewAI / OpenAI-Agents-SDK) for runaway-budget risk WITHOUT running it. Builds a .py-only archive of the given local path and returns a worst-case budget summary: counts of certifiable / default_dependent / non_certifiable / runaway graph units and a pass|fail verdict. Use before deploying a workflow to catch missing token caps and while-True runaway drivers.
costwright_certify
Issue a tamper-evident, Ed25519-signed budget certificate for an agent repo (re-run server-side, logged to a public transparency log). Same input as costwright_check plus an optional label. Returns the cert_id, the signed certificate and a verify_url. Use to produce an auditable proof of a workflow's worst-case spend ceiling.
costwright_verify
Verify a previously issued costwright certificate by id (public, no key). Returns its state (valid|expired|revoked|signature_invalid), whether the signature checks out, and the certified result.
costwright_pubkey
Fetch costwright's active Ed25519 public keys (PEM) for offline signature verification of any certificate (public, no key).
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"costwright mcp": {
"costwright": {
"command": "npx",
"args": [
"-y",
"costwright-mcp"
],
"env": {
"COSTWRIGHT_API_KEY": "your_rapidapi_key"
}
}
}
}
}McpServers
{
"costwright": {
"command": "npx",
"args": [
"-y",
"costwright-mcp"
],
"env": {
"COSTWRIGHT_API_KEY": "your_rapidapi_key"
}
}
}costwright — MCP server
Static worst-case token-budget analysis for LLM-agent workflows. Point it at a Python repo
using LangGraph / CrewAI / OpenAI-Agents-SDK and it reports — by pure AST analysis, without
running the code — the worst-case budget ceiling of every workflow graph: which units are
certifiable / default-dependent / non-certifiable / runaway, and which LLM calls have no token
cap. Optionally issues an Ed25519-signed budget certificate logged to a public transparency log.
Wraps the hosted costwright API; backed by a Lean 4 cost-soundness theorem.
> Use it before deploying an agent workflow to catch missing token caps and while True: runaway
> drivers — the budget version of a type check.
Tools
| Tool | What it does | Key? |
|------|--------------|------|
| costwright_check(repo_path, policy?) | Static budget analysis of a local repo. Returns pass/fail + counts of certifiable/default-dependent/non-certifiable/runaway units. | yes |
| costwright_certify(repo_path, policy?, label?) | Issues a signed, logged budget certificate. Returns cert_id + signature + verify_url. | yes |
| costwright_verify(cert_id) | Verify a certificate by id (valid/expired/revoked, signature check). | public |
| costwright_pubkey() | Active Ed25519 public keys for offline verification. | public |
Setup
{
"mcpServers": {
"costwright": {
"command": "npx",
"args": ["-y", "costwright-mcp"],
"env": { "COSTWRIGHT_API_KEY": "your_rapidapi_key" }
}
}
}
The key is sent as X-RapidAPI-Key (RapidAPI channel) by default; set COSTWRIGHT_DIRECT=1 to send
it as Authorization: Bearer for the direct channel. verify and pubkey work with no key.
check/certify build a .py-only gzip archive of repo_path client-side (excluding venv,
node_modules, tests, etc.) and send it for analysis — your source is uploaded to the hosted API.
See <https://eleata.io/privacy/>. MIT licensed.
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
