feat(desktop): MCP fleet cost/usage overlay with schema token estimates and 30-day usage

[teknium1]

Each configured server row on the desktop MCP Capabilities page now shows what it costs and whether it earns its keep: an approximate per-call token cost of its tool schemas, a 30-day usage count, and — for enabled servers with nonzero schema cost and zero 30-day usage — a subtle muted unused pill on the row (never a dialog).

Infographic

Changes

• apps/desktop/src/lib/mcp-cost.ts (new): pure functions — estimateServerTokens (sum of ceil(schema_chars / 4) over enabled tools only, honoring the existing tools.include/tools.exclude filter via isToolEnabled), sanitizeMcpNameComponent / mcpServerUsagePrefix / serverUsageCount (mirror of mcp_prefixed_tool_name in tools/mcp_tool.py, the mcp__<server>__<tool> registry convention, prefix-summed per server).
• apps/desktop/src/app/skills/mcp-tab.tsx: extends the existing statusLine/capabilitySummary second-line text in McpRow and the ServerConfig header — e.g. 12 tools enabled, ~4.2k tok/call, 3 uses/30d — using the existing compactNumber helper. Adds a module-wide 30-day usage cache (loadMcpUsage, same TTL/keying pattern as the Skills page's toolCallsCache), epoch-guarded and reset on profile switch like the probes. The unused pill renders only when both halves are known: probe ok + nonzero token estimate + zero 30-day uses.
• hermes_cli/mcp_config.py: _probe_single_server fills an optional details["schema_chars"] map — per-tool length of the same converted registry schema the agent registers (_convert_mcp_schema: name + description + normalized parameters), i.e. what actually rides on every model call. Best-effort, wrapped so any failure just omits the field.
• hermes_cli/web_routers/mcp.py: /api/mcp/servers/{name}/test adds schema_chars per tool when the probe produced it. Additive-only wire change.
• apps/desktop/src/hermes.ts: McpTestResult.tools[].schema_chars?: number (optional).
• i18n: costTokens / usage30d / unusedPill added to types.ts, en, zh, zh-hant, ja (ar is a partial-override locale via defineLocale and inherits en for this section, as it does for the whole existing mcp block).
• Tests: apps/desktop/src/lib/mcp-cost.test.ts (token estimate, filter interaction, name sanitization/prefix boundaries, usage summation); two new Python tests in tests/hermes_cli/test_web_server_profile_unification.py pinning the additive wire field and the unchanged legacy shape.

Graceful degradation

• Older backend (no schema_chars): renderer shows tool counts + usage only — estimateServerTokens returns null and no token segment is rendered.
• Older renderer against a new backend: extra key is ignored; wire change is purely additive (a probe that fills nothing produces the byte-identical pre-overlay tool objects, pinned by test).
• No probe yet / failed probe: no estimate.
• Analytics fetch failure: usage segment simply omitted (no error UI), nothing cached, retried on next TTL window.
• Display-only feature: nothing changes what tool schemas are sent to models; no config knobs; prompt-caching invariant untouched.

Validation

Check	Command	Result
Desktop lint	npm run check:lint (apps/desktop)	✅ 0 errors (108 pre-existing warnings)
Desktop unit tests	npx vitest run --project ui src/app/skills src/lib	✅ 79 files, 793 tests passed
New unit tests	npx vitest run --project ui src/lib/mcp-cost.test.ts	✅ 9 tests passed
i18n runtime/parity	npx vitest run --project ui src/i18n	✅ 4 files, 28 tests passed
Python endpoint tests	scripts/run_tests.sh tests/hermes_cli/test_web_server_profile_unification.py	✅ 21 tests passed, 0 failed
Probe-adjacent tests	scripts/run_tests.sh tests/hermes_cli/test_mcp_config.py	✅ 38 tests passed, 0 failed
Python lint	ruff check on touched Python files	✅ All checks passed

[github-actions]

૮ >ﻌ< ა ci review

_{ran on eb048db — feat(desktop): MCP fleet cost/usage overlay with schema toke}

⚠️ Warnings

OSV vulnerability scan · View job

5 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in package-lock.json
• CVE-2026-67213 in website/package-lock.json
• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 15m32s vs 19m57s (-22.1%). 22 job(s) slower, 12 faster, 3 unchanged.

• Python tests / Run tests slice 9/12: +129.0s
• Python tests / Run tests slice 1/12: -42.0s
• Python tests / Run tests slice 2/12: +30.0s
• Python tests / Run tests slice 12/12: +24.0s
• Python tests / Run tests slice 7/12: +22.0s