{
  "markdown": "# cap-shield MCP server\n\nContext selection and compression for AI agents — with the recall\nmeasured, not claimed.\n\nOne file. No dependencies. No SDK required.\n\n## Why\n\nMore context makes agents worse. ETH Zurich found context files LOWER\ntask success versus giving the agent no repository context at all, while\nraising inference cost by over 20 %. Around two thirds of production\nagent failures trace to context problems, not to the model being\nincapable.\n\nSo the question is not how much you cut. It is whether what you kept was\nenough — and that is measured here, on a benchmark we did not choose:\nLongMemEval-S, 500 questions. Recall@10 of 93.8 % against a lexical\nbaseline of 51.9 %.\n\nRecall@10 is the strict measure: a question counts only when ALL gold\nsessions were found. Finding half the answer means the agent answers\nconfidently on half a basis.\n\n**Two of the five tools need no account.** Measure first, decide after.\n\n## Install\n\n```bash\ncurl -O https://cap-shield-robin.fly.dev/cap_mcp.py\n```\n\n```json\n{\n  \"mcpServers\": {\n    \"cap-shield\": {\n      \"command\": \"python\",\n      \"args\": [\"/absolute/path/to/cap_mcp.py\"]\n    }\n  }\n}\n```\n\nPython 3.9+. Nothing else.\n\nThe optional [SKILL.md](SKILL.md) tells an agent *when* to use these\ntools — and when not to.\n\n\n## No install at all\n\nThe server is also reachable over HTTP:\n\n```\nhttps://cap-shield-robin.fly.dev/mcp\n```\n\nAdd it as a remote MCP server in any client that supports them, or open it\nin an MCP inspector. `measure_traffic` and `list_packages` work with no\naccount and no key — you can measure your own traffic in a browser without\ninstalling anything.\n\n`remember` and `assemble_context` need a key and are not open over HTTP\nyet; they answer with what to do instead.\n\n## Dictionaries improve on your traffic — and only if they win\n\nA customer's dictionary is trained on their own traffic, in their own\nisolated store. A new version is adopted **only if it measures better on\nheld-out data neither version was trained on.** A retraining that does not\nwin is rejected and logged, and the old dictionary stays.\n\nOld versions are never deleted, so packets compressed under any earlier\nversion still unpack.\n\n\n## Tools\n\n### `measure_traffic` · *no account*\n\nMeasure how much of your own agent traffic could be saved. NO ACCOUNT OR KEY NEEDED — use this first. Returns byte savings over the wire and, if a query is given, token savings from selective context retrieval. Nothing is stored: the text is compressed in memory and discarded. Rate limited to 20 calls per hour per IP.\n\n### `list_packages` · *no account*\n\nList the available dictionaries with their MEASURED compression, including the ones that perform badly. Each entry says whether it works one message at a time or only batched, and how many messages came out LARGER. No key needed.\n\n### `remember` · *requires a key*\n\nStore a memory entry for later retrieval. REQUIRES A KEY. This does not call any language model — it stores text in an isolated per-tenant archive. Use assemble_context to get relevant entries back.\n\n### `assemble_context` · *requires a key*\n\nRetrieve the memory entries that answer a question, within a token budget. REQUIRES A KEY. Send the returned 'context' to your language model INSTEAD of the whole history. This does not call a model itself — it selects what to send. The budget is a ceiling, not a target: selection stops where relevance runs out, often well below it. The response says how many entries were left behind and why.\n\n### `get_account`\n\nGet an account and an API key. Requires an email address. The key is returned ONCE and cannot be shown again — store it immediately. Beta quotas are low by design; they are hard stops, never overage billing.\n\nThe descriptions above are copied verbatim from the server. If they ever\ndiffer from what `tools/list` returns, the server is right and this file\nis stale.\n\n## Memory is versioned, and updates are stored as deltas\n\nAn entry can be updated without storing it again in full. Every fifth\nversion is complete; the ones between are stored as a delta against the\nprevious version, with a SHA-256 checked on read. Lossless, and no\nversion depends on more than four others.\n\nAgent memory is mostly small edits to text that already exists. Storing\neach edit in full is what makes it expensive to keep.\n\nEntries also pick their own compression strategy by size — and if\ncompression does not pay off, the entry is stored **raw** and the\nresponse says so.\n\n## The response is auditable\n\nA saving you cannot check is a saving you have to take on trust. Every\nhit carries `method` — vector or lexical — so you can see which mechanism\nfound it. Every assembly reports `baseline_tokens` (what the whole\nhistory would have cost, in the same format), `candidates_before_autocut`,\n`autocut_removed`, `deduplicated` and `skipped_too_big`.\n\nMeasuring the baseline in a different format once produced a 39-point\nerror. The formats are identical for that reason.\n\n## What the numbers mean\n\nCompression saves **bytes over the wire**. Selection saves **tokens in\nthe context**. Two different mechanisms — adding them together produces\na number that means nothing.\n\nCompressed packets are decompressed before a model sees them, so this\ndoes **not** reduce inference cost. Saying otherwise is the easiest way\nto be wrong about this project.\n\nEvery figure is published live, including what has *not* been measured\nand which packages perform badly:\n\nhttps://cap-shield-robin.fly.dev/.well-known/cap-shield.json\n\nFetch that rather than trusting this file. It goes stale; the document\ndoes not.\n\n## Measuring without MCP\n\n```bash\npip install cap-shield\n```\n\n```python\nfrom cap_shield import measure, print_measurement\nprint_measurement(measure(texts=[...], query=\"...\"))\n```\n\nNo account, nothing stored. The response includes the degraded share —\nhow many of your messages came out **larger**.\n\n## Batching has a security condition\n\nBatching compresses several messages in the same context, which opens a\nCRIME/BREACH-style side channel: someone who can place chosen text in the\nsame batch as a secret, and observe the batch size, learns something\nabout the secret.\n\nOnly batch messages that already share a trust boundary. Optional padding\ncloses the leak for under two bytes a message, and it is **off by\ndefault** — we say so rather than let you assume otherwise.\n\nIndividual packing does not have this problem at all.\n\n## Portability\n\nDictionary versions are never deleted, and the guarantee does not rest on\nus still being here: the archive export carries the dictionary binaries,\nand a standalone unpacker runs with no gateway, no network and no other\npart of the system.\n\nhttps://cap-shield-robin.fly.dev/cap_unpack.py\n\nIt is served without a token, because whoever needs it most is whoever no\nlonger has an account.\n\n## Status\n\nBeta. Server version 0.1.0.\n\nDocs: https://cap-shield-robin.fly.dev/docs/quickstart\nConsole: https://cap-shield-console.lovable.app\n\n## Licence\n\nMIT — see [LICENSE](LICENSE).\n",
  "bytes": 6995,
  "sha": "04c807aad6a3eede4a1a0753284989f4bbe0cca7d381d3dc1d81fadb611a8e42",
  "repo_slug": "robinlidberg-dot/cap-shield-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_robinlidberg_dot_cap_shield_bda736c2/readme"
}