{
  "markdown": "# tessera-mcp-server\n\n> The MCP server that returns money, not data.\n\n[![npm version](https://img.shields.io/npm/v/@tessera-llm/mcp-server.svg)](https://www.npmjs.com/package/@tessera-llm/mcp-server)\n[![Apache-2.0 License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n\n**Status:** v0.1.3 — published 2026-05-27 on npm with sigstore SLSA provenance v1, listed on `registry.modelcontextprotocol.io`.\n\nTessera is an LLM proxy that optimizes API spend through multi-provider routing, prompt compression, audit-immutable logging, output-length prediction, and batch arbitrage. This package exposes Tessera as an [MCP](https://modelcontextprotocol.io) server for tool-using agents — Claude Desktop, Claude Code, Cursor, Cline, Continue, Goose, Zed.\n\nWhere other LLM-infrastructure MCP servers return logs, traces, or prompt metadata, this one returns **savings decisions**: what's drifting, what to switch, what to approve, what to audit.\n\n## See it in action\n\n[![Tessera launch demo — 41-second walkthrough](https://tesseraai.io/launch-reel-poster.jpg)](https://tesseraai.io/launch-reel.mp4)\n\n▶ 41-second walkthrough: live counter ticks · baseline $74,800 → actual $30,000 ($44,800 saved, 60% reduction) · audit-immutable savings ledger. Click to play.\n\n## Install\n\n```bash\nnpx @tessera-llm/mcp-server\n```\n\nOr add to your client config:\n\n**Claude Desktop** (`~/Library/Application Support/Claude/claude_desktop_config.json` on macOS, `%APPDATA%\\Claude\\claude_desktop_config.json` on Windows):\n\n```json\n{\n  \"mcpServers\": {\n    \"tessera\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@tessera-llm/mcp-server\"],\n      \"env\": {\n        \"TESSERA_API_KEY\": \"tk_...\"\n      }\n    }\n  }\n}\n```\n\n**Claude Code** (`.mcp.json` in project root):\n\n```json\n{\n  \"mcpServers\": {\n    \"tessera\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@tessera-llm/mcp-server\"],\n      \"env\": {\n        \"TESSERA_API_KEY\": \"tk_...\"\n      }\n    }\n  }\n}\n```\n\n**Cursor** (`~/.cursor/mcp.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"tessera\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@tessera-llm/mcp-server\"],\n      \"env\": { \"TESSERA_API_KEY\": \"tk_...\" }\n    }\n  }\n}\n```\n\nGet a `TESSERA_API_KEY` at [tesseraai.io/dev](https://tesseraai.io/dev) — Free Sandbox is 60M tokens/month with no card.\n\n## Tools\n\nv0.1 exposes 6 tools (5 read + 1 mutate). Hard cap — no tool sprawl.\n\n| Tool | Read/Write | Purpose |\n|---|---|---|\n| `tessera_list_workloads` | read | List your mapped workloads with anchor cost + current m-stack. |\n| `tessera_get_savings_report` | read | Anchored spend + measured savings for a window. |\n| `tessera_get_recommendation_queue` | read | Pending Optimize-tab recommendations with expected lift + confidence. |\n| `tessera_get_ledger_entries` | read | Audit-immutable Monthly Reading rows (provider call, mechanic stack applied, savings). |\n| `tessera_get_quality_snapshot` | read | SLA floor + p50/p95 quality scores + drift events. |\n| `tessera_approve_recommendation` | **mutate** | Move a queued mechanic from \"suggested\" to \"active\" with audit-trail entry. |\n\nProvider config writes, API-key management, composition cap changes, and Stripe operations are deliberately NOT in this surface — they live in the dashboard, where blast-radius requires explicit modal confirmation.\n\n## Transport\n\n- **stdio** (default) — local clients (Claude Desktop, Cursor, Cline, Continue, Claude Code)\n- **Streamable HTTP** (optional) — set `TESSERA_MCP_TRANSPORT=http` to bind on `localhost:8788` for remote / Goose / Zed-via-`mcp-remote`\n\nSSE (deprecated in MCP spec 2025-11-25) is not supported.\n\n## Auth\n\n`TESSERA_API_KEY` env var or `Authorization: Bearer <key>` header (HTTP transport). Same API key as the SDK — `tk_*` format. Future v0.2: OAuth 2.1 (aligned with MCP spec RC 2026-07-28).\n\n## Security posture\n\n- Tools receiving user-controlled content (ledger notes, recommendation rationale strings, workload names) are labelled `__untrusted__` to prevent prompt-injection cascade per the Supabase/Cursor 2025 pattern.\n- `mcp-scan` (Invariant Labs) runs in CI to catch tool-poisoning attacks in tool descriptions.\n- No `execute_code` escape hatch. Typed verbs only.\n- No session-based auth. Every request authenticates independently per MCP spec 2026 requirement.\n\n## License\n\n[Apache-2.0](LICENSE). Tessera is a product of [Fintechagency OÜ](https://ariregister.rik.ee/eng/company/16638667) (Estonia, Tallinn).\n\n## Links\n\n- Tessera landing: [tesseraai.io](https://tesseraai.io)\n- Free Sandbox signup: [tesseraai.io/dev](https://tesseraai.io/dev)\n- How it works: [tesseraai.io/how-it-works](https://tesseraai.io/how-it-works)\n- MCP protocol spec: [modelcontextprotocol.io](https://modelcontextprotocol.io)\n",
  "bytes": 4711,
  "sha": "9eddb81bf0c47c9a964298d4905ee17b5099b41ce790f601123538a42e994b3c",
  "repo_slug": "tessera-llm/mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_tesseraai_mcp_server_fe0c9b43/readme"
}