ModelsAtlas
Explore
Atlas / MCP servers / 00200200 / usagetrim

usagetrimBLOCK

mcp/00200200/usagetrim
MCP server by 00200200 · ai agents · anthropic · claude · Audited 2026-10-08
⚑ Report / re-scanSource ↗

Keep the signal. Cut the noise. Local CLI + MCP — fold verbose tool output for Claude Code, Codex, Cursor & Desktop.

Verdict
BLOCK
Grade
D
Trust score
65 /100
Exposed tools
—
Transport
stdio
License
MIT
Stars
43
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Keep the signal. Cut the noise. Local CLI + MCP that folds verbose tool output for Claude Code, Codex, Cursor, and Claude Desktop — recoverable by reference. Optional macOS pet.

Website · Install · Demo · Features · Connect · Pet ·

Read from source at commit b7f10df5fd41OBSERVED · 2026-10-08
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add usagetrim -- uvx usagetrim
claude-desktop
{
  "mcpServers": {
    "usagetrim": {
      "command": "uvx",
      "args": [
        "usagetrim"
      ]
    }
  }
}
03

Trust audit

BLOCKgrade D · trust 65/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (2 observation(s))
Shell
declared (6 observation(s))
Dependencies
pinned
Secrets in source
found

Findings (14)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
scripts/benchmark_code.py:131
exec(compile(path.read_text(), str(path), "exec"), namespace)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/usagetrim/core/specialized.py:3770
'Liveness probe failed: Get "http://10.0.2.15:8080/healthz": dial tcp '
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/usagetrim/core/specialized.py:3852
"  echo http://127.0.0.1:8080/",
MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321
tests/test_advanced_features.py:31
"ANTHROPIC_KEY=sk-ant-1234567890abcdef1234567890\n"
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
tests/test_advanced_features.py:33
"DB=postgres://user:super_secret_pw@localhost:5432/db"
MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321
tests/test_advanced_features.py:32
"GH_TOKEN=ghp_1234567890abcdefghijklmnopqrstuvwxyz\n"
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
tests/test_redactor.py:55
"-----BEGIN RSA PRIVATE KEY-----\n"
MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321
tests/test_redactor.py:53
slack = "xoxb-1234567890-abcdefghij"
LOWInventory / provenance · inv.hidden_file · CWE-1104
.pre-commit-config.yaml
.pre-commit-config.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.pre-commit-hooks.yaml
.pre-commit-hooks.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
extensions/claude-desktop/.mcpbignore
.mcpbignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table
INFOInventory / provenance · inv.oversize · CWE-1104
assets/pet-3d.png
assets/pet-3d.png
Why it matters. 1201256 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
macos/Sources/UsageTrimMenu/Resources/pet-3d.png
macos/Sources/UsageTrimMenu/Resources/pet-3d.png
Why it matters. 1201256 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha b7f10df5fd41full audit observations/trust-audit/mcp-server/00200200__usagetrim.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08b7f10df5fd41BLOCKD65first audit
05

Questions

What is the usagetrim MCP server?

Keep the signal. Cut the noise. Local CLI + MCP — fold verbose tool output for Claude Code, Codex, Cursor & Desktop.

Is usagetrim safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (65/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does usagetrim need?

No credential environment variables were found in its source, so it appears to need none.

How does usagetrim run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as usagetrim.

How current is this page?

The grade is for one exact copy of the source (b7f10df5fd41), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement