TrazumBLOCK
Know what your AI agents cost, per project, without your prompts leaving the machine. CLI, MCP server and CI gate. Zero dependencies, offline.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Most of your LLM bill is not the prompt. Trazum finds where it is.
A deterministic cost analyser for prompts and usage logs. Offline, free, same answer every time. It reports sixteen findings priced in dollars per month: caching you are not getting, a model tier you may not need, a schema you pay to describe on every call. Shortening the prompt is one of them, and it is rarely the biggest.
[](https://github.com/Davmunrey/Trazum/actions/workflows/ci.yml) [](https://github.com/Davmunrey/Trazum/actions/workflows/security.yml) [](LICENSE) [](package.json) [](#layout)
Start here: one line, nothing installed
npx @trazum/cli bill
What the command prints on the two illustrative projects in `examples/claude-projects`. The picture is drawn from the CLI's own output by `scripts/draw-bill.mjs`, and the suite fails the day the two disagree.
With no path it reads Claude Code's own folder, labels each session by its project, and prints the statement above on a terminal; piped, it prints the JSON receipt instead. Transcripts are priced at Anthropic's API rates, and the statement says so: on a Pro or Max plan you paid the plan, so read the figure as what the same work would cost through the API. Point it
f762026ae298OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp -- npx -y @trazum/[email protected]
Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
check_prompt | read | Answers whether a prompt fits a maximum, and if not, whether optimising it would. |
list_models | read | Input and output price per million tokens, context window and cacheable minimum, for |
optimize_prompt | read | Applies Trazum |
position | read | States the month\ |
profile_usage | read | Reads a usage log — one JSON object per line, each with a |
prompt_writer | read | Asks what a good prompt needs and assembles one from your answers. Call it with the |
spend_guard | read | Call this before making a model call, when a budget exists and you do not know whether |
Trust audit
BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
/^\[?::ffff:/i, // IPv4-mapped IPv6, e.g. ::ffff:169.254.169.254
CMD wget -qO- http://0.0.0.0:3000/ >/dev/null || exit 1
[' ', ' '], [' ', ' '], [' ', ' '], ['', ''],
const key = 'sk-ant-admin-01ABCDEFGHIJKLMNOP';
const key = 'sk-ant-admin-0123456789ABCDEF';
const key = 'sk-ant-admin-SECRETSECRETSECRET';
const secret = 'sk-ant-admin-thisisnotarealkey0000000000';
credential: 'sk-ant-api03-NOTAREALKEYBUTSHAPEDLIKEONE',
const SECRET = 'web-otel-prompt-do-not-leak-3c9d';
const SECRET = 'my-secret-question-3a7e';
const SECRET = 'otel-prompt-do-not-leak-11ff';
const secret = 'sk-ant-admin-thisisnotarealkey0000000000';
const SECRET = 'ACME-CONFIDENTIAL-Q3-PRICING';
'ghp_0123456789abcdefghijklmnopqrstuvwxyz',
assert.throws(() => pkcs8FromPem('-----BEGIN PRIVATE KEY-----\n-----END PRIVATE KEY-----'), /empty/);assert.throws(() => pkcs8FromPem('-----BEGIN PRIVATE KEY-----\n!!!!\n-----END PRIVATE KEY-----'), /base64/);.pre-commit-hooks.yaml
.vscodeignore
const repoRoot = new URL('../../', import.meta.url).pathname;for (const path of ['a--b.txt', '../../etc/passwd', 'a b/c.txt']) {import { SPAWN_ENV } from '../../../packages/cli/test/env.mjs';import { CELLS, FILLED, PALETTE, SIZE, png } from '../../../scripts/draw-icon.mjs';import { adminList, adminSource } from '../../lib/admin/config';# exfiltration. For this product it is the contract: `--exact-tokens` sends
# and `trazum feedback` — the one command that could be a beacon — is tested
Gates applied: no_behavioural_pass.
f762026ae298full audit observations/trust-audit/mcp-server/davmunrey__trazum.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | f762026ae298 | BLOCK | F | 46 | first audit |
Questions
What is the @trazum/mcp MCP server?
Know what your AI agents cost, per project, without your prompts leaving the machine. CLI, MCP server and CI gate. Zero dependencies, offline.
What tools does @trazum/mcp expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @trazum/mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (46/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does @trazum/mcp need?
It reads ACTIONS_ID_TOKEN_REQUEST_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL, ANTHROPIC_API_KEY, NEXT_PUBLIC_POSTHOG_KEY and TRAZUM_LLM_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @trazum/mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @trazum/tokenizer-openai at 2.5.1.
How current is this page?
The grade is for one exact copy of the source (f762026ae298), read on 2026-10-12. The repository is watched and re-audited when it changes.