$ brew tap mmornati/leanproxy-mcp https://github.com/mmornati/leanproxy-mcp
$ brew install leanproxy-mcpA local token firewall between your AI client and every MCP server. It cuts what tool schemas and tool results cost you, and it redacts, screens and pins everything on the way through. One Go binary, and nothing leaves your machine unless you turn it on.
Scan of the benchmark catalog: 5 servers, 118 tools, with sizes as
measured by make harness against the real binary. The
secret is a planted test value. Drag the scan line, or use the arrow keys.
Two kinds of cargo come through every MCP call: weight you pay for on every turn, and payloads that can hurt you. LeanProxy handles both in the same pass, before anything reaches your model provider.
server__tool instead.search_tools
BM25 search across every server. A lookup costs 152 tokens on average, and it puts the right tool in the top 5 for 85.5% of 83 labeled intents.read_result.doctor security
A read-only report mapped to the OWASP MCP Top 10, with --json for CI.tools pins and policy check
See what changed upstream before you approve it, and test a rule before a call hits it.Three recorded working sessions, replayed through the binary. Native MCP keeps all five servers' schemas in context on every turn; the harness bills later turns at a 0.25× cache-read rate, a conservative assumption (some providers charge less). The LeanProxy bars include its own discovery calls.
search_tools
LeanProxy, list_tools
The savings leave out the token cost of the extra discovery turns, so
read them as upper bounds. In Full Day, 3 of 7 searches missed and paid
for a list_tools fallback as well. Earlier versions of this
table left both costs out and showed 81.5–93.7%.
| Parameter | Measured | Test condition |
|---|---|---|
| Proxy overhead | 0.56 ms p50 · 0.74 ms p95 | Proxied minus direct, per call |
| Pipelined burst | 9,723 req/s · 0 errors | 500 calls spread over 5 servers |
| Large tool results | 234,700 → 18,515 tok −92.1% | Response governor, max_tokens: 4000, pages back byte-identical via read_result |
| Repeated reads | 13,780 → 3,640 tok −73.6% | response.dedup: on, same file read 3× |
| Secret leaks | 0 of 3 | Planted fake secrets, both directions, including search_tools output |
| Memory | 20.4 MiB idle · 22.5 MiB after burst | Resident set size |
| Binary size | 16.4 MiB | linux/amd64, stripped |
Claude Code, Claude Desktop, Cursor and VS Code already defer and
search large tool lists on their own. For them, LeanProxy stops
hiding schemas behind a router. It lists every upstream tool as
server__tool, with full metadata and
tools/list_changed, and gets out of the way.
It still redacts, screens, pins and enforces policy on every listed tool and every call. And the response side doesn't depend on the mode: large tool results drop by 92.1% and repeated reads by 73.6% in the harness, whichever client you use.
Homebrew or a release archive on macOS and Linux (amd64 and arm64), or go build from source.
brew tap mmornati/leanproxy-mcp \
https://github.com/mmornati/leanproxy-mcp
brew install leanproxy-mcpAdd each server once to ~/.config/leanproxy_servers.yaml. Coming from Claude Code or OpenCode? leanproxy-mcp migrate imports what they already have.
leanproxy-mcp server add filesystem -- \
npx -y @modelcontextprotocol/server-filesystem ~/projectsReplace the servers in your client with one stdio server, or run a shared HTTP gateway with serve.
# Claude Code; other clients: same command
claude mcp add leanproxy -- \
leanproxy-mcp server run --stdioBased on each project's own public documentation as of September 2026. These projects move fast, so check the source before you rely on a row.
| LeanProxy | MCPProxy | ToolHive | Docker MCP Gateway | LiteLLM | |
|---|---|---|---|---|---|
| Response-side token governor | Yes | — | — | — | — |
| Injection classifier, request and response | Yes, local | — | — | — | — |
| Tool pinning, drift detection | Yes | Schema quarantine | — | — | — |
| Per-tool allow / deny / confirm | Yes | — | Access policies | — | Per key / team |
| Sandboxed stdio servers | Opt-in | — | Yes | Yes | n/a |
| Tool search across servers | BM25 | BM25 | — | — | — |
— means not documented. All five run as local, self-hosted binaries.
One binary. Minutes to set up. Nothing leaves your machine.