fix: reduce hosted mcp runtime cost

Author: thedaviddias

apps/web/app/api/mcp/route.ts

@@ -26,9 +26,9 @@ import { createCorsHeaders, isOriginAllowed, mergeHeaders } from './route-helper
 const MAX_BATCH_SIZE = 10
 const MAX_REQUEST_SIZE = 100 * 1024 // 100KB
 
-/** Set to "true" or "1" to disable DB and in-memory MCP telemetry (usage counts). */
-const MCP_TELEMETRY_DISABLED =
-  process.env.MCP_TELEMETRY_DISABLED === 'true' || process.env.MCP_TELEMETRY_DISABLED === '1'
+/** Set to "true" or "1" to enable DB and in-memory MCP telemetry (usage counts). */
+const MCP_TELEMETRY_ENABLED =
+  process.env.MCP_TELEMETRY_ENABLED === 'true' || process.env.MCP_TELEMETRY_ENABLED === '1'
 
 interface McpRequest {
   jsonrpc: '2.0'
@@ -269,12 +269,12 @@ export async function POST(request: Request) {
         maxResponseChars: process.env.MCP_MAX_RESPONSE_CHARS
           ? parseInt(process.env.MCP_MAX_RESPONSE_CHARS, 10)
           : undefined,
-        telemetryEnabled: !MCP_TELEMETRY_DISABLED
+        telemetryEnabled: MCP_TELEMETRY_ENABLED
       },
       body
     )
 
-    if (!MCP_TELEMETRY_DISABLED) {
+    if (MCP_TELEMETRY_ENABLED) {
       const toolNames = extractToolNamesFromRequest(body)
       if (toolNames.length > 0) {
         prisma.mcpToolCall
@@ -382,7 +382,7 @@ export async function GET(request: Request) {
             maxResponseChars: process.env.MCP_MAX_RESPONSE_CHARS
               ? parseInt(process.env.MCP_MAX_RESPONSE_CHARS, 10)
               : undefined,
-            telemetryEnabled: !MCP_TELEMETRY_DISABLED
+            telemetryEnabled: MCP_TELEMETRY_ENABLED
           }
         ),
         rateLimitResult
@@ -405,7 +405,7 @@ export async function GET(request: Request) {
     }
   }
 
-  const usage = MCP_TELEMETRY_DISABLED ? {} : getTelemetryStats()
+  const usage = MCP_TELEMETRY_ENABLED ? getTelemetryStats() : {}
   const tools = getToolDefinitions(getChecklists()).map((tool: { name: string }) => tool.name)
 
   return Response.json(

apps/web/lib/rate-limit.ts

@@ -2,7 +2,7 @@ import { Ratelimit } from '@upstash/ratelimit'
 import { Redis } from '@upstash/redis'
 
 // Rate limiter configuration for MCP endpoint
-// Uses sliding window algorithm: 60 requests per minute per IP
+// Uses sliding window algorithm: 30 requests per minute per IP
 
 let ratelimit: Ratelimit | null = null
 let waitlistRatelimit: Ratelimit | null = null
@@ -36,8 +36,8 @@ function getRatelimiter(): Ratelimit | null {
 
     ratelimit = new Ratelimit({
       redis,
-      // Sliding window: 60 requests per 60 seconds
-      limiter: Ratelimit.slidingWindow(60, '60 s'),
+      // Sliding window: 30 requests per 60 seconds
+      limiter: Ratelimit.slidingWindow(30, '60 s'),
       // Prefix for Redis keys
       prefix: 'mcp-ratelimit',
       // Analytics disabled by default (costs extra)
@@ -116,8 +116,8 @@ export async function checkRateLimit(identifier: string): Promise<RateLimitResul
   if (!limiter) {
     return {
       success: true,
-      limit: 60,
-      remaining: 60,
+      limit: 30,
+      remaining: 30,
       reset: Date.now() + 60000
     }
   }
@@ -135,8 +135,8 @@ export async function checkRateLimit(identifier: string): Promise<RateLimitResul
     console.error('[rate-limit] Rate limit check failed:', error)
     return {
       success: true,
-      limit: 60,
-      remaining: 60,
+      limit: 30,
+      remaining: 30,
       reset: Date.now() + 60000
     }
   }

apps/web/vercel.json

@@ -1,4 +1,11 @@
 {
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "git": {
+    "deploymentEnabled": {
+      "main": true,
+      "**": false
+    }
+  },
   "crons": [
     {
       "path": "/api/cron/supabase-keepalive",

docs/mcp-quality.md

@@ -210,9 +210,10 @@ Tool responses are capped so the MCP doesn’t blow LLM token budgets:
 - **In-memory usage counters** in `packages/mcp`: every `tools/call` increments a per-tool counter when telemetry is enabled. Exposed via `getTelemetryStats()` and in **GET /api/mcp** as the optional `usage` object (e.g. `usage: { get_rule: 42, search_rules: 10 }`). Anonymous only; no IPs or identifiers. Counts reset on each deploy/restart.
 - **Database persistence**: Each `tools/call` is stored in the `McpToolCall` table (anonymous: `toolName`, `createdAt`). The API route writes after a successful request; DB errors are ignored so telemetry never breaks MCP responses. Apply migrations with `pnpm --filter @repo/auth db:migrate`.
 
-**Disabling telemetry**
+**Enabling telemetry**
 
-- Set **`MCP_TELEMETRY_DISABLED=true`** (or `MCP_TELEMETRY_DISABLED=1`) in the app environment. When set: in-memory counters are not updated and **GET /api/mcp** does not include `usage`; no rows are written to `McpToolCall`. The handler also accepts `createMcpHandler(getRules, getChecklists, { telemetryEnabled: false })` when creating it programmatically (e.g. in tests).
+- Telemetry is disabled by default for the public hosted endpoint to avoid database writes and analytics work for routine agent traffic.
+- Set **`MCP_TELEMETRY_ENABLED=true`** (or `MCP_TELEMETRY_ENABLED=1`) in the app environment to opt in. When enabled: in-memory counters are updated, **GET /api/mcp** includes `usage`, and successful `tools/call` requests write anonymous rows to `McpToolCall`. The handler also accepts `createMcpHandler(getRules, getChecklists, { telemetryEnabled: true })` when creating it programmatically (e.g. in tests).
 
 **How to see it**