quota-mcp

Name: quota-mcp
Author: limitcool

作者：limitcool版本 0.3.2i★ –i在你的电脑上运行

注册名称io.github.limitcool/quota-mcp

安装

概览

作者提供的说明（英文原文）

Usage & quota tracker for AI subscription accounts (StepFun, Command Code)

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i尚未统计★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 开发者工具
你需要填写：QUOTA_MCP_MASTER_KEY

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
需要你自己填写： QUOTA_MCP_MASTER_KEY, QUOTA_MCP_DB

标为机密的值是你账户的钥匙。千万不要分享给别人，也不要粘贴到聊天里。

你需要

Docker已安装 Docker

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "quota": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "QUOTA_MCP_MASTER_KEY",
        "-e",
        "QUOTA_MCP_DB",
        "ghcr.io/limitcool/quota-mcp:0.3.2"
      ],
      "env": {
        "QUOTA_MCP_MASTER_KEY": "your-value",
        "QUOTA_MCP_DB": "your-value"
      }
    }
  }
}

在终端中运行这条命令

claude mcp add quota --env QUOTA_MCP_MASTER_KEY=your-value --env QUOTA_MCP_DB=your-value -- docker run -i --rm -e QUOTA_MCP_MASTER_KEY -e QUOTA_MCP_DB ghcr.io/limitcool/quota-mcp:0.3.2

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "quota": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "QUOTA_MCP_MASTER_KEY",
        "-e",
        "QUOTA_MCP_DB",
        "ghcr.io/limitcool/quota-mcp:0.3.2"
      ],
      "env": {
        "QUOTA_MCP_MASTER_KEY": "your-value",
        "QUOTA_MCP_DB": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "quota": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "QUOTA_MCP_MASTER_KEY",
        "-e",
        "QUOTA_MCP_DB",
        "ghcr.io/limitcool/quota-mcp:0.3.2"
      ],
      "env": {
        "QUOTA_MCP_MASTER_KEY": "your-value",
        "QUOTA_MCP_DB": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

QUOTA_MCP_MASTER_KEY 机密 env
64 hex chars AES master key for credential encryption (required in production; without it the key is derived from machine traits)
QUOTA_MCP_DB env
SQLite path inside the container (default /data/quota-mcp.db, backed by the /data volume)

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 limitcool 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“开发者工具”中的其他服务器比较i

星标数多于此分类中其他 4910 个服务器的 0%
发布到注册中心的时间比此分类中其他 4910 个服务器的 49% 更新
基础检查结果等于或优于此分类中其他 4910 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

quota-mcp 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

你需要填写：QUOTA_MCP_MASTER_KEY

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（0.3.2）于2个月前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Docker。

有什么可以替代它？

同一分类中有：GitHub, Desktop Commander, Cloudflare MCP

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

GitHub

作者：github

Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.

电脑或云端★ 34,245MIT4天前更新

安装

Desktop Commander

作者：wonderwhy-er

MCP server for terminal commands, file operations, and process management

在你的电脑上运行★ 10,225MIT16天前更新

安装

Cloudflare MCP

作者：cloudflare

Cloudflare MCP servers

在云端运行★ 4,446Apache-2.014个月前更新

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

English | 简体中文

quota-mcp

A usage & quota tracker for AI subscription accounts. It pulls the balances, subscription expiry dates and rate-limit windows that are scattered across vendor dashboards into one place, and exposes them through both a REST management API and an MCP query surface — point your agent (Hermes, Claude Code, …) at it with one config line and it can answer "how much quota do I have left?" on its own.

Two platforms supported today:

Platform	Data source	Credential	What you can see
StepFun (阶跃星辰, `.ai` intl / `.com` China)	`platform.stepfun.{ai,com}` console Connect RPC	Browser session (Oasis-Token, ~2 h, auto-renewed) + optional plan key	Plan & expiry, 5-hour / weekly / subscription credit windows, access keys under the account, session health
Command Code (commandcode.ai)	Undocumented `/alpha/*` endpoints on `api.commandcode.ai`	A single Bearer API key	Plan (GOAT/Pro/Max/…), 5-hour / weekly / monthly windows, balances, billing-period request stats

Highlights:

Encrypted at rest: credentials are AES-256-GCM encrypted into SQLite (pure-Go driver, no CGO); every endpoint returns masked views only
StepFun session auto-renewal: a background goroutine checks every 60 s and renews any session whose TTL drops below 20 min. Renewing an *expired* session gets you a degraded device token — there is a guard that detects this and refuses to persist it
Dual auth planes: StepFun's plan key (permanent) and console session (quota data) are managed and probed separately; the verdict is driven by the permanent plane
MCP is read-only: the query surface (list / probe / summarize) is safe to hand to agents; enrol / renew / delete live on the REST side only
Single binary, zero external services

Quick start

go build -o quota-mcp ./cmd/quota-mcp

In production set the master key explicitly (64 hex chars). Without it the key is

derived from machine traits and old ciphertext becomes unreadable after a migration.

export QUOTA_MCP_MASTER_KEY=$(openssl rand -hex 32)

./quota-mcp -db data/quota-mcp.db -listen 127.0.0.1:8780

After startup:

http://127.0.0.1:8780/healthz health check
http://127.0.0.1:8780/api/stepfun/accounts REST list
http://127.0.0.1:8780/mcp MCP endpoint

Enrolling accounts

Command Code (two credential planes)

The alpha/API-key plane is the easy one — a permanent Bearer key:

curl -X POST http://127.0.0.1:8780/api/commandcode/accounts \

-H 'Content-Type: application/json' \ -d '{"service":"cc-myname","api_key":"user_xxx","label":"primary"}'

Get the key from commandcode.ai/settings/keys (shown once at creation). The server validates it with whoami first and refuses to store a rejected key.

The internal/session plane mirrors the browser: pass session_text (the whole Cookie: header, a document.cookie dump, or the bare __Secure-commandcode_prod_.session_token value). It is validated against billing/credits and never stored unless it passes. Sessions expire, so refresh them from CookieCloud or by copying the cookie again from DevTools:

curl -X POST http://127.0.0.1:8780/api/commandcode/accounts \

-H 'Content-Type: application/json' \ -d '{"service":"cc-myname","session_text":"__Secure-commandcode_prod_.session_token=eyJ..."}'

When both are stored the API key wins. Each enrol overwrites the credential planes it was given — re-enrolling with only api_key clears any stored session, and vice-versa, so a rotation is never silently skipped.

StepFun (browser session)

Oasis-Token is an HttpOnly cookie, so document.cookie cannot read it — copy it from a request header in DevTools. Paste the whole Cookie: header (or the bare token) to the server:

curl -X POST http://127.0.0.1:8780/api/stepfun/accounts \

-H 'Content-Type: application/json' \ -d '{"service":"ai-412848664332275712","region":"ai","session_text":"Oasis-Token=eyJ...; Oasis-Webid=...","email":"me@example.com"}'

Protocol findings from real-world testing (all handled in code):

The .ai Oasis-Token cookie value is two JWTs concatenated (8 segments); the console only accepts the whole value — a single segment gets you token is illegal
Timestamp units differ per site: .ai returns second-level strings, .com returns milliseconds; the code infers by magnitude
.com device tokens live only 30 minutes and its RefreshToken returns a degraded token — .com sessions need periodic re-import
Renewing after expiry yields a device token (mode 1, data plane always token is illegal), so renewal must happen before expiry; a degradation guard refuses to store such tokens

REST API

GET    /api/stepfun/accounts                     List (masked view)

POST /api/stepfun/accounts Enrol/update (stored only if at least one plane probes OK) POST /api/stepfun/accounts/{service}/probe Probe (auto-renews once on console auth failure) POST /api/stepfun/accounts/{service}/renew Force-renew the console session POST /api/stepfun/accounts/{service}/register?region=ai Register an anonymous device slot (self-test) DELETE /api/stepfun/accounts/{service} Delete POST /api/stepfun/probe Probe all (cron-friendly)

GET /api/commandcode/accounts List (masked view) POST /api/commandcode/accounts Enrol/update (api_key or session_text; stored only if it probes OK) POST /api/commandcode/accounts/{service}/probe Probe DELETE /api/commandcode/accounts/{service} Delete POST /api/commandcode/probe Probe all

MCP surface (for agents)

Two ways to connect — pick either:

1. Streamable HTTP (served on /mcp) — for always-on deployments:

mcp_servers:

quota: url: http:// :8780/mcp

2. stdio — for clients that spawn the server themselves (Claude Code, containers, mcp-publisher-style registry installs):

# local binary

quota-mcp -stdio

or straight from the published image (works with zero setup)

docker run -i --rm -v quota-mcp-data:/data ghcr.io/limitcool/quota-mcp:latest

Works the same way from Claude Code or any other MCP client.

All tools are read-only:

Tool	Description
`quota_list_accounts`	List every account: plan, expiry, remaining quota, session/key status (masked)
`quota_probe_account`	Live-probe one account (hits upstream, takes a few seconds)
`quota_probe_all`	Serially probe all accounts and refresh the cache
`quota_status`	Summary: per-platform counts of serving / limited / invalid / needs-relogin, plus a one-line status per account
`quota_check_alerts`	Firing alerts: low quota, upcoming expiry, dead session, rejected key, window exceeded
`quota_report`	The scheduled-digest payload: all account numbers + current alerts

Alerts, expiry warnings & scheduled digest

quota-mcp owns condition detection (it holds the data and runs a 60 s background loop); scheduling and delivery belong to your agent platform. A hermes-style wiring:

1. Threshold & expiry alerts (event-driven, push)

A background evaluator refreshes stale probe data (>5 min), evaluates rules, keeps a firing/resolved state machine in SQLite (alert_events), and POSTs only the transitions to a webhook — the same alert never repeats until it clears and fires again.

Rules: credit_low (remaining share below threshold), expiring_soon (subscription/billing period ending within N days), session_dead (StepFun console session needs re-import), key_rejected (Command Code key got 401/403), window_limited (rate window exceeded).

QUOTA_MCP_ALERT_WEBHOOK_URL=http://<hermes>:8642/webhooks/quota \

QUOTA_MCP_ALERT_CREDIT_PCT=0.2 \ QUOTA_MCP_ALERT_EXPIRY_DAYS=7 \ ./quota-mcp -listen 0.0.0.0:8780

Payload pushed on each transition:

"source": "quota-mcp", "at": "2026-09-21T15:52:30Z", "fired": [{"kind":"credit_low","provider":"stepfun","service":"ai-…","severity":"warn","title":"订阅额度即将耗尽","detail":"剩余 13%（阈值 20%），2026-10-20 重置"}], "resolved": [] }

No webhook? No problem — hermes (or anything) can poll instead:

# hermes mcp_servers

mcp_servers: quota: url: http:// :8780/mcp

then have a hermes cron every 15–30 min call quota_check_alerts and hermes send anything new. Same for GET /api/alerts?history=20.

2. Scheduled digest (cron)

quota_report (or GET /api/report) returns a stable, agent-friendly payload: every account's plan / expiry / remaining quota / session state / window usage / request stats, plus current alerts. Point hermes's existing 09:30 cron at it: one turn calls the tool, composes the message, and delivers via hermes send. No scheduler is duplicated inside quota-mcp.

3. Environment variables

Variable	Default	Meaning
`QUOTA_MCP_ALERT_CREDIT_PCT`	`0.2`	Fires when remaining share drops below this
`QUOTA_MCP_ALERT_EXPIRY_DAYS`	`7`	Fires when subscription/billing period ends within N days
`QUOTA_MCP_ALERT_WEBHOOK_URL`	—	POST target for alert transitions; empty = record only (pull mode)

Example (quota_status output — what an agent would read to answer "how much quota is left?"):

"stepfun": { "total": 2, "healthy": 2, "attention": 0, "accounts": ["ai-4128…: ok (10 models)", "com-3766…: ok (0 models)"] }, "commandcode": { "total": 1, "serving": 1, "limited": 0, "key_rejected": 0, "accounts": ["cc-limitcool: serving GOAT"] } }

Project layout

cmd/quota-mcp/        Entrypoint (flags/env config, one port serving both surfaces)

internal/store/ SQLite + AES-256-GCM encryption + schema internal/stepfun/ StepFun protocol client + account registry + background renewer internal/commandcode/ Command Code protocol client + account registry internal/api/ REST management surface (net/http, no framework) internal/mcpsrv/ MCP query surface (modelcontextprotocol/go-sdk) internal/alerts/ Alert rules + firing/resolved state machine + webhook push internal/digest/ Scheduled-digest payload for cron consumers

Security boundary

Ciphertext goes to the DB only — never to logs, never to responses; every endpoint returns masks
The REST surface contains writes: bind it to loopback or a private network. To expose it publicly, front it with a reverse proxy + auth and only publish the MCP path
Losing the master key means every stored credential becomes unreadable — back up QUOTA_MCP_MASTER_KEY

Releases

Binaries for Linux / macOS / Windows (amd64 + arm64) are attached to each GitHub Release. Grab the latest:

# example: linux amd64

curl -LO https://github.com/limitcool/quota-mcp/releases/latest/download/quota-mcp_linux_amd64 chmod +x quota-mcp_linux_amd64

Docker

Image is published to ghcr.io/limitcool/quota-mcp (amd64 + arm64) on every main push (:main) and tag (:v1.0.0, :latest).

docker run -d --name quota-mcp \

-p 8780:8780 \ -v quota-mcp-data:/data \ -e QUOTA_MCP_MASTER_KEY=$(openssl rand -hex 32) \ ghcr.io/limitcool/quota-mcp:latest

Or with the bundled compose file (QUOTA_MCP_MASTER_KEY is required, put it in .env):

echo "QUOTA_MCP_MASTER_KEY=$(openssl rand -hex 32)" > .env

docker compose up -d

The database lives in the /data volume (QUOTA_MCP_DB=/data/quota-mcp.db). Back up the master key — losing it makes every stored credential unreadable.

License

MIT

quota-mcp

概览

PopNx MCP 的三大支柱

它能帮你做什么

安装

安装之前

需要你填写的值

它能做什么

基础检查i

作者与仓库一致

仍在维护

有许可证

端点有响应

使用 OAuth 登录

工具描述中没有隐藏指令

与“开发者工具”中的其他服务器比较i

常见问题

替代选择

GitHub

Desktop Commander

Cloudflare MCP

作者的 README

quota-mcp

Quick start

In production set the master key explicitly (64 hex chars). Without it the key is

derived from machine traits and old ciphertext becomes unreadable after a migration.

Enrolling accounts

Command Code (two credential planes)

StepFun (browser session)

REST API

MCP surface (for agents)

or straight from the published image (works with zero setup)

Alerts, expiry warnings & scheduled digest

1. Threshold & expiry alerts (event-driven, push)

2. Scheduled digest (cron)

3. Environment variables

Project layout

Security boundary

Releases

Docker

License