
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@alephantai/mcp
Advanced tools
Alephant MCP Server — query AI spend, manage virtual keys and policies from your AI IDE
Model Context Protocol server for Alephant BYO-KEY: FinOps metrics, virtual keys, and workspace analytics from Cursor, Claude Desktop, or any MCP host.
| Mode | Environment | Tools |
|---|---|---|
| VK | ALEPHANT_VIRTUAL_KEY | Cockpit-scoped usage + 3 VK tools (8 tools total incl. shared) |
| Manager | ALEPHANT_PAT + ALEPHANT_WORKSPACE_ID | Workspace-wide management (27 tools total incl. shared) |
PAT takes precedence when ALEPHANT_PAT is non-empty. If neither VK nor PAT is set, the process exits with an error (no mock data).
Required (both modes): ALEPHANT_API_BASE_URL
Optional: ALEPHANT_RATE_LIMIT_RPM (default 60, use 0 to disable client-side throttling)
npx troubleshootingFrom this repo’s root (alephant-mcp/): do not use npx -y @alephantai/mcp to “smoke test” the published package. npm treats the current directory as the local @alephantai/mcp project and does not link the root package’s bin into node_modules/.bin, so Windows then fails with 'alephant-mcp' is not recognized (or the Chinese CMD equivalent).
Use one of these instead while developing in the clone:
npm start
# or
node .\bin\alephant-mcp.js
To verify npx the same way end users do, run it from any other directory (e.g. the parent folder):
cd ..
npx -y @alephantai/mcp
From a normal project folder (after npm install @alephantai/mcp), you can also run:
node .\node_modules\@alephantai\mcp\bin\alephant-mcp.js
If npx -y @alephantai/mcp still fails outside the clone, try:
npx --yes --package=@alephantai/mcp alephant-mcp
Published packages 0.0.2+ include the bin/alephant-mcp.js shim for reliable npm bin resolution when installed from the registry.
Alephant MCP is a local stdio server. Use one server entry per credential scope. For multiple workspaces, create multiple entries with different names and environment variables.
Virtual Key (read-only / scoped cockpit):
{
"mcpServers": {
"alephant": {
"command": "npx",
"args": ["-y", "@alephantai/mcp"],
"env": {
"ALEPHANT_API_BASE_URL": "https://alephant.io",
"ALEPHANT_VIRTUAL_KEY": "vk-..."
}
}
}
}
Personal Access Token (manager):
{
"mcpServers": {
"alephant-workspace-a": {
"command": "npx",
"args": ["-y", "@alephantai/mcp"],
"env": {
"ALEPHANT_API_BASE_URL": "https://alephant.io",
"ALEPHANT_PAT": "pat_...",
"ALEPHANT_WORKSPACE_ID": "00000000-0000-0000-0000-000000000000"
}
}
}
}
Use separate mcpServers entries per workspace when you have multiple PATs.
Add a stdio MCP server in ~/.codex/config.toml:
[mcp_servers.alephant]
command = "npx"
args = ["-y", "@alephantai/mcp"]
env = {
ALEPHANT_API_BASE_URL = "https://alephant.io",
ALEPHANT_VIRTUAL_KEY = "vk-..."
}
startup_timeout_sec = 20
tool_timeout_sec = 120
For Manager mode, replace the VK env with:
env = {
ALEPHANT_API_BASE_URL = "https://alephant.io",
ALEPHANT_PAT = "pat_...",
ALEPHANT_WORKSPACE_ID = "00000000-0000-0000-0000-000000000000"
}
Verify with:
codex mcp list
codex mcp get alephant
Add a local MCP server under mcp in your OpenCode config, for example opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"alephant": {
"type": "local",
"command": ["npx", "-y", "@alephantai/mcp"],
"enabled": true,
"environment": {
"ALEPHANT_API_BASE_URL": "https://alephant.io",
"ALEPHANT_VIRTUAL_KEY": "vk-..."
}
}
}
}
For Manager mode, use ALEPHANT_PAT and ALEPHANT_WORKSPACE_ID in environment instead of ALEPHANT_VIRTUAL_KEY.
Use the CLI to add Alephant as a local stdio server:
claude mcp add-json alephant '{"type":"stdio","command":"npx","args":["-y","@alephantai/mcp"],"env":{"ALEPHANT_API_BASE_URL":"https://alephant.io","ALEPHANT_VIRTUAL_KEY":"vk-..."}}' --scope user
claude mcp list
claude mcp get alephant
For a shared project config, create .mcp.json in the project root:
{
"mcpServers": {
"alephant": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@alephantai/mcp"],
"env": {
"ALEPHANT_API_BASE_URL": "https://alephant.io",
"ALEPHANT_VIRTUAL_KEY": "vk-..."
}
}
}
}
For Manager mode, replace the VK env with ALEPHANT_PAT and ALEPHANT_WORKSPACE_ID.
npx --yes --package=@alephantai/mcp alephant-mcp --audit
scope + usage-summary (billing cycle).GET /api/v1/analytics/overview.Shared (both modes): check_alephant_connection, get_usage_summary, get_daily_costs, get_cost_by_model, list_available_models
VK only: get_my_scope, get_my_budget, get_my_recent_requests
Manager only: get_workspace_overview, get_workspace_budget_status, list_virtual_keys, create_virtual_key, update_key_budget, revoke_virtual_key, list_agents, get_agent_analytics, list_members, get_member_analytics, list_departments, get_department_analytics, get_subscription_info, set_budget_policy, get_live_24h, get_usage_timeseries, get_sparklines, diagnose_cost_anomaly, get_executive_dashboard, drill_down_spend, find_idle_resources, compare_entity_periods
get_request_logs is not included (JWT-only backend route).
/alephant-… 快捷模板、工具对照表docs/marketplace-submission.md for official MCP Registry, Smithery, and Glama submission notes.npm install
npm test
npm run build
Published as @alephantai/mcp (alephant-mcp binary).
FAQs
Alephant MCP Server — query AI spend, manage virtual keys and policies from your AI IDE
We found that @alephantai/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.