
Security News
White House Authorizes Private Companies to Conduct Offensive Cyber Operations
A new federal program will let vetted U.S. cybersecurity firms help investigate and disrupt foreign cybercrime groups under government direction.
@spanlens/mcp-server
Advanced tools
MCP server for Spanlens — query LLM cost, anomalies, traces, and per-user analytics from inside Cursor, Continue, or Claude Desktop.
Query your LLM observability data from inside Cursor, Continue, or Claude Desktop. Powered by Spanlens.
Ask your IDE's agent things like "what's my OpenAI spend this week?", "any cost anomalies?", or "show me the most expensive trace today" — and get real answers from your Spanlens workspace through the Model Context Protocol.
Public-scope keys (sl_live_pub_*) are read-only — they can query your dashboard data but cannot trigger LLM proxy spend. This server refuses to start with a full-access key because the credential will live in a plaintext config file in your IDE.
Create one at spanlens.io/projects → the Public Keys card at the top → + New public key. Copy the sl_live_pub_… value when it's shown.
~/.cursor/mcp.json (or workspace .cursor/mcp.json){
"mcpServers": {
"spanlens": {
"command": "npx",
"args": ["-y", "@spanlens/mcp-server"],
"env": { "SPANLENS_API_KEY": "sl_live_pub_..." }
}
}
}
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows){
"mcpServers": {
"spanlens": {
"command": "npx",
"args": ["-y", "@spanlens/mcp-server"],
"env": { "SPANLENS_API_KEY": "sl_live_pub_..." }
}
}
}
~/.continue/config.yamlmcpServers:
- name: spanlens
command: npx
args: ['-y', '@spanlens/mcp-server']
env:
SPANLENS_API_KEY: sl_live_pub_...
The agent will discover six tools and use them automatically when relevant.
| Question | Tool called |
|---|---|
| "How much have we spent on LLMs this week?" | get_stats |
| "Break down cost by model for the last 30 days" | get_stats(groupBy=model) |
| "Any cost or latency anomalies?" | get_anomalies |
| "Show me the 10 most recent error calls on gpt-4o" | query_requests |
"Walk me through trace abc123…" | get_trace |
| "What models could we swap to save money?" | get_savings |
| "Which end-user is driving the most spend?" | get_user_analytics |
| Tool | What it returns |
|---|---|
get_stats | Aggregate cost, request count, token usage, latency, error rate. Optional groupBy for per-model or per-provider breakdown. |
query_requests | Individual LLM requests with cost, latency, model, error message. Filter by model, provider, status, userId, since, limit. |
get_trace | Full agent span tree for a trace ID — every LLM/tool/retrieval span with timing, tokens, cost. |
get_anomalies | Cost / latency / error-rate anomalies the platform has detected. Optional severity. |
get_savings | Model-swap recommendations with projected monthly savings and adoption status. |
get_user_analytics | Per-end-user usage breakdown — total cost, request count, models touched, recent calls. |
This server is designed for the IDE-config use case, where the credential sits in a plaintext file that's easy to leak (dotfile sync, screen shares, accidental commits). Two defenses:
/api/v1/me/key-info against your workspace, and verifies the key has scope=public. If you accidentally paste a full-access sl_live_* key, the server refuses to start with a clear error pointing at the correct key type./proxy/* or /ingest/* — the Spanlens server enforces this with a 403 + PUBLIC_KEY_WRITE_FORBIDDEN code. The blast radius of a leak is "competitor sees my usage stats", not "competitor runs up my OpenAI bill".| Environment variable | Default | Notes |
|---|---|---|
SPANLENS_API_KEY | required | A sl_live_pub_* key from the Public Keys card on /projects. The server refuses to start without one, and refuses to start with a sl_live_* (full) key. |
SPANLENS_BASE_URL | https://server.spanlens.io | Override for self-hosted Spanlens. Trailing slashes are normalised. |
{
"mcpServers": {
"spanlens": {
"command": "npx",
"args": ["-y", "@spanlens/mcp-server"],
"env": {
"SPANLENS_API_KEY": "sl_live_pub_...",
"SPANLENS_BASE_URL": "https://spanlens.your-company.com"
}
}
}
}
MIT — see LICENSE in the repo root.
FAQs
MCP server for Spanlens — query LLM cost, anomalies, traces, and per-user analytics from inside Cursor, Continue, or Claude Desktop.
The npm package @spanlens/mcp-server receives a total of 57 weekly downloads. As such, @spanlens/mcp-server popularity was classified as not popular.
We found that @spanlens/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A new federal program will let vetted U.S. cybersecurity firms help investigate and disrupt foreign cybercrime groups under government direction.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.