MCP cost is not only host CPU. It is compute + upstream APIs + model tokens + human incident time.
Cost surfaces
| Surface | What burns money |
|---|---|
| MCP runtime | Always-on or scaled containers/functions |
| Upstream APIs | SaaS/DB calls from tools |
| LLM tokens | Tool definitions + tool results in context (client best practices) |
| Incidents | Runaway agents, auth outages |
Protocol-mandated server controls
From Tools — Security Considerations, servers MUST:
- Validate all tool inputs
- Implement access controls
- Rate limit tool invocations
- Sanitize tool outputs
Clients SHOULD implement timeouts for tool calls and log usage for audit.
Also apply scope minimization so stolen tokens cannot invoke every high-privilege tool.
Agent-loop failure modes
| Pattern | Symptom | Mitigation |
|---|---|---|
| Retry storm | Same failing tools/call thousands of times | Rate limits; circuit break on error rate; fix isError messages |
| Definition flood | Huge prompt before user message | Progressive discovery (client best practices) |
| Result flood | Multi‑MB tool payloads | Summarize in server; resources instead of blobs; code-mode composition |
| Over-scoped OAuth | One token does everything | Least privilege scopes |
Tool execution errors should use isError: true with actionable text so models can self-correct instead of thrashing (tools error handling).
Quotas that work in practice
| Quota | Example |
|---|---|
| Per-token / per-user RPS | Protect shared remotes |
| Per-tool daily caps | Expensive upstream APIs |
| Max concurrent sessions | Streamable HTTP multi-client |
| Max payload size | Prevent context/memory bombs |
| Separate staging vs prod budgets | Avoid demo traffic killing prod |
Multi-tenant: isolate quotas per tenant (multi-tenant guide).
Compute right-sizing
Start small; raise profile only with evidence (OOM, sustained high p95). See server profiles and product profiles docs.
Observability for cost
Track:
- Calls per tool
- Error rate (loops)
- Latency p95
- Auth failures
- Upstream 429s
MCPLambda: tool analytics. Protocol debugging: Inspector.
Controls checklist
- Server-side rate limits on
tools/call - Timeouts client-side
- Circuit breaker on elevated error rate
- Staging keys cannot hit prod upstream
- Destructive tools disabled on shared prod
- Progressive discovery if tool catalog is large
- Alerts on cost/error spikes
Worked scenario: The weekend retry storm
A flaky upstream returns 500s. Your tool surfaces a vague error. Agents retry dozens of times per user. Overnight you burn the SaaS API quota and the MCP host scales on useless load.
You add: server-side rate limits on tools/call (required by the tools security guidance), clearer isError text (“upstream unavailable; retry after 60s”), a circuit breaker after N failures per minute, and an alert on identical failing tool signatures.
Separately, a host loads 200 tool definitions every turn. You split servers and push progressive discovery so token cost drops even though MCP CPU was never high.
Checklist for this topic
- Server-side rate limits on tools/call
- Client timeouts on tool calls
- Actionable isError messages (not empty failures)
- Circuit break on elevated error rate
- Per-tenant/per-key quotas for shared remotes
- Alert on retry storms and upstream 429s
Topic-specific failure modes
| Failure | Likely cause | Fix |
|---|---|---|
| Quota exhaustion | Retry loops | Rate limit + clearer errors |
| Huge LLM bills | Tool definition flood | Progressive discovery / fewer servers |
| One tenant starves others | No isolation of quotas | Per-tenant limits |
| Cost spike after deploy | New chatty tool | Diff tool call volume post-release |
Related guides
Observability · Tools & primitives · Multi-tenant
In practice: default limits
Start conservative on shared remotes:
- Per-token: e.g. N
tools/call/ minute - Per-tool: stricter caps on expensive upstream tools
- Global: burst ceiling to protect the process
Tune up with evidence. Defaults that are “unlimited because internal” become external-facing faster than you expect.
Cost review ritual
Monthly, review:
- Top tools by call volume
- Top tools by error rate (wasted retries)
- Top tools by upstream spend
- Hosts with the largest tool catalogs attached
Kill or split noisy tools. Progressive discovery and result truncation often save more money than shrinking a compute profile.
Takeaways
For MCP Rate Limits, Quotas, and Cost Control, remember three things:
- Be specific to this problem — the worked scenario “The weekend retry storm” is the failure mode you should design against, not a generic outage narrative.
- Bound retries and payload size at the server; agents will otherwise amplify cost in loops.
- Publish quotas per key/tenant and fail with actionable errors before upstream bills spike.
If you only remember one habit: treat weekend retry storms as a design bug, not only an ops event.
Sources
- Tools — security considerations
- Tools — error handling
- Client best practices
- Security Best Practices — scope minimization
- Transports — 2025-11-25
