Systems cost
Generated by pnpm bench. What enforcement costs, apart from what the model
costs. No model is in any span on this page: the in-process path drives the
scripted adversary against one fixed world, and the toolshare path drives the
real MCP server with the frames a client would send.
- SharedOS:
0.1.0-alpha.3 - Measurement rules: version
1 - Workload: 24 issuable attempts per turn, 200 measured turns after 60 discarded
- Cases:
forged-grant,hidden-tool,read-to-mutation,namespace-crossing,tool-ceiling-escape,invalid-tool-result,grant-material,rollback-unavailable,record-completeness - Environment: node
v22.23.2, platformlinux-x64, cpuAMD EPYC 7571, cores2, memoryGb8
Percentiles are nearest-rank: a printed p95 is a duration that occurred, not
an interpolation between two that did. Throughput is 1000 / mean, not
1000 / p50, because a median discards the tail that makes a stream of
operations slower than its typical member.
Taking one measurement costs 0.18 µs at the median over 4096 samples. It is printed rather than subtracted: subtracting it would produce a number that is neither the operation nor the measurement of it.
— in the wire-bytes column is the legend's "declared not to apply on this
path": an in-process row has no transport to count. It is not a pending
measurement.
Enforcement cost
| Component | Path | p50 | p95 | Tokens | Evidence bytes | Wire bytes | Ops/sec | n |
|---|---|---|---|---|---|---|---|---|
| Capability authorization | in-process | 285 µs | 738 µs | 0 | 1038 B | — | 2930 | 4200 |
| Capability authorization | mcp-toolshare | 281 µs | 723 µs | 0 | 1000 B | — | 3016 | 4200 |
| Execution-record write | in-process | 16.8 ms | 18.8 ms | 0 | 52901 B | — | 59 | 200 |
| End-to-end SharedOS overhead | in-process | 8.29 ms | 13.5 ms | 0 | 1068 B | — | 128 | 4800 |
| End-to-end SharedOS overhead | mcp-toolshare | 8.19 ms | 13.3 ms | 0 | 918 B | 489 B | 129 | 4800 |
Every 0 in the token column is structural: it is asserted from the absence
of a model call inside the span, not measured by counting one.
What each row measured
- Capability authorization — in-process. One operation is one authorization decision: the turn-boundary load, and each in-turn check. pooled over 200 turn-boundary loads (p50 0.776 ms) and 4000 in-turn checks (p50 0.283 ms).
- Capability authorization — mcp-toolshare. One operation is one authorization decision: the turn-boundary load, and each in-turn check. pooled over 200 turn-boundary loads (p50 0.756 ms) and 4000 in-turn checks (p50 0.278 ms).
- Execution-record write — in-process. One operation is one record assembled, validated, and serialized. one turn's evidence, re-assembled; the same code on both paths, so it is measured once.
- End-to-end SharedOS overhead — in-process. One operation is one mediated tool call. the envelope's mediation of one call, provider subtracted by call id.
- End-to-end SharedOS overhead — mcp-toolshare. One operation is one mediated tool call. one
tools/callframe in to its response out, provider subtracted by call id; the transport and the process boundary lie outside this span by its own definition, and so does the vendor CLI's own tool router.
Where one mediated call goes
Every segment below is a span carrying the call's own id, so the remainder is a subtraction rather than a name for what went unmeasured. It is the defensive copies, the schema validation, and the two execution events a call leaves behind.
Shares are totals over the whole run, not ratios of medians. A segment appears fewer than once per call because the envelope refuses some calls before the kernel is reached at all -- a guess at an unexposed tool never resolves a catalogue -- and that is the column headed Per call.
in-process
| Segment | p50 | Share of the call | Per call |
|---|---|---|---|
| Resolve the effective catalogue | 7.27 ms | 80% | 0.833 |
| Discovery filter | 300 µs | 3% | 0.833 |
| Authorization decision, audit included | 283 µs | 3% | 0.833 |
| Provider (not enforcement) | 94.3 µs | 2% | 0.625 |
| Remainder | 470 µs | 11% | 1 |
| Whole call | 8.36 ms | 100% | 1 |
mcp-toolshare
| Segment | p50 | Share of the call | Per call |
|---|---|---|---|
| Resolve the effective catalogue | 7.14 ms | 79% | 0.833 |
| Discovery filter | 296 µs | 3% | 0.833 |
| Authorization decision, audit included | 278 µs | 3% | 0.833 |
| Provider (not enforcement) | 93.6 µs | 2% | 0.625 |
| Remainder | 517 µs | 12% | 1 |
| Whole call | 8.27 ms | 100% | 1 |
Harness translation cost
The adapter layer, with no model in any span. One operation is one call's
round trip through the vendor's shapes: interpret the frame that carries the
call, and encode the result that answers it. describeTools runs once per
turn rather than once per call and is outside these figures.
| Column | Parse + translate per call | Catalogue width | n |
|---|---|---|---|
| Adversary | — | 17 | — |
| Codex | 5.11 µs | 17 | 200 |
| Claude Code | 12.7 µs | 17 | 200 |
| DeepSeek | 9.75 µs | 17 | 200 |
| Pi | 12.3 µs | 17 | 200 |
Adversary's — is the absence of a translation layer, not a pending measurement.
The width is the catalogue SharedOS served. A harness that republishes it behind a proxy tool of its own -- Pi's installed extension does -- changes what the harness serializes, not what was served, and that is a property of the extension rather than a measurement this bench can take.
Structural footprint of this run
| Quantity | Value |
|---|---|
| Record bytes per turn | 54358 B mean |
| Authority loads per turn | 1 |
| Decisions per turn | 20 |
| Audit events per turn | 43 |
| Mediated tool calls per turn | 24 |
| Catalogue served per turn | 9103 B over the wire, 17 tools |