Too Many MCP Tools: The Context Tax on Every Agent Turn

Connect five MCP servers with forty tools each and their schemas load before the model sees a line of your problem. Nothing errors; the agent just gets worse at picking tools.

What a tool list costs before it is used

An MCP server's tools are not idle until called. As one Dev.to write-up puts it, their names, descriptions and full input schemas are text, and that text loads before the model can decide whether to use them.

Two things degrade at once. Context available for real work shrinks, and selection accuracy drops because the model is choosing from a longer, noisier list. The author's point: the second is the expensive half and it is invisible — there is no error for picking a plausible but wrong tool.

The symptoms stay soft, which is why teams miss it: responses slow with no obvious cause, long sessions degrade faster than they used to, and eventually someone says it used to be better at this. None of that files a bug report. The cheapest diagnostic named in the piece: Claude Code's /mcp panel shows a tool count next to each connected server, and the author reports most people are surprised by the total — the browser automation server usually the culprit.

Tool search already defers most of the bill

On recent versions this is partly handled. Per the same write-up, tool search defers tool schemas by default: rather than loading every definition up front, the model searches for what it needs and expands only those. A session with dozens of deferred tool names might load the schemas of only the two or three actually touched.

That also explains a ticket you can stop filing: "connected but the tool isn't available" is often not a bug — the tools are there, they just have not been expanded yet.

You can exempt a server you hit every turn with "alwaysLoad": true in its mcpServers entry, the author notes, but sparingly: every always-loaded tool consumes context tool search could have spent on something more relevant. Small, focused servers are the reasonable candidates; large ones are exactly where you were most tempted to force them on.

Where deferral does not run

Check this against your own deployment. The write-up lists tool search as off with a custom ANTHROPIC_BASE_URL, with ENABLE_TOOL_SEARCH=false, on Amazon Bedrock, on Claude Platform on AWS, on Microsoft Foundry, through a Claude apps gateway, and on Google Cloud's Agent Platform with pre-4.5 models. There, everything loads up front, so tool-count discipline matters far more than on a default desktop setup.

Output is the other half

Tool definitions are the cost of having a tool available; output is the cost of using it. The author reports Claude Code warns when MCP tool output exceeds 10,000 tokens and caps it at 25,000 by default — a ceiling that exists because one unbounded query against a large table can consume more context than every tool definition you were worried about.

For anyone writing a server, that sets the design rule: return the smallest useful result, not the most complete one. A tool returning 50 rows with a has_more flag beats one returning 5,000 rows and blowing the window.

Surface area is a security number too

Quokka Labs gave an AI agent write access to a sandbox CRM and ranked 12 controls by how much each reduced unauthorized actions and irreversible damage. Strict tool schemas land at #6, untrusted tool-output inspection at #7 and idempotency controls at #8; for their malicious-tool-output case they report output validation as the control that mattered most. They also cite AWS's disclosure of CVE-2026-18733, where indirect prompt injection could bypass a human consent gate, and NIST's August 27, 2026 guidance that agentic systems need strong identity and authorization foundations because model-only guardrails are insufficient.

What to do this week

Open the tool count. Disconnect any server whose tools the agent has not called in the last week — the author's rule is that a server earns its place by doing something you asked for, and reconnecting takes seconds. Then check whether your runtime sits on the exclusion list above: that decides whether tool count is a preference or a hard budget.