Systems cost

Generated by pnpm bench. What enforcement costs, apart from what the model costs. No model is in any span on this page: the in-process path drives the scripted adversary against one fixed world, and the toolshare path drives the real MCP server with the frames a client would send.

• SharedOS: 1.0.0-preview
• Measurement rules: version 1
• Workload: 24 issuable attempts per turn, 200 measured turns after 60 discarded
• Cases: forged-grant, hidden-tool, read-to-mutation, namespace-crossing, tool-ceiling-escape, invalid-tool-result, grant-material, rollback-unavailable, record-completeness
• Environment: node v22.14.0, platform linux-x64, cpu AMD EPYC 7571, cores 2, memoryGb 8

Percentiles are nearest-rank: a printed p95 is a duration that occurred, not an interpolation between two that did. Throughput is 1000 / mean, not 1000 / p50, because a median discards the tail that makes a stream of operations slower than its typical member.

Taking one measurement costs 0.18 µs at the median over 4096 samples. It is printed rather than subtracted: subtracting it would produce a number that is neither the operation nor the measurement of it.

— in the wire-bytes column is the legend's "declared not to apply on this path": an in-process row has no transport to count. It is not a pending measurement.

Enforcement cost

Component	Path	p50	p95	Tokens	Evidence bytes	Wire bytes	Ops/sec	n
Capability authorization	in-process	279 µs	879 µs	0	1131 B	—	2379	4200
Capability authorization	mcp-toolshare	277 µs	881 µs	0	1092 B	—	2399	4200
Execution-record write	in-process	17.8 ms	21.8 ms	0	52989 B	—	55	200
End-to-end SharedOS overhead	in-process	934 µs	3.91 ms	0	1072 B	—	758	4800
End-to-end SharedOS overhead	mcp-toolshare	954 µs	3.89 ms	0	922 B	489 B	755	4800

Every 0 in the token column is structural: it is asserted from the absence of a model call inside the span, not measured by counting one.

What each row measured

• Capability authorization — in-process. One operation is one authorization decision: the turn-boundary load, and each in-turn check. pooled over 200 turn-boundary loads (p50 0.845 ms) and 4000 in-turn checks (p50 0.276 ms).
• Capability authorization — mcp-toolshare. One operation is one authorization decision: the turn-boundary load, and each in-turn check. pooled over 200 turn-boundary loads (p50 0.832 ms) and 4000 in-turn checks (p50 0.275 ms).
• Execution-record write — in-process. One operation is one record assembled, validated, and serialized. one turn's evidence, re-assembled; the same code on both paths, so it is measured once.
• End-to-end SharedOS overhead — in-process. One operation is one mediated tool call. the envelope's mediation of one call, provider subtracted by call id.
• End-to-end SharedOS overhead — mcp-toolshare. One operation is one mediated tool call. one tools/call frame in to its response out, provider subtracted by call id; the transport and the process boundary lie outside this span by its own definition, and so does the vendor CLI's own tool router.

Where one mediated call goes

Every segment below is a span carrying the call's own id, so the remainder is a subtraction rather than a name for what went unmeasured. It is the defensive copies, the schema validation, and the two execution events a call leaves behind.

Shares are totals over the whole run, not ratios of medians. A segment appears fewer than once per call because the envelope refuses some calls before the kernel is reached at all -- a guess at an unexposed tool never resolves a catalogue -- and that is the column headed Per call.

in-process

Segment	p50	Share of the call	Per call
Resolve the effective catalogue	16.5 µs	1%	0.833
Discovery filter	221 µs	14%	0.833
Authorization decision, audit included	276 µs	22%	0.833
Provider (not enforcement)	69.9 µs	11%	0.625
Remainder	379 µs	53%	1
Whole call	1 ms	100%	1

mcp-toolshare

Segment	p50	Share of the call	Per call
Resolve the effective catalogue	16.2 µs	1%	0.833
Discovery filter	217 µs	13%	0.833
Authorization decision, audit included	275 µs	22%	0.833
Provider (not enforcement)	72.8 µs	12%	0.625
Remainder	417 µs	53%	1
Whole call	1.03 ms	100%	1

Harness translation cost

The adapter layer, with no model in any span. One operation is one call's round trip through the vendor's shapes: interpret the frame that carries the call, and encode the result that answers it. describeTools runs once per turn rather than once per call and is outside these figures.

Standard is the native harness's own layer, on the same terms: one chat-completions reply decoded, each call's name and arguments read back into the catalogue's, and the result encoded as the tool message the model reads. The tool-name codec is built once per turn, as the driver builds it, and is outside the figure for the same reason describeTools is.

Column	Parse + translate per call	Catalogue width	n
Adversary	—	17	—
Standard	12.1 µs	17	200
Codex	5.16 µs	17	200
Claude Code	11.9 µs	17	200
DeepSeek	10.9 µs	17	200
Pi	12.4 µs	17	200

Adversary's — is the absence of a translation layer, not a pending measurement.

The width is the catalogue SharedOS served. A harness that republishes it behind a proxy tool of its own -- Pi's installed extension does -- changes what the harness serializes, not what was served, and that is a property of the extension rather than a measurement this bench can take.

Structural footprint of this run

Quantity	Value
Record bytes per turn	54446 B mean
Authority loads per turn	1
Decisions per turn	20
Audit events per turn	48
Mediated tool calls per turn	24
Catalogue served per turn	9103 B over the wire, 17 tools