Tessera MCP Server
@tessera-llm/mcp-server exposes six tools for any MCP-aware agent (Claude Desktop, Claude Code, Cursor, Cline, Continue, Goose): tessera_list_workloads, tessera_get_savings_report, tessera_get_recommendation_queue, tessera_get_ledger_entries, tessera_get_quality_snapshot, tessera_approve_recommendation.
Five of the six are read-only: they return decisions, not raw rows. The one mutator (approve_recommendation) is the bounded blast-radius operation. Provider config, API key rotation, and Stripe operations live in the dashboard where there is a confirm modal, not in the MCP surface.
Tool results that echo customer-controlled strings (workload names, recommendation rationale, ledger notes) are wrapped in tessera:untrusted sentinels with a preamble instructing the calling LLM to treat the wrapped regions as data, not instructions. Mitigates the Supabase MCP "lethal trifecta" class of attack disclosed by General Analysis in July 2025.
Apache-2.0 SDK + free 60M-tokens-per-month Sandbox tier (no card) at tesseraai.io/dev. Get a key in 30 seconds; the server reads it from the TESSERA_API_KEY env var.
Transports: stdio (default) plus optional Streamable HTTP behind TESSERA_MCP_TRANSPORT=http for remote/hosted deployment.
Server Config
{
"mcpServers": {
"tessera": {
"command": "npx",
"args": [
"-y",
"@tessera-llm/mcp-server"
],
"env": {
"TESSERA_API_KEY": "tk_..."
}
}
}
}