mcpspend-cost-tracking

The skill is mostly coherent with its stated purpose: a cost-observability proxy must modify MCP configs, intercept tool-call metadata, and send usage data to MCPSpend. Main concerns are medium-risk supply-chain hygiene from unpinned npx @latest installs, direct credential forwarding to vendor packages/services, and the inherent sensitivity of placing a third-party proxy in the path of MCP traffic across several clients. This looks suspicious only in the sense of elevated trust requirements, not confirmed malicious behavior.