Tool output is part of the context bill
Anthropic's context documentation says tool results, messages, system instructions, images, documents, and tool definitions all count toward the context window. It also says prompt caching changes the price of reused tokens, not the amount of context they occupy.[2]
That makes raw logs, browser snapshots, issue lists, and repository scans obvious targets for reduction. The useful move is to compute against the large result and send the model the small answer. The dangerous move is to discard the large result before anyone defines its custody.
Compression answers how much the model sees. Custody answers whether anyone can check it.
A trending project makes the split concrete
Context Mode is an open repository and npm package that routes tool work through an MCP server. Its README says a 315 kilobyte input became 5.4 kilobytes in one example. The project stores session events in SQLite, indexes content with FTS5, retrieves selected passages, and exposes a purge command.[1]
Those are project claims, not results we reproduced. We inspected release 1.0.169 at commit 8de5f73. The package declares Node.js 22.5 or newer, an Elastic License 2.0 license, a post-install script, local databases, hooks, and eleven MCP tools. We did not install or run it because setup changes agent clients, hooks, and local history paths.
Compaction and retrieval solve different failures
OpenAI's compaction guide says its server can emit an encrypted compaction item after a configured token threshold. The item carries prior state into the next window. The guide also says it is opaque and not meant for human interpretation.[3]
Anthropic documents server-side compaction, old tool-result clearing, and thinking-block clearing as separate controls.[2] A compacted conversation can continue. That does not mean a reviewer can recover one exact command result, compare it with the current repository, or prove that retained data was deleted.
The protocol already has room for an address
The MCP tool specification allows text, structured content, embedded resources, and resource links in tool results. It also allows output schemas. Clients should validate structured results when a schema exists.[4]
A compact result can therefore carry a count, status, source address, digest, retention rule, and retrieval hint. The raw payload does not need to flood every turn. It does need a named location and a deletion route that the operator can inspect.
Use a two-record contract
Keep the model record small. Include the answer, query, source address, timestamp, and digest. Keep the custody record outside the model context. Include the raw artifact, access scope, retention deadline, deletion action, and retrieval log.
The inspection rack below is a teaching fixture. Its byte reduction is illustrative. It does not measure Context Mode or predict savings for another agent. Use it to draft the contract before routing real output through a filter.