mcpsnoop: A Transparent Proxy and TUI for Debugging MCP Traffic

Solving the MCP Visibility Gap

mcpsnoop provides a transparent proxy that captures and visualizes real-time tool calls between an AI client (such as Claude Desktop, Cursor, or Claude Code) and an MCP server. Unlike the official MCP Inspector, which acts as a separate client and cannot observe the actual traffic of a production client, mcpsnoop sits directly in the data path to reveal exactly what is being sent and received.

This approach eliminates the need to manually tail logs in /tmp or guess why a tool was not called, why capabilities are mismatched, or why a specific request is hanging.

Core Features for MCP Debugging

mcpsnoop includes several specialized tools to accelerate the development and troubleshooting of MCP servers:

Live JSON-RPC Streaming and Inspection

The tool provides a color-coded live stream of requests, responses, and notifications. It specifically flags errors and slow calls, including tool-level result.isError flags that go beyond standard JSON-RPC error codes. Users can drill into any frame using the enter key to view pretty-printed JSON with integrated search.

Tool Call Replay

One of the most significant productivity features is the ability to re-run any captured tool call against a fresh, isolated instance of the server. This creates a tight iteration loop for fixing bugs in specific tool implementations without needing to trigger the entire AI conversation again.

Capability and State Monitoring

Capability Inspector: By pressing c, developers can see the exact capabilities agreed upon during the initial handshake between the client and server.
Hung-Call Detection: In-flight requests are marked as PENDING with a live timer, making it immediately obvious when a tool call has stalled.
Advanced Filtering: The stream can be narrowed using specific tokens such as tool:, status:, dir:, kind:, and id:, or via plain text search.

Architecture and Implementation

mcpsnoop operates using a dual-role binary system. When run as mcpsnoop -- <server>, it acts as a transparent shim that forwards bytes verbatim while copying each JSON-RPC frame to a local store. When run as mcpsnoop without arguments, it launches the TUI hub.

Because the shim and the UI communicate via a well-known socket and on-disk logs, the UI can backfill past sessions, meaning the developer does not need to start the UI before the AI client.

Deployment Modes

Standard Wrapper: Wrap the server command in the client's MCP configuration (e.g., mcpsnoop -- node server.js).
HTTP Reverse Proxy: For streamable-HTTP servers, it can be run as a reverse proxy: mcpsnoop http --target http://localhost:3000/mcp --listen :7000.

Comparison with Existing Tools

Feature	MCP Inspector	mcp-trace	mcpsnoop
Sees real client–server traffic	No	Yes	Yes
Interactive TUI	No	Yes	Yes
Zero-config / No flags	No	No	Yes
Capability inspector	Partial	No	Yes
Replay captured calls	No	No	Yes
Single binary (no deps)	No	Varies	Yes

Community Insights and Considerations

While the tool is praised for filling a critical visualization gap, community discussions have highlighted areas for future improvement and security considerations:

Data Privacy: Users have raised concerns regarding the redaction of sensitive information, such as bearer tokens in HTTP headers or secrets within payloads.
Auditability: There is a suggested need for remote debugging and post-mortem support to align with broader AI auditability standards.
Extensibility: Some users suggested the possibility of a web-based browser interface for data visualization as an alternative to the TUI.

"The official Inspector connects as a second client, off to the side. mcpsnoop sits in the actual pipe, so it sees exactly what your real client and server say to each other."

Installation

mcpsnoop can be installed via Go, Homebrew, or as a prebuilt binary:

Go: go install github.com/kerlenton/mcpsnoop/cmd/mcpsnoop@latest
Homebrew: brew tap kerlenton/mcpsnoop && brew install mcpsnoop