kerlenton/mcpsnoop

What it solves

mcpsnoop is a transparent proxy for the Model Context Protocol (MCP), acting as a "Wireshark for MCP." It solves the problem of visibility into the actual communication between an AI client (like Cursor, Claude Code, or Codex) and its MCP servers. Unlike the official MCP Inspector, which acts as its own client, mcpsnoop sits directly in the data path, allowing developers to see every real tool call, identify hung calls, detect malformed JSON-RPC frames, and spot tool definition drift.

How it works

The tool operates in two roles within a single binary: a transparent shim and a hub. When used as a shim (mcpsnoop -- <server>), it forwards bytes verbatim between the client and server while copying every frame to a hub. The hub (mcpsnoop with no arguments) provides a live Terminal User Interface (TUI) to monitor and analyze the traffic. These two components pair automatically via a well-known socket and on-disk logs. It supports both stdio and streamable-HTTP servers, and can be integrated into CI/CD pipelines via a GitHub Action to fail jobs based on errors or latency budgets.

Who it’s for

Developers building or debugging MCP servers and AI clients who need real-time, high-fidelity visibility into the JSON-RPC traffic and tool execution performance.

Highlights

• Real-time Monitoring: A live TUI to watch tool calls and JSON-RPC frames as they happen.
• CI Integration: A GitHub Action that files code scanning alerts and fails jobs on gated errors.
• HTTP Proxying: Support for streamable-HTTP servers with detailed HTTP status tracking.
• Observability: Built-in Prometheus metrics for tool-call totals, error rates, and latency histograms.
• Session Management: Ability to export sessions to JSON, HTML, text, HAR, or OTLP formats for post-mortem analysis.
• Redaction: Tools to scrub secrets, keys, and specific paths from captured logs before sharing.
• Zero-config Setup: Simple wrap/unwrap commands for Claude Desktop configuration.