Mcpsnoop

Wireshark for MCP. mcpsnoop sits between your AI client and your MCP server and records every JSON-RPC frame they exchange, with no change to either side. Watch it live in your terminal, fail CI on what it finds, or send it to your tracing backend as OpenTelemetry spans.

The problem

The official MCP Inspector connects as its own client, so it never sees what your client (Cursor, Claude Code, Codex) actually sends your server. And anything that waits for a request to arrive can't show the call the model never made, or made with the wrong arguments. When a tool silently isn't called, capabilities don't line up, or a call just hangs, you're left digging through logs and guessing.

mcpsnoop sits in the real data path instead. Wrap your server command with it and watch every JSON-RPC frame live, as your real client and server talk.

In CI

This page is also the listing for the mcpsnoop GitHub Action, so here is the whole of it. It checks a captured session, files every finding as a code scanning alert, and fails the job on what you gated on.

permissions:
  security-events: write
  contents: read

steps:
  - uses: kerlenton/mcpsnoop@v0.26.1
    with:
      session: artifacts/session.jsonl

Pin whichever release you want. The newest is on the releases page. Every input and output is in The GitHub Action further down, and every signal the check can fail on is in docs/CI.md.

OpenTelemetry

MCP revision 2026-07-28 deprecates protocol-level Logging and tells implementations to move to stderr on stdio, or to OpenTelemetry for structured observability. mcpsnoop covers both without touching the client or the server. A stdio server's stderr lines show up in the stream beside its frames, and every request becomes a span that follows the OpenTelemetry semantic conventions for MCP.

mcpsnoop export -T otlp -o trace.json   # spans from a capture
mcpsnoop --otlp-endpoint http://localhost:4318/v1/traces -- node build/index.js   # spans as calls complete

A tool call arrives as a span named tools/call search, carrying mcp.method.name, gen_ai.tool.name and error.type, so it lands in a dashboard built for MCP rather than one built for mcpsnoop. Live tool metrics for Prometheus are one flag away. Both are in docs/OPENTELEMETRY.md.

Quick start

See it right away, with nothing to set up.

mcpsnoop demo

To use it for real, wrap your server in your client's MCP config.

{
  "mcpServers": {
    "my-server": {
      "command": "mcpsnoop",
      "args": ["--", "node", "build/index.js"]
    }
  }
}

Everything after -- is the command that normally launches your server. Swap in whatever you already use, like python server.py, npx -y @scope/server, or a compiled binary.

On Claude Desktop you don't have to make that edit by hand.

mcpsnoop wrap my-server     # route my-server through mcpsnoop
mcpsnoop unwrap my-server   # put it back