2026-07-04

mcpsnoop turns MCP debugging into something you can actually see

If you build with Claude Desktop, Cursor, or Claude Code, MCP debugging has a familiar smell: you think the server is fine, but the real problem is somewhere in the handshake, the arguments, or a request that never quite happened. mcpsnoop is interesting because it doesn’t sit off to the side like the official Inspector; it drops into the actual path between client and server, which is the part developers usually need to inspect first.

Key Points

mcpsnoop is a transparent proxy for MCP, described as “Wireshark for MCP.”
It shows the real tool calls between an AI client and an MCP server, live in a terminal UI.
The project specifically calls out Claude Desktop, Cursor, and Claude Code as examples of clients it can observe.
The official MCP Inspector connects as its own client, so it cannot see the actual traffic between your real client and server.
mcpsnoop wraps the server command in your MCP config, then forwards bytes while capturing frames for display.
It supports both stdio-style servers and streamable HTTP servers.
There’s a mcpsnoop demo mode for a scripted session if you want to see the UI without wiring anything up.
The UI shows requests, responses, notifications, server stderr, errors, slow calls, and even result.isError at the tool level.
It includes replay, so you can rerun a captured tool call against a fresh isolated copy of the server.
There’s a capability inspector, a full frame inspector, hung-call detection, and filtering by fields like tool:, status:, dir:, kind:, and id:.
The project positions itself as a single binary with no runtime dependencies.
Installation options include go install, Homebrew, or a prebuilt binary.
The README is explicit about security: it runs the server command you wrap, so you should only use it with trusted servers.

My Take

What strikes me is how practical this is. A lot of MCP tooling feels like it was built for protocol authors, not for the person trying to figure out why Claude Code didn’t call the tool they expected. mcpsnoop feels more like the thing you’d reach for at 11 p.m. when a server is “working” but not actually working.

I think the biggest win here is the simple claim that it sits in the real data path. That sounds obvious, but it’s the whole ballgame. Once you can see the actual frames, the mystery usually collapses fast: wrong capability exchange, a client-side assumption, a malformed argument, or a server that’s hanging and pretending not to. The live timer on pending calls is especially appealing; that’s the kind of tiny UI detail that saves time because it turns “maybe it’s slow” into “yes, this is stuck.”

The replay feature is what makes me most curious. If it’s as smooth as the README suggests, that’s not just debugging candy — that’s a real workflow improvement. Being able to capture a call and rerun it against a clean server instance sounds much better than reproducing a flaky agent interaction by hand. I’d definitely try that first when iterating on an MCP tool.

I’m a little skeptical of the “Wireshark for MCP” framing only because analogies like that can overpromise. This is not packet capture in the broad networking sense; it’s a very focused developer tool for one protocol layer. Still, the analogy is useful because it tells you exactly what the product instinct is: observe reality, don’t infer it. That’s the right instinct for agent tooling.

What I’d actually do with it as a Claude Code user is keep it around as a diagnostic shim for any custom MCP server I write. I’d use it when a tool silently disappears from Claude’s menu, when a capability negotiation looks off, or when a call returns something weird and I need to know whether the bug is in my server or in the client’s expectations. I’d also be curious whether this becomes a standard part of the MCP debugging stack, because the “official inspector” model really does leave a gap here.

The short version: mcpsnoop looks like one of those unglamorous tools that becomes indispensable the moment MCP stops being a demo and starts being part of your daily workflow. It’s exactly the kind of thing I’d want nearby when building with Claude.

Reference: GitHub - kerlenton/mcpsnoop: Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal.

同じ著者の記事