# mcpsnoop

A transparent proxy, described as Wireshark for MCP, that sits in the real traffic path between an AI client and its MCP servers and shows every JSON-RPC tool call live in the terminal.

mcpsnoop wraps the command that normally launches an MCP server, so it observes the real client (Cursor, Claude Code, Codex) talking to the real server rather than connecting as its own separate client the way the official MCP Inspector does. This lets it show calls the model never made, calls made with the wrong arguments, or silent mismatches that are otherwise only visible by guessing from logs.

On Claude Desktop it can rewrite a server's config entry in place to route through the proxy, with wrap and unwrap commands and an automatic backup. It also ships as a GitHub Action that checks a captured session, files findings as code-scanning alerts, and fails CI on whatever was gated.

Website: https://github.com/kerlenton/mcpsnoop