mcp-snoop
Transparent stdio interceptor for MCP JSON-RPC traffic.
Like strace, but for the Model Context Protocol. Wrap any MCP server and see every message in real time — tool calls, responses, errors. Zero dependencies.
$ mcp-snoop -- python3 my_server.py
mcp-snoop intercepting: python3 my_server.py
[03:14:22.847] →SERVER #1 initialize claude-desktop v1.0
[03:14:22.912] ←CLIENT #1 → server: my-server v0.1.0
[03:14:22.913] →SERVER notifications/initialized
[03:14:22.914] →SERVER #2 list tools
[03:14:22.916] ←CLIENT #2 → 8 tools
[03:14:23.201] →SERVER #3 call search_files(path="/tmp", pattern="*.py")
[03:14:23.847] ←CLIENT #3 → text: "['server.py', 'handler.py']"
mcp-snoop: 7 messages intercepted
Install
pip install mcp-snoop
Or run without installing:
uvx mcp-snoop -- python3 my_server.py
Usage
# Basic — logs all messages to stderr
mcp-snoop -- python3 my_server.py
# Verbose — print full JSON for each message
mcp-snoop --verbose -- node server.js
# Save trace to file
mcp-snoop --output trace.log -- uvx my-mcp-server
# No color (for CI/log files)
mcp-snoop --no-color -- python3 server.py
What you see
Each log line shows:
- timestamp —
HH:MM:SS.mmmUTC - direction —
→SERVER(client→server) or←CLIENT(server→client) - message ID —
#1,#2, etc. (pairs requests with responses) - summary — parsed tool name, arguments, result preview
With --verbose, the full JSON follows.
Why
You're building an MCP server. Your agent keeps calling the wrong tool. Something's returning garbage. The MCP Inspector requires a browser. You want to script against the logs.
mcp-snoop gives you the raw protocol traffic, right in your terminal.
Use in Claude Desktop / cline / any MCP client
Replace your server command with mcp-snoop -- <your command>:
{
"mcpServers": {
"my-server": {
"command": "mcp-snoop",
"args": ["--output", "/tmp/trace.log", "--", "python3", "my_server.py"]
}
}
}
All traffic between the client and your server is now logged to /tmp/trace.log.
Relationship to other tools
| Tool | What it does |
|---|---|
| agent-friend | Grades MCP schema quality (A+ to F) |
| mcp-patch | AST security scanner for MCP servers |
| mcp-pytest | pytest integration for testing MCP servers |
| mcp-snoop | Stdio interceptor — debug live protocol traffic |
License
MIT
Metadata
Release files for mcp-snoop 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| mcp_snoop-0.1.0.tar.gz | 5.3 kB | Without provenance | Details for mcp_snoop-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| mcp_snoop-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for mcp_snoop-0.1.0-py3-none-any.whl |
Total release size: 11.9 kB
Release files / mcp_snoop-0.1.0.tar.gz
| Download URL | mcp_snoop-0.1.0.tar.gz |
|---|---|
| Size | 5.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e841c74f261425262980802e58bc539e342a1dcbde05e25756ac683ca18a5849
|
|
BLAKE2b-256 checksum How to use checksums |
b535d538bbab5617826cffa8d6317101ae9f0d586f6cb84bcc1ce9fe5eae75c3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.12
|
Release files / mcp_snoop-0.1.0-py3-none-any.whl
| Download URL | mcp_snoop-0.1.0-py3-none-any.whl |
|---|---|
| Size | 6.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ccb12f19fc8cd9323272ee53a99ac9ecd082534c91a06ec96bb2bccbc7520823
|
|
BLAKE2b-256 checksum How to use checksums |
838815256dcaf96c73e96ae42b36278549babb22201702a2a5b2389521eac951
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.12
|
Security for mcp-snoop 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.