mcp-wiretap

See everything your AI agents do through MCP. One command. Zero config.

Quick Start

npx mcp-wiretap -- npx -y @modelcontextprotocol/server-filesystem ~/Code

That's it. Every MCP tool call is now logged to SQLite and displayed in your terminal.

Why

MCP servers can read files, query databases, and execute code on your behalf. But you can't see what they're actually doing.

mcp-wiretap wraps any MCP server and records every tool call — what was requested, what was returned, and how long it took. No SDK integration. No platform to adopt. Just wrap and watch.

Use with Claude Desktop

Replace your existing MCP server config:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y", "mcp-wiretap", "--",
        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/me/Code"
      ]
    }
  }
}

Now every tool call Claude Desktop makes through this server is logged.

Use with Cursor

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y", "mcp-wiretap", "--",
        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/me/Code"
      ]
    }
  }
}

Use with Claude Code

claude mcp add filesystem -- npx -y mcp-wiretap -- npx -y @modelcontextprotocol/server-filesystem ~/Code

Terminal Output

14:23:01.442 ──▶ initialize
14:23:01.458 ◀── initialize                           16ms
14:23:01.460 ──▶ tools/list
14:23:01.463 ◀── tools/list              (12 tools)    3ms
14:23:05.891 ──▶ tools/call   read_file  {"path":"/Users/me/Code/README.md"}
14:23:05.903 ◀── tools/call   read_file  (2,847 bytes) 12ms

Use --verbose to see full payloads.

Export & Search

# Export current session to JSON
npx mcp-wiretap export --format json --output audit.json

# Export all sessions to CSV
npx mcp-wiretap export --format csv --all --output audit.csv

# List all recorded sessions
npx mcp-wiretap sessions

# Replay a specific session
npx mcp-wiretap replay <session-id>

# Search across all sessions
npx mcp-wiretap search "read_file"

How It Works

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  MCP Client  │────▶│  mcp-wiretap │────▶│  MCP Server  │
│ (Claude, etc)│◀────│  (proxy)     │◀────│  (any)       │
└──────────────┘     └──────┬───────┘     └──────────────┘
                            │
                     ┌──────▼───────┐
                     │   SQLite DB  │
                     │   + Terminal │
                     │     Output   │
                     └──────────────┘

mcp-wiretap spawns your MCP server as a child process, intercepts all JSON-RPC messages on stdin/stdout, logs them to SQLite with timestamps and latency, and forwards everything unmodified. Neither the client nor the server knows it's there.

All display output goes to stderr. stdout is reserved exclusively for the MCP protocol.

Options

Flag	Description	Default
--db <path>	SQLite database location	~/.mcp-wiretap/wiretap.db
--quiet	Suppress terminal output, log only	false
--verbose	Show full payloads in terminal	false
--filter <method>	Only display specific methods	all
--max-payload <bytes>	Truncate payloads in display	unlimited
--no-color	Disable color output	false

Comparison

Tool	Type	Setup	Cost
mcp-wiretap	Passive CLI monitor	One command	Free
MCP Inspector	Interactive debugger	Manual testing	Free
Datadog MCP	Enterprise SaaS	SDK + account	$$$
Gateways (Composio, etc.)	Platform	Architecture change	Varies

SQLite Schema

Events are stored at ~/.mcp-wiretap/wiretap.db. You can query them directly:

SELECT timestamp, direction, method, tool_name, latency_ms
FROM events
WHERE session_id = 'your-session-id'
ORDER BY timestamp;

Contributing

See CONTRIBUTING.md.

License

MIT