mcp-wiretap

See everything your AI agents do through MCP. One command. Zero config.

Quick Start

npx mcp-wiretap -- npx -y @modelcontextprotocol/server-filesystem ~/Code

That's it. Every MCP tool call is now logged to SQLite and displayed in your terminal.

Why

MCP servers can read files, query databases, and execute code on your behalf. But you can't see what they're actually doing.

mcp-wiretap wraps any MCP server and records every tool call — what was requested, what was returned, and how long it took. No SDK integration. No platform to adopt. Just wrap and watch.

Use with Claude Desktop

Replace your existing MCP server config:

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y", "mcp-wiretap", "--",
        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/me/Code"
      ]
    }
  }
}

Now every tool call Claude Desktop makes through this server is logged.

Use with Cursor

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y", "mcp-wiretap", "--",
        "npx", "-y", "@modelcontextprotocol/server-filesystem", "/Users/me/Code"
      ]
    }
  }
}

Use with Claude Code

claude mcp add filesystem -- npx -y mcp-wiretap -- npx -y @modelcontextprotocol/server-filesystem ~/Code

Terminal Output

14:23:01.442 ──▶ initialize
14:23:01.458 ◀── initialize                           16ms
14:23:01.460 ──▶ tools/list
14:23:01.463 ◀── tools/list              (12 tools)    3ms
14:23:05.891 ──▶ tools/call   read_file  {"path":"/Users/me/Code/README.md"}
14:23:05.903 ◀── tools/call   read_file  (2,847 bytes) 12ms

Use --verbose to see full payloads.

Export & Search

# Export current session to JSON
npx mcp-wiretap export --format json --output audit.json

# Export all sessions to CSV
npx mcp-wiretap export --format csv --all --output audit.csv

# List all recorded sessions
npx mcp-wiretap sessions

# Replay a specific session
npx mcp-wiretap replay <session-id>

# Search across all sessions
npx mcp-wiretap search "read_file"

How It Works

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  MCP Client  │────▶│  mcp-wiretap │────▶│  MCP Server  │
│ (Claude, etc)│◀────│  (proxy)     │◀────│  (any)       │
└──────────────┘     └──────┬───────┘     └──────────────┘
                            │
                     ┌──────▼───────┐
                     │   SQLite DB  │
                     │   + Terminal │
                     │     Output   │
                     └──────────────┘

mcp-wiretap spawns your MCP server as a child process, intercepts all JSON-RPC messages on stdin/stdout, logs them to SQLite with timestamps and latency, and forwards everything unmodified. Neither the client nor the server knows it's there.

All display output goes to stderr. stdout is reserved exclusively for the MCP protocol.

Options

| Flag | Description | Default | |------|-------------|---------| | --db <path> | SQLite database location | ~/.mcp-wiretap/wiretap.db | | --quiet | Suppress terminal output, log only | false | | --verbose | Show full payloads in terminal | false | | --filter <method> | Only display specific methods | all | | --max-payload <bytes> | Truncate payloads in display | unlimited | | --no-color | Disable color output | false |

Comparison

| Tool | Type | Setup | Cost | |------|------|-------|------| | mcp-wiretap | Passive CLI monitor | One command | Free | | MCP Inspector | Interactive debugger | Manual testing | Free | | Datadog MCP | Enterprise SaaS | SDK + account | $$$ | | Gateways (Composio, etc.) | Platform | Architecture change | Varies |

SQLite Schema

Events are stored at ~/.mcp-wiretap/wiretap.db. You can query them directly:

SELECT timestamp, direction, method, tool_name, latency_ms
FROM events
WHERE session_id = 'your-session-id'
ORDER BY timestamp;

Contributing

See CONTRIBUTING.md.

License

MIT