Show HN: Mcpsnoop – Wireshark for MCP (transparent proxy and live TUI)

7/4/2026 at 5:28:23 PM

"MCP Inspector [...] never sees the traffic between your client and your server." This line resonates a lot, what you're building makes sense to me! I had built something similar to track these interactions and turn them into a benchmark, I'm gonna try this out.

by rstagi

7/4/2026 at 3:55:38 PM

Makes sense. Payload secrets are probably the scarier part anyway. Would a simple redact config make sense, like keys/patterns to scrub before writing traces?

by geraldsterling

7/3/2026 at 8:10:46 PM

I feel most of the comments here are from bots

by cidd

7/4/2026 at 3:52:50 PM

It's getting bad. Definitely a hole that needs to be filled...

by geraldsterling

7/3/2026 at 8:13:05 PM

Maybe, but I didn't do it. Perhaps people are boosting their karma?

by kerlenton

7/3/2026 at 8:02:13 PM

Great. I dream to see MCP of MCP, discovery, installation, security and usage should be automatic.

by iamgopal

7/4/2026 at 4:24:09 AM

One question about http mode, you carry authorization headers. Do you redact bearer tokens before captures hit the logs?

by mmakeev

7/4/2026 at 6:36:16 AM

There's nothing redacted because the header isn't collected in the first place. Under http mode, the proxy intercepts the JSON-RPC messages, but not their headers, so there's no way for the log to contain the Authorization header and the bearer passes through unlogged. The contents of the messages themselves aren't redacted, which means if the secret is in the payload, it'll end up in the trace. The trace stays on your machine, and if you don't want anything to go to the disk at all, use --no-trace.

by kerlenton

7/4/2026 at 6:38:48 AM

thanks! all clear

by mmakeev

7/3/2026 at 7:56:43 PM

To be fair, it is really simple to build your own proxy. I built a custom authentication layer with logging and limits for Dify MCP with just 2 prompts in Kimi. Later built it out with database limts etc.

by tiku

7/3/2026 at 8:06:14 PM

[dead]

by kerlenton

7/3/2026 at 7:26:50 PM

This is awesome. Your comparison make it easy. This approach makes perfect sense to give 100% visibility into the back and forth.

Is it possible to add a simple browser page to brows the data in a simple way?. Thank you.

by chopete3

7/3/2026 at 7:52:55 PM

Thank you! Showing the data in a web page should definitely be possible. But I’m not sure if this matches the original idea I had, where the tool would run in the terminal only. Why do you feel the need to show the data in a web page? Is there anything missing in the CLI?

by kerlenton

7/3/2026 at 6:02:29 PM

This is awesome, thank you. What's missing now is an MCP for Wireshark.

by atmanactive

7/3/2026 at 6:20:28 PM

Thanks! Actually, there is already an MCP for Wireshark, for example https://github.com/0xKoda/WireMCP

by kerlenton

7/3/2026 at 6:50:12 PM

Bingo! Great find. Thank you.

by atmanactive

7/4/2026 at 11:13:56 AM

You can just get your agent to run tshark :)

by InfraScaler

7/3/2026 at 7:48:12 PM

Its really a great tool. The gap of visualization of calling the AI client is covered by your product!!

by yr_animesh

7/3/2026 at 7:56:39 PM

Thanks a lot!

by kerlenton

7/3/2026 at 8:13:03 PM

Remote debugging and post-mortem debugging support might be useful.

There are many AI auditability proxies;

awesome-auditable-ai: "A curated list of papers, tools, datasets, benchmarks, and standards for building, evaluating, and auditing reliable AI agents" https://github.com/yzhao062/awesome-auditable-ai

Aegis and LiteLLM, for example, are pre-execution firewalls that add a cryptographic audit trail. https://github.com/Justin0504/aegis

by westurner

7/3/2026 at 8:26:58 PM

[dead]

by kerlenton

7/3/2026 at 4:55:00 PM

[flagged]

by kerlenton

7/4/2026 at 1:34:20 AM

[flagged]

by jing09928

7/3/2026 at 9:30:14 PM

[flagged]

by tomkow

7/3/2026 at 9:32:44 PM

Coward

by dialsMavis