How to Capture and Inspect MCP Traffic from Cursor and Windsurf

What is MCP Traffic Capture?

MCP (Model Context Protocol) traffic consists of all HTTP requests and responses between your IDE and MCP servers. When you use tools, prompts, or resources in your IDE, these interactions happen over HTTP. MCP Shark aggregates multiple MCP servers and provides a monitoring interface, capturing and logging all these communications so you can inspect them in real-time.

This is essential for debugging MCP integrations, understanding how your IDE communicates with servers, and detecting potential issues or security concerns.

Prerequisites

• MCP Shark installed on your system
• One of the following IDEs: Cursor or Windsurf
• At least one MCP server configured in your IDE

Step 1: Start MCP Shark

1. Install dependencies: npm run install:all

2. Start the UI: make start or npm start

3. Open your browser and navigate to http://localhost:9853

4. On first launch, you'll see an interactive tour - follow it to get started

Step 2: Configure MCP Shark

MCP Shark automatically detects your IDE's MCP configuration files:

• Cursor: Automatically detects ~/.cursor/mcp.json
• Windsurf: Automatically detects ~/.codeium/windsurf/mcp_config.json

1. Go to the "MCP Server Setup" tab in the UI

2. MCP Shark will show detected configuration files

3. Select your IDE from the detected list (or upload your own config file)

4. Choose which servers to enable (optional - you can enable/disable specific servers)

5. Click "Start MCP Shark" to begin

MCP Shark will automatically create a backup of your original configuration, convert your IDE's config format to MCP Shark format, and update your IDE config to point to MCP Shark server at http://localhost:9851/mcp. No manual configuration editing required!

Step 3: View Captured Traffic

Once MCP Shark is running and your IDE is configured, switch to the "Traffic Capture" tab in MCP Shark. You'll see all HTTP requests and responses in real-time as your IDE communicates with MCP servers.

Use the search and filter capabilities to:

• Filter by JSON-RPC method (e.g., tools/list, tools/call)
• Search by session ID to track specific conversations
• Filter by server name to see traffic for a specific MCP server
• View detailed request/response headers and bodies

Step 4: Inspect MCP HTTP Calls

Click on any request in the traffic capture view to see detailed information:

• Request Headers: See all HTTP headers sent from your IDE
• Request Body: View the complete JSON-RPC payload, including method names and parameters
• Response Headers: Inspect response headers from MCP servers
• Response Body: See the complete response, including tool results, resource data, or prompt responses

This detailed inspection helps you understand exactly what data is being exchanged between your IDE and MCP servers, making it easier to debug issues or optimize performance.

Advanced: Export and Analysis

MCP Shark allows you to export captured traffic in multiple formats:

• JSON: For programmatic analysis or integration with other tools
• CSV: For spreadsheet analysis and reporting
• TXT: For human-readable logs and documentation

Export your traffic data to analyze patterns, create reports, or share with your team for debugging purposes.

Next Steps

Now that you know how to capture and inspect MCP traffic, explore these related guides:

• Detecting Malicious MCP Servers - Learn how to identify suspicious behavior
• Building a Secure MCP Setup - Best practices for MCP observability
• How to Use MCP Shark - Complete feature guide