MCP Shark is a Wireshark-like forensic analysis tool for Model Context Protocol (MCP) communications. It captures, inspects, and investigates all HTTP traffic between your IDE and MCP servers.

How does MCP Shark work?

MCP Shark acts as an intermediary gateway between your IDE and MCP servers. It captures all HTTP requests and responses, logs them to SQLite, and provides a real-time web interface for monitoring and analysis.

What is the MCP Playground?

The MCP Playground is a feature in MCP Shark where you can run commands and see results. You can call tools, test prompts, and read resources from your connected MCP servers.

Which IDEs are supported?

MCP Shark works with any IDE that supports the Model Context Protocol, including Cursor, Windsurf, Claude Code, and any other MCP-compatible development environment. As long as your IDE can connect to MCP servers via HTTP or stdio, MCP Shark can capture and analyze the traffic.

Model Context Protocol Deep Dive: How MCP Tools, Resources and Prompts Talk to Your IDE

What is Model Context Protocol?

Model Context Protocol (MCP) is a standardized communication protocol that enables AI assistants and development tools to interact with external data sources and services. It provides a structured way for IDEs like Cursor, Windsurf, and other MCP-compatible IDEs to:

Access tools that can perform actions (file operations, API calls, etc.)
Read resources that provide data (databases, APIs, file systems)
Use prompts that guide AI behavior and provide context

MCP servers implement these capabilities, and MCP clients (your IDE) communicate with servers over HTTP or stdio to access their functionality.

The MCP Architecture

MCP Clients (Your IDE)

Your IDE acts as an MCP client, making requests to MCP servers. When you use AI features in your IDE:

The IDE identifies what tools, resources, or prompts it needs
It sends HTTP requests (or stdio messages) to the appropriate MCP server
It receives responses and integrates them into your workflow

Popular MCP clients include Cursor, Windsurf, and other MCP-compatible IDEs.

MCP Servers

MCP servers provide specific capabilities:

They register available tools, resources, and prompts
They handle requests from clients
They execute operations and return results
They can be local (stdio) or remote (HTTP)

Examples include file system servers, database servers, API integration servers, and custom development tools.

MCP Shark: The Observability Layer

MCP Shark sits between clients and servers, acting as a transparent proxy that:

Intercepts all HTTP communication
Logs requests and responses
Provides real-time monitoring
Enables forensic analysis

This gives you complete visibility into how MCP works in practice.

MCP Tools: Executing Actions

What Are Tools?

Tools are functions that MCP servers can execute. They represent actions that can be performed, such as:

Reading or writing files
Making API calls
Executing shell commands
Querying databases
Performing calculations or transformations

How Tools Work

The tool lifecycle:

Discovery: Client calls tools/list to get available tools
Registration: Server returns tool definitions with names, descriptions, and parameters
Invocation: Client calls tools/call with tool name and arguments
Execution: Server executes the tool and returns results
Response: Client receives the result and integrates it

MCP Shark captures all these interactions, showing you exactly what tools are called, with what parameters, and what they return.

Example: File Reading Tool

When your IDE needs to read a file:

IDE calls tools/call with tool name "read_file" and path parameter
MCP server receives the request and reads the file
Server returns file contents in the response
IDE displays the file content to you

MCP Shark shows you the complete request/response cycle, including headers, parameters, and file contents.

MCP Resources: Accessing Data

What Are Resources?

Resources are data sources that MCP servers can provide. They represent information that can be accessed, such as:

Database records
API endpoints
File system contents
Configuration data
External service data

How Resources Work

Resource access flow:

Discovery: Client calls resources/list to get available resources
Listing: Server returns resource URIs and metadata
Access: Client calls resources/read with resource URI
Retrieval: Server fetches and returns resource data
Usage: Client uses the data in AI context or displays it

Example: Database Resource

When your IDE needs database information:

IDE calls resources/list to see available database tables
Server returns list of resource URIs like "db://users", "db://products"
IDE calls resources/read with "db://users" URI
Server queries database and returns user data
IDE includes this data in AI context for better responses

MCP Prompts: Guiding AI Behavior

What Are Prompts?

Prompts are templates or instructions that guide how AI assistants interact with MCP servers. They provide:

Context about available tools and resources
Guidelines for when to use specific capabilities
Examples of proper usage
Best practices and constraints

How Prompts Work

Prompt integration:

Discovery: Client calls prompts/list to get available prompts
Retrieval: Server returns prompt templates with variables
Integration: Client includes prompts in AI context
Usage: AI uses prompts to guide tool and resource usage

Example: Code Review Prompt

A code review MCP server might provide a prompt like:

"When reviewing code, use the read_file tool to examine 
relevant files, then provide structured feedback on 
code quality, security, and best practices."

This prompt guides the AI to use specific tools in a structured way for code reviews.

Communication Protocol: JSON-RPC over HTTP

MCP uses JSON-RPC 2.0 over HTTP for communication. This means:

All requests are HTTP POST requests
Request bodies contain JSON-RPC method calls
Responses are JSON-RPC responses
Each request has a unique ID for correlation

Example JSON-RPC request:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "read_file",
    "arguments": {
      "path": "/path/to/file.txt"
    }
  }
}

MCP Shark captures these JSON-RPC messages, making it easy to understand the exact protocol being used.

How MCP Shark Helps You Understand MCP

MCP Shark provides complete visibility into MCP communication:

See the Protocol: View exact JSON-RPC messages being exchanged
Understand Flow: Track how tools, resources, and prompts are discovered and used
Debug Issues: Identify where communication breaks down
Learn Patterns: Understand how different MCP servers work
Optimize Performance: Identify bottlenecks and inefficiencies

By capturing all HTTP traffic, MCP Shark gives you a complete picture of MCP in action.

Real-World Example: Complete MCP Session

Here's what happens when you use an MCP server in your IDE:

IDE connects to MCP server via MCP Shark proxy
IDE calls tools/list - MCP Shark captures request/response
IDE calls resources/list - MCP Shark captures request/response
IDE calls prompts/list - MCP Shark captures request/response
You use AI feature that needs a tool
IDE calls tools/call - MCP Shark captures request/response
Tool executes and returns result
IDE integrates result into your workflow

MCP Shark shows you every step of this process, making MCP transparent and understandable.

Next Steps

Continue learning about MCP:

How to Capture and Inspect MCP Traffic - Practical setup guide
MCP Playground Guide - Test MCP servers safely
MCP Shark Architecture - See how it works