miatz™
Log inSit Chuun
Free concept playground · no account

MCP Playground

Wiretap the protocol traffic between your agent and its tools.

All 90 playgrounds Join the free cohort

MCP Playground

AvailableFree

MCP is “just JSON-RPC” in theory but invisible in practice. This wire-tap makes every initialize, tools/list, and tools/call a literal, readable line of protocol traffic. Click any line to inspect it, then read the permission-scope diff below.

8messages4round-trips4agent → tool4tool → agent278tokens
The raw wire, not the agent’s summarythe view a security reviewer uses

Click a line in the log to read it raw. Nothing is summarised away — you see exactly what crossed the wire, the same view a reviewer uses to audit a server’s real behaviour.

Permission-scope diff — what the server claimed vs. what the traffic did:

  • ✓m2 · Server advertises itself as read-only (files-ro).
  • ✗m4 · But its manifest exposes write_file — wider than the claim.
  • ✗m7 · The agent actually calls write_file — the overreach in action.
  • ✓m8 · The server denies the write — least-privilege held this time.

A “read-only” label is a promise; the wire is the proof. Least-privilege is what you can see a server obey, line by line.

Was this playground useful?

MCP Playground

The Model Context Protocol is how an agent talks to its tools — and in theory it is "just JSON-RPC." In practice that traffic is invisible: you see the agent's tidy summary, never the raw wire. This playground puts a wire-tap on a seeded MCP session so every initialize, tools/list, and tools/call becomes a literal, readable line of protocol traffic. Click any line to inspect it, then read the permission-scope diff — the red/green view a security reviewer actually uses to catch a "read-only" server that quietly exposes a write. Runs entirely in your browser (0 uploads, works offline).

How to use it

  1. Read the log top to bottom — eight ordered messages between the agent and a server called files-ro, with direction (agent → tool or tool → agent), method, a one-line payload summary, and a token cost.
  2. Click any line to open it raw in the X-ray panel — the exact bytes-worth that crossed the wire, not the agent's paraphrase.
  3. Hit Jump to the overreach to land on the write_file call the server should never have offered.
  4. Read the permission-scope diff: what the manifest claimed (read-only) against what the traffic did (offered and attempted a write).
  5. Copy or download the full transcript — the raw protocol log is the exact artifact a reviewer pastes into a least-privilege ticket.

What this clears up (the fundamentals)

  • MCP is just JSON-RPC — initialize to shake hands, tools/list to discover, tools/call to invoke, each a request/response pair. Once you can read the wire, the "magic" disappears.
  • Every call is a round-trip — one message out, one back. Counting the tool → agent responses tells you how many complete exchanges (and how many tokens) a single task really cost.
  • The manifest is a claim, not a guarantee — a server can advertise itself as read-only and still list a write_file tool. Least-privilege is what you can see it obey, line by line, not what its label says.
  • The wire beats the summary — an agent's natural-language recap hides overreach; the raw log surfaces it in red before it becomes a habit.

Where it's used

This is a miatz build-lab concept playable — play the wire-tap here, then learn to build the protocol-log viewer and the permission-scope diff yourself. It is the in-module lab for AIE-303 (feeds the Integrator badge) and is reused inside the Red-Team Dojo as the MCP-specific attack surface, where reading raw tool traffic is the core skill.

FAQ

What is the Model Context Protocol (MCP)?

An open standard for connecting an AI agent to external tools and data sources over JSON-RPC. The agent calls initialize to negotiate capabilities, tools/list to discover what a server exposes, and tools/call to run one — the same three methods you see in this log.

What am I looking at in the wire-tap?

The raw request/response traffic of one seeded session, in order. Each line shows its direction, JSON-RPC method, a readable payload summary, and its token cost — the view you would get by logging the protocol itself instead of trusting the agent's recap.

How does it catch an over-scoped server?

The permission-scope diff compares the server's claim against its behaviour. files-ro advertises read-only, yet its manifest lists write_file and the agent even attempts it — both flagged in red — while the server's denial shows least-privilege holding. That claim-vs-traffic gap is the whole point.

Is this talking to a real MCP server?

No. This is a seeded, scripted session baked into the engine — a fixed teaching example, deterministic and fully offline. Connecting to real MCP servers with your own key is a separate mode.

Is anything uploaded?

No. The session is hand-authored and inspected entirely in your browser — nothing is transmitted, stored, or logged. Turn off your Wi-Fi and it still works.

Limits

This is a seeded demo: the eight-message session is a fixed, hand-authored example chosen to teach the protocol and the over-scope pattern — it is not a live capture and does not talk to any server. Live, bring-your-own-key inference against real MCP servers (with a cost meter and an eval gate) is a separate mode; here the goal is to make the wire readable, not to run your traffic. The scope diff shown is the same reasoning you would apply to a real manifest.

Related

Part of the Demystify Playgrounds — the AI-engineering dojo. Explore the rest, including the sibling agent-safety playables, from the Playgrounds home.

Bookmark this page (Ctrl+D, or ⌘D on Mac) — it works offline the next time you need it.

More playgrounds

Ninety playgrounds. Zero setup.

Every concept here is playable free, no account — and inside the program you learn to rebuild the machinery yourself.

Browse all playgrounds Join free