MCPRadar is the only tool that combines MCP debugging AND security scanning in one place. Inspect tool calls, replay requests, trace SSE streams — and automatically scan every server for prompt injection, path traversal, and command injection risks before they reach production.
{
"method": "tools/call",
"params": {
"name": "create_ticket",
"arguments": {
"title": "Fix SSE transport bug",
"priority": "high"
}
}
}Automatically scans every server you connect to. Detects prompt injection, permissive file paths, command injection risks, sensitive data exposure, and performance issues. Get a security grade (A-F) in seconds.
13 checksSee every MCP tool invocation in real time — request body, response, latency, token counts.
real-timeConnect via Streamable HTTP, SSE, or direct browser fallback. Works with local and remote servers.
HTTP · SSE · BrowserReplay any captured tool call with one click. Edit params, re-send, diff outputs.
replay · diffStore and inject Bearer tokens, API keys, or custom headers per connection profile.
local storageValidates MCP protocol compliance on connect. Surfaces capability mismatches immediately.
MCP 2024-11-05Save and switch between server configs. Claude Desktop, Cline, remote agents — one place.
✓ availableEvery MCP server you connect to is automatically scanned for security vulnerabilities. MCPRadar checks for the same attack vectors documented in real-world MCP breaches — prompt injection, path traversal, command execution risks, and more.
Scans tool descriptions for hidden instructions that could hijack your AI agent's behavior.
Flags tools that accept unrestricted file paths or execute commands without input validation.
Identifies tools that will timeout during agent runs before they cause silent failures in production.
Paste your MCP server URL — Streamable HTTP and SSE transport supported. Handshake and capability discovery happen automatically.
Your tool registry loads instantly. Fill params via form or raw JSON, then fire.
Every wire message captured — frames, timing, errors, full payloads.
Edit params, replay calls, compare diffs. Catch bugs before they break agents in production.
Most modern MCP servers built after early 2025. Try this first.
Servers built before 2025 or older community servers. Use this if Streamable HTTP fails.
Run this command to start a test server:
npx @modelcontextprotocol/server-everything streamableHttphttp://localhost:3001/mcpPaste your MCP server URL into the input field
Select transport — Streamable HTTP for modern servers, SSE for older ones
Click Connect — MCPRadar runs the handshake and discovers all tools, resources, and prompts automatically
Browse the Tools tab — click any tool to expand its input form
Fill in the arguments and click Send
See the full response on the right — formatted JSON, errors highlighted
Check History at the bottom right to revisit previous calls
Also supports Resources and Prompts tabs — browse everything your MCP server exposes, not just tools.
Go to the Debug tab
Click Start Session — MCPRadar generates a unique proxy URL
Copy the proxy URL
In your AI agent or MCP client, replace your MCP server URL with the MCPRadar proxy URL
Run your agent as normal
Watch every tool call appear in the waterfall in real time
Click any step to inspect the full request and response payload
{
"method": "tools/list"
}If it speaks MCP, MCPRadar connects to it. Any server that implements the spec — official SDK, community package, or hand-rolled — works out of the box.
npx @modelcontextprotocol/create-server my-serverMCP Inspector is a great protocol explorer for a quick sanity check. But it has no security scanning, no replay, and no history. MCPRadar gives you the full picture — debugging and security in one tool.
| Capability | MCPRadar | MCP Inspector |
|---|---|---|
| Security scanningkey differentiator | ✓ 13 automated checks, A-F grade | ✗ No security analysis |
| Prompt injection detection | ✓ Scans all tool descriptions | ✗ Not available |
| Performance analysis | ✓ Latency warnings + timeout risk | ✗ Not available |
| Security report | ✓ Exportable with findings + fixes | ✗ Not available |
| Request replay | ✓ Replay any call, edit params, re-send | ✗ No replay — fire once and re-type |
| Connection profiles | ✓ Named profiles with saved auth + URL | ✗ Single connection, no saved state |
| Auth header management | ✓ Bearer tokens, API keys per profile | ~ Manual headers only, not persisted |
| Transport support | ✓ HTTP · SSE · browser fallback | ~ SSE only, browser requires local process |
| Install required | ✓ Open in browser — nothing to install | ✗ npx @modelcontextprotocol/inspector |
| Full wire trace | ✓ Every frame, timing, protocol errors | ~ Request/response only, no frame-level view |
| Response diffing | ✓ Diff two call outputs side by side | ✗ Not available |
| Handshake validation | ✓ Flags non-compliant capability responses | ~ Connects but won't surface protocol issues |
| Remote server testing | ✓ Works with any reachable URL | ~ Primarily designed for localhost |
| Built for iteration | ✓ Designed for the debug → fix → re-test loop | ✗ Built to explore, not iterate |
MCPRadar is in active development. Drop your email to get notified on new features, vote on the roadmap, and help shape what gets built next.