cd /news/developer-tools/record-and-replay-one-mcp-tool-call-… · home topics developer-tools article
[ARTICLE · art-60397] src=dev.to ↗ pub= topic=developer-tools verified=true sentiment=· neutral

Record and Replay One MCP Tool Call Without Keeping Its Secrets

A developer describes a technique for recording and replaying MCP tool calls without exposing secrets. The method normalizes dynamic fields like request IDs and timestamps, producing small, deterministic fixtures that verify protocol contracts without repeating external actions.

read1 min views1 publishedJul 15, 2026

Capturing an MCP exchange is easy. Creating a fixture you can safely commit and reliably replay is the actual task.

A raw traffic dump contains dynamic request IDs, timestamps, paths, and possibly credentials. A useful fixture preserves protocol shape while removing values that should never become test data.

Start with one tools/call

request:

{
  "jsonrpc": "2.0",
  "id": "<REQUEST_ID>",
  "method": "tools/call",
  "params": {
    "name": "lookup_issue",
    "arguments": { "owner": "demo", "repo": "sample", "number": 42 }
  }
}

Store the expected response beside it, but replace the response ID with the same placeholder.

A recorder should:

The final JSONL can be tiny:

{"direction":"client->server","message":{"jsonrpc":"2.0","id":"<REQUEST_ID>","method":"tools/call","params":{"name":"lookup_issue","arguments":{"owner":"demo","repo":"sample","number":42}}}}
{"direction":"server->client","message":{"jsonrpc":"2.0","id":"<REQUEST_ID>","result":{"content":[{"type":"text","text":"Issue 42: example"}]}}}

Do not replay the original network connection. Feed the normalized client message into the server transport used by tests, capture its reply, normalize that reply, and compare structures.

Fail separately on:

For tools that write data, use a fake implementation or disposable account. A replay suite must not repeat yesterday's external action.

I used to reach for a full transcript recorder. That immediately created questions about every dynamic field. One representative call gives you the canonicalization rules first. Add fixtures only when they cover a new protocol behavior.

The fixture is not proof that the tool result is factually correct. It verifies the contract between client, transport, and server. Keep domain assertions in a separate test so a protocol update does not erase the business expectation.

A good replay file is boring: small, redacted, deterministic, and useful when the SDK or server changes. If it contains enough context to impersonate a user, it is not a fixture—it is an incident waiting for a commit.

── more in #developer-tools 4 stories · sorted by recency
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/record-and-replay-on…] indexed:0 read:1min 2026-07-15 ·