{"slug": "record-and-replay-one-mcp-tool-call-without-keeping-its-secrets", "title": "Record and Replay One MCP Tool Call Without Keeping Its Secrets", "summary": "A developer describes a technique for recording and replaying MCP tool calls without exposing secrets. The method normalizes dynamic fields like request IDs and timestamps, producing small, deterministic fixtures that verify protocol contracts without repeating external actions.", "body_md": "Capturing an MCP exchange is easy. Creating a fixture you can safely commit and reliably replay is the actual task.\n\nA raw traffic dump contains dynamic request IDs, timestamps, paths, and possibly credentials. A useful fixture preserves protocol shape while removing values that should never become test data.\n\nStart with one `tools/call`\n\nrequest:\n\n```\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": \"<REQUEST_ID>\",\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"lookup_issue\",\n    \"arguments\": { \"owner\": \"demo\", \"repo\": \"sample\", \"number\": 42 }\n  }\n}\n```\n\nStore the expected response beside it, but replace the response ID with the same placeholder.\n\nA recorder should:\n\nThe final JSONL can be tiny:\n\n``` php\n{\"direction\":\"client->server\",\"message\":{\"jsonrpc\":\"2.0\",\"id\":\"<REQUEST_ID>\",\"method\":\"tools/call\",\"params\":{\"name\":\"lookup_issue\",\"arguments\":{\"owner\":\"demo\",\"repo\":\"sample\",\"number\":42}}}}\n{\"direction\":\"server->client\",\"message\":{\"jsonrpc\":\"2.0\",\"id\":\"<REQUEST_ID>\",\"result\":{\"content\":[{\"type\":\"text\",\"text\":\"Issue 42: example\"}]}}}\n```\n\nDo not replay the original network connection. Feed the normalized client message into the server transport used by tests, capture its reply, normalize that reply, and compare structures.\n\nFail separately on:\n\nFor tools that write data, use a fake implementation or disposable account. A replay suite must not repeat yesterday's external action.\n\nI used to reach for a full transcript recorder. That immediately created questions about every dynamic field. One representative call gives you the canonicalization rules first. Add fixtures only when they cover a new protocol behavior.\n\nThe fixture is not proof that the tool result is factually correct. It verifies the contract between client, transport, and server. Keep domain assertions in a separate test so a protocol update does not erase the business expectation.\n\nA good replay file is boring: small, redacted, deterministic, and useful when the SDK or server changes. If it contains enough context to impersonate a user, it is not a fixture—it is an incident waiting for a commit.", "url": "https://wpnews.pro/news/record-and-replay-one-mcp-tool-call-without-keeping-its-secrets", "canonical_source": "https://dev.to/rivera123/record-and-replay-one-mcp-tool-call-without-keeping-its-secrets-52mp", "published_at": "2026-07-15 11:22:05+00:00", "updated_at": "2026-07-15 11:30:44.391268+00:00", "lang": "en", "topics": ["developer-tools"], "entities": [], "alternates": {"html": "https://wpnews.pro/news/record-and-replay-one-mcp-tool-call-without-keeping-its-secrets", "markdown": "https://wpnews.pro/news/record-and-replay-one-mcp-tool-call-without-keeping-its-secrets.md", "text": "https://wpnews.pro/news/record-and-replay-one-mcp-tool-call-without-keeping-its-secrets.txt", "jsonld": "https://wpnews.pro/news/record-and-replay-one-mcp-tool-call-without-keeping-its-secrets.jsonld"}}