Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SpyNet mock GET /api/users to return a list of 3 test users for session-1"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Session-based mock server for client application development with AI integration.
REST API Mocking with sequential response support
WebSocket Support for both mock data and app control
Session Isolation for concurrent testing
MCP Integration for AI-driven development with Claude Desktop
Related MCP server: api-mock-generator
# Install dependencies
npm install
# Start server
npm run dev
# Server runs on http://localhost:8675 (default)
# Or configure with PORT=8080 npm run devcurl -X POST http://localhost:8675/_mock/sessions/test-1/endpoints \
-H "Content-Type: application/json" \
-d '{
"method": "GET",
"path": "/api/users",
"responses": [
{ "status": 200, "body": [{"id": 1, "name": "Test User"}] }
]
}'curl http://localhost:8675/session/test-1/api/users
# Returns: [{"id": 1, "name": "Test User"}]curl -X POST http://localhost:8675/_mock/sessions/test-1/socket/action \
-H "Content-Type: application/json" \
-d '{"action": "logout", "params": {"reason": "timeout"}}'SpyNet can be controlled by AI assistants via the Model Context Protocol (MCP).
Build SpyNet:
npm run buildAdd to Claude Desktop config:
macOS: Edit ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: Edit %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"spynet": {
"command": "node",
"args": ["/absolute/path/to/spynet/dist/mcp.js"]
}
}
}Restart Claude Desktop
Ask Claude to configure your mocks:
"Set up GET /api/users to return 3 test users"
"Configure login to fail first, then succeed"
"Send a WebSocket logout action to session demo"
"Show me the request history for session test-1"
Your app connects to http://localhost:8675 as usual.
configure_endpoint - Set up mock API responses with sequential behavior
list_sessions - View all active sessions
delete_session - Clean up a session
list_endpoints - See configured endpoints and call counts
clear_endpoints - Remove mock configurations
get_request_history - Inspect request logs
send_websocket_action - Trigger app actions via WebSocket
send_websocket_data - Send real-time data via WebSocket
Check if SpyNet is running:
curl http://localhost:8675/_mock/sessionsView MCP server logs: MCP logs go to stderr. Check Claude Desktop's logs or run directly:
node dist/mcp.jsPort already in use:
# Check what's using port 8675
lsof -ti:8675
# Use different port
PORT=9000 node dist/mcp.jsSpyNet can also be used with Claude Code (CLI) via MCP.
Build SpyNet:
npm run buildAdd to Claude Code:
# Add for current user (stored in ~/.claude.json)
claude mcp add --transport stdio spynet -- node /absolute/path/to/spynet/dist/mcp.js
# Or add for your team (creates .mcp.json in project)
cd /path/to/spynet
claude mcp add --transport stdio spynet --scope project -- node ./dist/mcp.jsVerify it's configured:
claude mcp listSame as Claude Desktop - just ask Claude to configure your mocks naturally:
"Set up GET /api/users to return 3 test users"
"Configure login to fail first, then succeed"
"Send a WebSocket logout action to session demo"
The same 8 MCP tools are available. Your app connects to http://localhost:8675 as usual.
See Design Document for complete API documentation.
# Run tests
npm test
# Build
npm run build
# Type check
npm run typecheckMIT
Clear configured endpoints (all or specific)
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session identifier | |
| method | No | Optional: HTTP method to clear | |
| path | No | Optional: endpoint path to clear |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden of behavioral disclosure. It fails to clarify what 'clearing' entails (permanent deletion vs temporary disablement), whether the operation is reversible, or what happens to active connections/requests targeting those endpoints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely brief (5 words). While not verbose, it is so terse that it under-delivers on necessary context. The parenthetical is compressed to the point of opacity. Every word earns its place, but more words are needed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive state-modification tool with no output schema, the description is inadequate. It omits return value semantics, error conditions (e.g., clearing non-existent endpoints), side effects on the session, and relationship to the 'configure_endpoint' sibling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, establishing a baseline of 3. The description conceptually links the optional method/path parameters to 'specific' clearing versus 'all', but adds no syntax details, format examples, or clarification that omitting optional parameters clears all endpoints for the session.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the action ('Clear') and resource ('configured endpoints'), but 'clear' is ambiguous (delete? unregister? reset?). The parenthetical '(all or specific)' hints at filtering behavior but does not distinguish this from sibling 'delete_session' (which removes the entire session vs just endpoints).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance provided on when to use this tool versus alternatives like 'delete_session' or when clearing is preferred over re-configuring. No mention of prerequisites (e.g., that endpoints must be configured first).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Configure a mock API endpoint with sequential responses
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session identifier | |
| method | Yes | HTTP method (GET, POST, etc.) | |
| path | Yes | Endpoint path (e.g., /api/users) | |
| responses | Yes | Array of responses for sequential behavior |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses 'sequential responses' behavior not inferable from just 'endpoint', but lacks critical operational context given zero annotations: idempotency (create vs update), side effects, return values, error conditions, or session lifecycle requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single 7-word sentence is maximally front-loaded with no waste. However, for a 4-parameter configuration tool with complex sequential behavior, slightly undersized - could benefit from one additional sentence on behavioral context without hurting conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate basic coverage given rich schema (100%), but incomplete for a mutation tool with no annotations or output schema. Missing: return value description, error scenarios, idempotency guarantees, and relationship to session lifecycle that would help an agent use this correctly in the mock server workflow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% description coverage, establishing baseline 3. Description mentions 'sequential responses' which aligns with but essentially restates the schema's 'Array of responses for sequential behavior' on the responses parameter. No additional semantic value added for sessionId, method, or path beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear specific verb ('Configure') + resource ('mock API endpoint') + distinguishing trait ('sequential responses'). The sequential responses detail clearly differentiates this from sibling read/delete tools like list_endpoints or clear_endpoints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use versus alternatives, prerequisites (e.g., requiring an existing session), or workflow ordering relative to siblings like list_sessions or clear_endpoints. Only states what it does, not when to do it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Delete a session and clean up resources
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session identifier to delete |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Mentions 'clean up resources' indicating side effects beyond simple deletion. However, with no annotations provided, lacks disclosure on reversibility, idempotency, or what specific resources are cleaned up.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single 7-word sentence, front-loaded with verb. Zero redundancy or wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a single-parameter deletion tool, but given lack of annotations and output schema, could clarify error handling (e.g., if sessionId doesn't exist) or confirmation requirements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with 'Session identifier to delete'. Description adds no parameter details, but baseline 3 applies since schema fully documents the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'Delete' and resource 'session'. Includes extra scope 'clean up resources'. Does not explicitly distinguish from sibling 'clear_endpoints' which also removes data, though 'delete' vs 'clear' implies different granularities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use versus alternatives (e.g., when to delete a session vs clearing endpoints), prerequisites, or consequences of deletion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get request history for a session
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session identifier | |
| limit | No | Maximum number of requests to return (default: 100) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, yet description fails to disclose if operation is read-only, what format data is returned in, error conditions (e.g., invalid sessionId), or pagination behavior beyond the limit parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is front-loaded and wastes no words, though brevity comes at cost of omitted behavioral details expected given no annotations or output schema exist.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Lacks return value description critical for agent usage given no output schema exists. With no annotations and minimal behavioral disclosure, description insufficiently covers tool complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% description coverage, establishing baseline 3. Description implies 'sessionId' via 'for a session' but adds no syntax details, format examples, or semantic meaning beyond what schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Get) and resource (request history) with scope (session), but 'request' is ambiguous in context of WebSocket sibling tools (send_websocket_data), and fails to differentiate from list_sessions or other session-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance provided on when to use this versus list_sessions or other session management tools, nor any prerequisites mentioned (e.g., session must exist).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List configured endpoints for a session
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session identifier |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. 'List' implies read-only behavior but does not confirm safety, describe error handling for invalid sessionIds, or explain output format given lack of output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Six words with zero redundancy. Core action and scope front-loaded. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Appropriate for low-complexity tool (single required string param, no nested objects). However, lacks behavioral details expected given absence of annotations and output schema. Minimum viable documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with sessionId documented as 'Session identifier'. Description reinforces this by mentioning 'for a session', adding contextual linkage between the parameter and operation scope. Baseline 3 appropriate given schema completeness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Provides clear verb (List), resource (endpoints), and scope (for a session). Implies distinction from sibling list_sessions by requiring session context, though could explicitly clarify relationship to configure_endpoint.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no guidance on when to use vs alternatives like configure_endpoint or clear_endpoints. No mention of prerequisites (e.g., requiring an active session) beyond implied sessionId requirement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all active sessions with metadata
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. While 'List' implies read-only behavior, the description does not confirm this explicitly, nor does it explain what constitutes 'active' status, what metadata is returned (format/fields), or whether results are paginated—critical gaps for a 'list all' operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no waste. Every word earns its place: 'List' (action), 'all' (scope/filter), 'active' (state filter), 'sessions' (resource), 'with metadata' (return detail).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema, the description is minimally viable—it conveys the basic operation. However, it lacks necessary context about what 'metadata' includes, what 'sessions' refer to in this domain (WebSocket/http?), and lacks behavioral warnings appropriate for a mutation-free listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters (empty schema), the baseline score is 4 per calibration guidelines. The word 'all' in the description correctly signals that no filtering parameters exist, which aligns with the empty input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verb 'List' and resource 'sessions', and qualifies scope with 'active' and 'with metadata'. However, it does not explicitly differentiate from sibling tool 'list_endpoints', leaving ambiguity about when to use which list operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'get_request_history' (which also retrieves session-related data) or prerequisites for invocation. No mention of 'all' implying potential performance impact on systems with many sessions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Send an action message to connected WebSocket client
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session identifier | |
| action | Yes | Action name (e.g., logout, navigate) | |
| params | No | Optional action parameters |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden but offers minimal behavioral context. It does not specify failure modes (e.g., client disconnected), whether the operation is synchronous, timeout behavior, or side effects beyond the basic sending action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is efficiently structured and front-loaded with the operative verb. While extremely terse, it contains no redundant or wasted phrases. However, the brevity contributes to under-specification given the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three parameters (including a nested object), no annotations, and no output schema, the description is insufficiently complete. Critical missing information includes: differentiation from 'send_websocket_data', error handling behavior, and the specific semantics of 'action' types (only partially covered by schema examples).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, establishing a baseline of 3. The description adds marginal value by contextualizing the 'action' parameter as an 'action message' and implying the 'sessionId' relates to a 'connected WebSocket client', though it does not elaborate on syntax or validation rules beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Send') and resource ('action message' to 'WebSocket client'), clearly stating the core operation. However, it fails to distinguish from the sibling tool 'send_websocket_data', leaving ambiguity about when to use 'action' versus 'data' messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (particularly 'send_websocket_data'), nor are prerequisites mentioned (e.g., requiring an active session/connection). Agents must infer usage solely from parameter names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Send a data message to connected WebSocket client
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session identifier | |
| data | Yes | Data payload to send |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Fails to disclose critical WebSocket behavioral traits: what happens if the client is disconnected, whether the operation blocks, payload size limits, or success/failure return semantics. Only states the obvious send operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single 9-word sentence is front-loaded and contains no waste. However, it is arguably underspecified for a networking tool rather than appropriately concise—missing critical behavioral context that would help an agent handle errors.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a WebSocket communication tool with no annotations and no output schema, the description is incomplete. Lacks connection state requirements, error handling details, payload constraints, and differentiation from send_websocket_action that are necessary for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% description coverage (sessionId and data both documented), establishing baseline 3. Description adds no additional parameter semantics, examples, or format constraints beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb (Send) and resource (data message to WebSocket client). Specifies 'data message' which implicitly distinguishes from sibling tool send_websocket_action, though it could explicitly clarify the semantic difference between a 'data message' and an 'action'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no guidance on when to use this vs send_websocket_action, nor prerequisites like requiring an active session/connection before sending. No mention of error conditions or failure modes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0clear_endpointsconfigure_endpointdelete_sessionget_request_historylist_endpointslist_sessionssend_websocket_actionsend_websocket_dataEach tool has a clearly distinct purpose with no ambiguity: clear_endpoints, configure_endpoint, delete_session, get_request_history, list_endpoints, list_sessions, send_websocket_action, and send_websocket_data all target specific, non-overlapping operations in the mock API/WebSocket testing domain. The descriptions reinforce this clarity, making misselection unlikely.
All tool names follow a consistent verb_noun pattern using snake_case, such as clear_endpoints, configure_endpoint, and list_sessions. This predictability aids agent understanding and selection, with no deviations in style or convention across the set.
With 8 tools, the count is well-scoped for a mock API and WebSocket testing server. Each tool serves a distinct role in managing sessions, endpoints, and WebSocket communications, avoiding bloat while covering essential operations for the domain.
The tool set provides strong coverage for session and endpoint management, including CRUD-like operations (list, configure, clear, delete) and WebSocket messaging. A minor gap exists in not having tools for modifying existing endpoints or detailed session configuration, but agents can work around this with the available tools.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
AI-native mock API server with MCP. Create REST/SOAP mocks from Claude, Cursor, or Windsurf.
AI-callable tools for API mocking, testing, monitoring, security, and automation.
Build, validate, and manage API simulations in WireMock Cloud from MCP-compatible AI agents.
A webhook inbox for agents: one call returns a live URL. Mock, verify, inspect and replay.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/aj-bartocci/SpyNet'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
