The inspector

Select a flow and the inspector shows both halves of the exchange. Reading it is free on every platform.

On the Mac#

The inspector sits under the traffic list, with the request and the response each in their own pane. View ▸ Detail Layout arranges them:

View ▸ Open Detail in New Window (⌥⇧⌘5) gives a flow its own window, and View ▸ Hide Detail Pane (⌥⌘→) gives the list the whole window.

Tabs#

• Both sides open on Summary. The request side shows the overview (host, path, scheme, protocol, start, duration, the GraphQL or gRPC operation), the request's size and timing, the client app with its bundle ID, the peer address, how WireLens handled the connection, the cipher, the protocols and ciphers the client offered, the server certificate, the TLS fingerprints, and which tools changed the flow. The response side shows status, size, latency and a timing breakdown.
• Auth, Cookies and Trailers appear only when that side has them. Messages appears for WebSocket flows. See WebSocket.
• LLM or MCP comes first for calls to AI model APIs and MCP traffic. See LLM and MCP calls.
• Raw shows the message as text, start line, headers and body.
• Query lays the query parameters out as a table you can copy.

Settings ▸ Appearance ▸ Inspector reorders or hides these tabs. Restore Default Order puts them back.

Reading bodies#

WireLens picks a view from the content type and from the bytes themselves, and offers the others in the body's mode picker:

Markdown, form fields, MessagePack and Protobuf are decoded too; Protobuf shows field names once you import your schemas, which needs WireLens Pro (see gRPC, GraphQL and Protobuf). Compressed bodies are decoded for reading.

The body toolbar has find, wrap lines, line numbers, Auto-beautify for minified code, copy, and Open in Payload Studio, which opens the body in its own window. View ▸ Quick Look Selection (⌥⌘P) shows the selected body large.

Query a JSON body#

With WireLens Pro, the JSON viewer has a query bar. Type a JSONPath expression such as $.items[?(@.price>50)].sku, or a jq program such as .errors[0].message, and the view narrows to the result. The same two languages work in the search field as json: and jq:. See The traffic list.

Headers#

• Credential headers are masked. Reveal value shows one, Reveal All Masked Values shows them all.
• A bearer token in Authorization is decoded into its Header and Payload, with a chip for its expiry.
• Cookies are split into name, value and attributes.
• Switch between Table and Raw, and filter rows with the Name or value field.

Custom preview tabs#

Tools ▸ Custom Preview Tabs adds your own views to the body's mode picker, for URLs that match a pattern. A tab either forces a format (Forced format) for bytes WireLens does not recognise, or runs an onPreview(body) script (Script) that turns a body into readable text or JSON, such as your app's own encoded payloads. A preview script is stopped after 3 s and has no network or file access.

LLM and MCP calls#

On the Mac, calls to AI model APIs and Model Context Protocol traffic get a tab of their own, and the LLM and MCP chips in the traffic list show only them.

The LLM tab#

WireLens reads requests in the Anthropic Messages, OpenAI Chat Completions, OpenAI Responses, Gemini and Ollama formats. It recognises a call by its body, on any host, including gateways and local servers.

On the request side:

• Call: the Model, and what was Sent.
• Since the previous call (Pro): what this turn added compared with the previous call of the same conversation, with Show Previous to jump to it. A changed system prompt or tool is marked CHANGED, a new tool NEW.
• System prompt and Tools.
• The conversation, message by message, with tool calls and tool results. Only what changed hides the messages that were sent again unchanged.

On the response side:

• Usage: Input, Cache read, Cache write, Output and Context read tokens, plus the tokens of an advisor step when the call used one.
• With WireLens Pro, Cost (est.) at the provider's list price on the day of the call, with a Breakdown into input, cache reads, cache writes, output and web searches, Cache saved, and Session so far for every model call in the capture run up to this one. An advisor or fallback step is priced at its own model's rate. Fast mode, the long-context rate, US-only inference and batch or flex tiers are applied when the response reports them. When a gateway reports the billed amount itself (OpenRouter, LiteLLM), Cost shows that amount instead. Negotiated and cloud-partner rates differ.
• Timing: First byte, Total and Output speed.
• Reply: the reassembled answer, including tool calls and reasoning blocks. A streamed reply that stopped before its final event is flagged as cut off.

The MCP tab#

Each row is one JSON-RPC request and its answer.

• Call: the Server, the Method, the Tool, Resource or Prompt it is about, the Request id, and the Agent app that called. Arguments or Params below.
• Outcome: Success, JSON-RPC error, Tool error (isError) or Failed, and how long it Took.
• Result: the content blocks and any Structured content.
• A tools/list answer lists every tool with chips for read-only and destructive. An initialize answer shows the Server name, protocol version, capabilities and the Instructions the model receives.
• Text in tool descriptions, results or server instructions that reads like hidden instructions to the model is flagged in a Flagged panel. These are pattern checks, worth a look before you trust a server.

MCP Inspector#

MCP servers reached over HTTP are captured like any other traffic when the agent's requests go through WireLens. Local servers talk over stdio, and Tools ▸ MCP Inspector (Pro) puts a small tap, wirelens-mcp-tap, in front of them.

• Servers lists the MCP servers configured in Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, VS Code Insiders, Gemini CLI and Zed. Click Inspect on one, or Inspect All N Local Servers, then restart the agent as the pane tells you. Stop Inspecting removes the tap.
• By hand shows how to put the tap in front of any stdio server command, for an agent the pane does not list. Everything after -- is the server's own command, and its environment and exit status pass through unchanged.
• Calls are recorded only while capture is running. The pane says so and offers Start Capture.
• The MCP chip above the traffic list filters to these calls. Each row is one request and its answer.
• Tool errors, calls that never got an answer, and tool descriptions that look like hidden instructions are marked on their rows.
• Servers reached over HTTP show remote · via proxy instead of Inspect. Their calls are captured whenever the agent's traffic goes through WireLens.

From the command line, wirelens ships inside the app and is not on your PATH until you link it once.

wirelens mcp servers
wirelens mcp inspect my-server
wirelens mcp uninspect my-server

On iPhone and iPad#

Tap a request to open it. The tabs are Overview (host, port, path, HTTP version, times and sizes), Request (the full URL, Query Parameters, Request Headers, the body), Response (Status, Response Headers, Response Trailers, the body) and Timing (phases and a waterfall). WebSocket flows show Overview, Messages and Timing.

• Bodies switch between Pretty, Tree, Query and Vars for GraphQL, Raw, Hex, and Play for audio and video. A compressed body shows a banner such as "gzip → decoded for display", and a GraphQL errors array shows as a banner too.
• The ⋯ menu has Copy as cURL, Export HAR Entry, Edit & Resend, Repeat, Breakpoint This URL, Map Local from Response and Share Body.
• The connection's own screen has a Fingerprint section with the client's and the origin's JA4 and HTTP/2 fingerprints.

On Android#

Tap a request to open it. The tabs are Overview, Request, Response and Timing; WebSocket flows add Messages.

• Overview lists the App and Package that sent it, the Protocol (for example "HTTP/2 over TLS (decrypted)"), the Remote address, the GraphQL Operation or the gRPC method and gRPC status, sizes, and the connection with its server certificate.
• Request and Response show Query, Headers and Trailers with their counts, then the body. Headers can be found, copied, hidden or revealed, and Show decoded opens a bearer token, Basic credentials or cookies.
• Bodies switch between Preview, Protobuf, Tree, Form, Raw and Hex, with find, wrap and copy. Compressed bodies are decoded for display.
• Timing shows the request and response marks, the durations, and TCP connect and TLS handshake times.
• The ⋮ menu has Copy URL, Copy as cURL, Edit & Resend, Repeat, Breakpoint This URL, Map Local from Response, Export HAR, Share Request Body and Share Response Body.

Copy a request#

• Mac: Edit ▸ Copy as cURL (⇧⌘C), or right-click ▸ Copy for the URL, headers, bodies and generated code. See Copy as code.
• iPhone, iPad and Android: Copy as cURL in the request's menu or its long-press menu.