Recording MCP tool calls
Recording MCP tool calls is the practice of capturing every tool call an AI agent makes over the Model Context Protocol — the typed JSON request and the typed result, in order — into a durable trace file while the job runs once as usual. In Reelier the recorder is a stdio proxy, reelier mcp --wrap "<server command>", which fronts an existing MCP server, re-exposes its tools unchanged, and appends each call and result to a JSONL trace under .reelier/traces/; the trace then compiles into a skill file that replays the same calls deterministically, with an assertion on every checkable step. This is recording for replay and regression testing. The same phrase also appears in security and observability writing, where it means audit logging or tracing — records you read, never records you re-execute.
Two meanings, one phrase
Most writing about recording MCP tool calls is about watching them: audit logs for compliance, SIEM detections, distributed traces for monitoring. The MCP tools specification itself tells clients they should log tool usage for audit purposes. All of that produces records meant to be read — by a human during an incident, or by an alerting rule.
Reelier records for a different reason. A tool call over MCP is a typed JSON request and a typed JSON result, which means a sequence of them is precise enough to execute again: same tool, same arguments, fresh response, an assertion checking each step. The recording stops being a diary and becomes a program. That re-executability is what separates a replay trace from a log, and it is the sense this page defines.
If you arrived here needing the logging sense, the honest bridge: a replay trace doubles as an exact record of what the agent did, and every replay writes a run receipt with per-step outcomes. It is still not a compliance pipeline — no retention policy, no SIEM shipping.
How the wrap proxy records
The recorder is reelier mcp --wrap "npx -y @yourco/mcp-server": a stdio MCP server that fronts the real one and re-exposes its tools 1:1 — same names, same descriptions, same input schemas — as pure passthrough. The live path is never modified; your agent always receives exactly what the downstream server returned. Repeat --wrap to front more than one server.
The proxy adds three control tools. reelier_start_recording opens .reelier/traces/<name>-<n>.jsonl — an existing trace is never overwritten. reelier_note narrates intent before a step, which later becomes the step title in the compiled skill. reelier_stop_recording returns the trace path and how many calls were captured. Between start and stop, every wrapped call and its result is appended in order, tool annotations included — a wrap-captured trace is the recording itself, where a history scan is a reconstruction.
Secrets are redacted at trace-write time only, never on the live path: values of env vars named in REELIER_REDACT, sk--shaped tokens, Bearer headers, and 32+-character hex strings in fields named like token/secret/key/password/authorization. The rules are deliberately conservative and can miss secrets in unnamed fields, so treat trace files as sensitive until you have verified coverage.
Two setup boundaries worth knowing before you wire it up. Only local stdio servers — a config entry with a command — can sit behind the proxy; remote http/sse entries are reported as skipped, never silently mis-wrapped. And on Claude Code, reelier install wraps every local server in your MCP config in one command, backing the config up first (reelier uninstall reverts); --agent claude is the only supported value today, so on other agents you edit the config entry by hand.
When you don't need the proxy
Recording is unnecessary when a scannable history already exists. Claude Code writes every session as a JSONL transcript under ~/.claude/projects, and reelier scan parses that format natively — past sessions freeze into skills without recording anything new. Scan also checks ~/.codex/sessions (Codex CLI), ~/.codeium/windsurf (Windsurf), and ~/.openclaw (OpenClaw); a source whose format it cannot parse contributes zero replayable sessions rather than a guess.
Cursor is the platform that makes the proxy mandatory: it keeps history in a SQLite database, so there is no history scan for it at all — Cursor is deliberately absent from scan's source list, and capture there is wrap-proxy only. The general rule: scan mines work you already paid for; wrap records the run losslessly as it happens.
From recording to replay — the boundaries
A trace becomes useful when it compiles: reelier compile <trace.jsonl> emits a SKILL.md with an assertion on every step that recorded a clean result (assertion-less steps are flagged as open questions), and reelier run re-executes the recorded calls at Level 0 — no LLM client is constructed, so the 0-token figure on the receipt is structural. Model help during replay is opt-in and BYOK (--max-level 1|2), and it heals assertions rather than improvising new steps.
Replay of a recording is read-only by default: recorded write steps never re-fire without --allow-writes. That default carries most of the weight, because in the measured corpus behind Reelier's launch writing only about 1.1% of scanned sessions were read-only end-to-end — almost everything an agent records will contain a write somewhere, and a recorder that replayed writes silently would be a hazard.
The recording boundary is worth stating just as plainly: Reelier captures MCP tool calls and its own http.get/http.post builtins. File edits, shell commands, and subagent dispatch are not MCP calls and are not recorded — an edit-heavy coding session honestly reports nothing replayable.
A real receipt
The output below is a real recorded trace, printed by reelier trace — the recording itself, before any compile or replay. It was produced by the published CLI's zero-setup demo path, which records two live HTTP requests through the same recorder and JSONL trace format the --wrap proxy uses for MCP servers; the wrapping: field in the meta line names what was fronted (here Reelier's http.get builtin rather than an external MCP server). Note the shape: a note narrating intent, then each call with its arguments, then its timed result.
npx -y reelier@latest trace .reelier/traces/reelier-init-demo-1.jsonl [meta] reelier-init-demo started 2026-07-21T21:54:17.109Z — wrapping: builtin:http.get [note] 2026-07-21T21:54:17.111Z — Fetch reelier's own versioned npm registry metadata [call #0] 2026-07-21T21:54:17.111Z — http.get {"url":"https://registry.npmjs.org/reelier/latest"} [result #0] ok (199ms) {"content":[{"type":"text","text":"{\"name\":\"reelier\",\"version\":\"0.13.0\",… [note] 2026-07-21T21:54:17.310Z — Fetch the package homepage, using the URL bound from the registry response [call #1] 2026-07-21T21:54:17.310Z — http.get {"url":"https://github.com/seldonframe/reelier#readme"} [result #1] ok (707ms) {"content":[{"type":"text","text":"\n\n\n\n \n\n<!DOCTYPE html>\n<html\n lang=…
Trace recorded by npx -y reelier@latest init --yes (resolved to reelier@0.13.0) in a scratch directory on 2026-07-21, then printed verbatim with reelier trace. The long result lines are truncated by the CLI itself — the … is its output, not an edit.
FAQ
Is this the same as MCP tool call logging, monitoring, or tracing?
No. Logging and tracing produce records meant to be read — for compliance, alerting, or debugging. A Reelier trace is a record precise enough to execute again: it compiles into a skill whose replay re-runs the recorded calls and asserts on every step. The trace doubles as an honest record of what the agent did, but retention, alerting, and SIEM integration are a logging pipeline's job, and Reelier does not claim them.
Does the proxy change what my agent sees?
Never. The wrapped tools are pure passthrough — same names, descriptions, and schemas, and the agent always receives the downstream server's real response. Redaction applies only to the copy written to the trace file.
Can every MCP server be recorded?
Local stdio servers only — an entry with a command (and optional args) can sit behind the proxy. Remote http/sse/url servers cannot be fronted by a stdio process; reelier install reports such entries as skipped rather than silently mis-wrapping them, and the same boundary applies when you wrap by hand.