mcp-chaos-rig

The problem

You're building an MCP client. You need to test OAuth flows, token refresh, tool discovery, error handling, and session lifecycle. Production servers don't fail on command. You need a server that does.

Related MCP server: mcpbin

What Chaos Rig does

Run a local MCP server where you control everything:

• Break authentication: force 401s and 500s mid-session, expire tokens on demand, reject refresh tokens

• Break tools: disable tools to trigger tools/changed, switch schema versions live

• Break reliability: add random latency, make tool calls fail at configurable rates

• See everything: live request log shows inbound JSON-RPC calls and outbound SSE responses, with click-to-expand bodies

Test scenarios

Quick start

npx mcp-chaos-rig

Control panel at localhost:4100/ui, MCP endpoint at http://localhost:4100/mcp. Requires Node 20+.

If you prefer a global install:

npm install -g mcp-chaos-rig
mcp-chaos-rig

Or run from source:

git clone https://github.com/Typewise/mcp-chaos-rig.git
cd mcp-chaos-rig
npm install
npm run dev

Remote access

If your production environment needs to reach Chaos Rig, expose it via a tunnel (ngrok, Cloudflare Tunnel, etc.) and set BASE_URL so OAuth redirects resolve correctly:

BASE_URL=https://your-tunnel.example.dev npx mcp-chaos-rig

Auth state

All state is in-memory and resets on restart. Bearer starts with token test-token-123 (valid until changed). OAuth tokens expire per TTL. Refresh tokens track ownership per client when enabled. After restart, do one refresh with ownership off to re-seed, then turn it on.

Control panel tabs

Server

Configure auth mode, slow mode (random latency), and flaky tools (% failure rate).

Bearer and OAuth modes support fault injection: force 401 or 500 responses to test error handling.

OAuth mode adds controls for access token TTL, refresh token rejection, and refresh token ownership enforcement. OAuth endpoints are listed in a collapsible section.

Tools

Toggle tools on/off. Disabling sends tools/changed to connected clients. Some tools (echo, add) support version switching.

Available tools:

• echo: returns your message (v2 adds format options)

• add: sums two numbers (v2 accepts an array)

• get-time: current server time as ISO 8601

• random-number: random integer in a range

• reverse: reverses a string

• list-contacts, search-contacts, create-contact, update-contact, delete-contact: SQLite CRUD

Contacts

View and reset the SQLite database backing the contact tools. Starts with three seed records.

Log

Live request log showing inbound requests and outbound SSE responses. Displays timestamp, source (mcp/auth/sse), method, status, JSON-RPC method, tool name, and arguments. Click any truncated body or args line to expand it. Keeps last 200 entries.

OAuth consent page

When auth mode is OAuth, the authorization endpoint shows an interactive consent page:

Links

• npm package

• GitHub repository

• MIT License