echoLABSCO SUMMARY
Production servers do not fail when you need them to; this one fails on a toggle.
That covers the cases you otherwise never exercise — a token rejected mid-session, a tool that vanishes, an authorization server that refuses dynamic registration, a rotated client_id that should now fail. Everything resets on restart, so a broken experiment costs nothing to clear.
What it is
A test rig for MCP client developers: a local server whose auth, tools and reliability you break from a web control panel — forced 401s, expired tokens, disappearing tools, flaky calls.
What you get
- Four auth modes — none, bearer, fixed headers and OAuth 2.1 — each able to force 401 or 500 mid-session
- An interactive OAuth 2.1 consent page with Approve, Decline, Wrong Code and Wrong State
- Token expiry by TTL, refresh-token rejection, and refresh-token ownership enforcement
- Dynamic client registration, or pre-registered-client-only mode where the registration endpoint disappears
- Tool disruption: disable a tool so clients receive tools/changed, or switch echo and add between v1 and v2 schemas
- Reliability faults: slow mode with a latency range, and a tool-call failure rate from 0 to 100%
- Real tools to exercise: echo, add, get-time, random-number, reverse, typeEcho, dispute-charge, and CRUD over a SQLite contact database
- Three large-schema tools that start disabled, for testing how a client handles wide inputs
- A live request log of inbound JSON-RPC and outbound SSE, keeping the last 200 entries
Requirements
Node 20+ and nothing else: npx mcp-chaos-rig starts it. The control panel is at localhost:4100/ui and the MCP endpoint at http://localhost:4100/mcp. All state is in memory and resets on restart to whatever AUTH_MODE and the other environment variables seed. Version 1.7.0.
Setup effort
One command — npx mcp-chaos-rig
USE CASES
01
Testing whether your client refreshes a token
Set a short access-token TTL and watch what it does when the token dies.
02
Seeing what happens when a tool disappears
Disable it in the Tools tab; connected clients get the change notification.
03
Checking your retry logic
Set a failure rate and confirm failed calls are handled rather than surfaced raw.
04
Testing against an enterprise-style authorization server
Switch to pre-registered-client-only, where registration 404s and only your client_id works.
17 tools
Listed in project docs. Your client may show a different list.
addget-timerandom-numberreversetypeEchodispute-chargelist-contactsget-contact-by-idget-contact-by-emailsearch-contactscreate-contactupdate-contactdelete-contactsubmit-customs-declarationcreate-product-listingsearch-propertiesBEFORE YOU INSTALL
What to know first
Tools you get
17 tools named in the project's documentation.
Requires
npx on PATH
INSTALLATION
Connect your client
Add the block to your client, or run the command directly.
Server setup
Configuration file
JSON
{
"mcpServers": {
"mcp-chaos-rig": {
"command": "npx",
"args": [
"mcp-chaos-rig"
]
}
}
}npx
TERMINAL
npx mcp-chaos-rig
