That covers the cases you otherwise never exercise — a token rejected mid-session, a tool that vanishes, an authorization server that refuses dynamic registration, a rotated client_id that should now fail. Everything resets on restart, so a broken experiment costs nothing to clear.
A test rig for MCP client developers: a local server whose auth, tools and reliability you break from a web control panel — forced 401s, expired tokens, disappearing tools, flaky calls.
- Four auth modes — none, bearer, fixed headers and OAuth 2.1 — each able to force 401 or 500 mid-session
- An interactive OAuth 2.1 consent page with Approve, Decline, Wrong Code and Wrong State
- Token expiry by TTL, refresh-token rejection, and refresh-token ownership enforcement
- Dynamic client registration, or pre-registered-client-only mode where the registration endpoint disappears
- Tool disruption: disable a tool so clients receive tools/changed, or switch echo and add between v1 and v2 schemas
- Reliability faults: slow mode with a latency range, and a tool-call failure rate from 0 to 100%
- Real tools to exercise: echo, add, get-time, random-number, reverse, typeEcho, dispute-charge, and CRUD over a SQLite contact database
- Three large-schema tools that start disabled, for testing how a client handles wide inputs
- A live request log of inbound JSON-RPC and outbound SSE, keeping the last 200 entries
Node 20+ and nothing else: npx mcp-chaos-rig starts it. The control panel is at localhost:4100/ui and the MCP endpoint at http://localhost:4100/mcp. All state is in memory and resets on restart to whatever AUTH_MODE and the other environment variables seed. Version 1.7.0.
One command — npx mcp-chaos-rig