Spanly
Spanly traces every MCP JSON-RPC packet, scans live tool calls for agent exploits, and canary-tests patches on real sessions.
If your MCP server faces customers, protocol-level telemetry is the gap a generic APM leaves open, and Spanly fills it with per-client conformance, live security screening, and a patch-test loop that starts on real sessions before you touch source. Budget for two observability bills, though: the pricing FAQ tells you to keep Datadog or Sentry running. Pro at $82.50/mo billed annually is where retention past 90 days and live scanners begin; Free is a single-server evaluation with a 50,000-packet
Verified 2h ago · liveness 76/100 · cite: rightaichoice.com/tools/spanly
- Engineering teams running customer-facing MCP servers who need to know which client is breaking tool calls
- Platform teams that want MCP-native telemetry without rebuilding or modifying server code
- Security teams screening live MCP traffic for prompt injection, tool poisoning, and secrets in arguments
- Teams that need to test an MCP fix on real sessions before shipping it upstream
- Teams not running MCP servers or AI agents at all
- Anyone wanting a single full-stack APM — Spanly is MCP-specific and explicitly additive
- Very high-volume MCP traffic above 75M packets/month unless you're ready for Enterprise sales
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip Spanly if you have no MCP servers in production — it is additive MCP-layer telemetry, not a general APM, so it will not replace your HTTP and infrastructure monitoring.
Only 50,000 packets a month are free, and past that every additional 100k costs $5.00 — a chatty server that records requests, responses and notifications can pass the allowance within days.
Spanly's ladder fits teams whose MCP traffic is real but not enormous. Free at $0/mo handles a single server up to 50,000 packets/month; Pro at $82.50/mo billed annually at $990 (90-day retention, unlimited seats, live scanners) suits a growing product team; Business at $415.83/mo billed annually at $4,990 adds SSO, audit log and your own-domain gateway. Above 75M packets/month, custom Enterprise rates drop below $3.50/100k.
In short
Spanly — Spanly traces every MCP JSON-RPC packet, scans live tool calls for agent exploits, and canary-tests patches on real sessions. Best for Engineering teams running customer-facing MCP servers who need to know which client is breaking tool calls, Platform teams that want MCP-native telemetry without rebuilding or modifying server code, Security teams screening live MCP traffic for prompt injection, tool poisoning, and secrets in arguments. Free to start; paid plans from $82.5/mo.
What's new in Spanly
Checked 5 days agoAcross the latest 2 updates: 2 news mentions.
Agentjacking: when your telemetry becomes a prompt-injection vector
Spanly examined RCE via public telemetry DSNs where shell commands hide in error reports, and how MCP observability surfaces the read-to-exec pivot.
MCP OpenTelemetry tracing vs Spanly: what each one actually captures
Compares the MCP Python SDK's SEP-414 OpenTelemetry tracing with Spanly's packet-level MCP capture and positions them as complementary layers.
What people actually say about Spanly — is it worth it?
We ran a structured research pass across product reviews, community discussions, and post-purchase forum threads to surface the patterns vendors won't publish themselves. Below: the recurring strengths, the hidden costs people mention most, and the cohort that consistently regrets adopting this tool.
5 mentions across 3 sources (Hacker News, YouTube, Product Hunt), 18 more we could not attribute · researched Sep 30, 2026.
Weighted by the 23 posts each of 3 sources contributed.
- +Captures every JSON-RPC message, so p95 latency spikes come with an actual cause attached
- +Zero-code CLI wrapper (npx spanly run) lowers adoption friction for existing MCP servers
- +Tool-level and argument-level visibility is the exact blind spot HTTP APMs leave
- +Per-client conformance across Claude Code, Cursor, Codex, Windurf, Copilot, and Zed is genuinely useful
- +132+ security scanners for prompt injection and tool poisoning cover a real 2026 attack surface
- −No independent production reports — all community signal traces back to founder-led launches
- −Single founder means support, security response, and roadmap ride on one person
- −Per-packet billing punishes chatty MCP servers; every notification counts
- −No documented payload-level redaction for prompts and arguments, only headers
- −132+ scanners sounds impressive but is unverified — no third-party efficacy testing exists
- • Per-packet metering means high-volume MCP servers (streaming clients, frequent notifications) can exceed tiers faster than expected
- • Pricing details aren't publicly disclosed beyond 'freemium' — budgeting requires a sales conversation
- • No published overage rate, so runaway agent loops can produce surprise bills
Viability Score
How well maintained and how widely used is Spanly? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: October 2026
How we score →Key Features
- Real-time MCP tracing with full JSON-RPC request and response capture
- Packet-based metering: every request, response, and notification is one packet
- P50/P95/P99 latency broken out per server, client, prompt, resource, and tool
- CLI wrapper (spanly run) for zero-code-change instrumentation over stdio or HTTP
- CLI reverse proxy (spanly proxy) in front of an already-running MCP server
- TypeScript SDK with one-line Express/HTTP middleware (@spanly/sdk)
- Python ASGI middleware for 3.10+ (spanly package)
- Docker sidecar deployment path
- MCP Gateway on a Spanly subdomain or your own domain (Business)
- OpenTelemetry ingestion of MCP spans plus export back to your APM
- 132+ security scanners for prompt injection, tool poisoning, secrets, and schema issues
- Live traffic screening of production tool calls, severity-ranked per tool
- Patch workflow: draft a fix, canary or A/B test on live sessions, apply until upstream ships
- Health monitors that inventory tools, prompts, and resources and alert on downtime
- Client conformance monitoring across Claude Code, Cursor, Codex CLI, Windsurf, Copilot, and Zed
About Spanly
Spanly is observability built for Model Context Protocol servers. Instead of watching HTTP requests and stack traces, it captures the protocol itself: every tool call, prompt, and resource read, with the arguments kept next to the trace so you can see why a tool broke, not just that latency moved. It is aimed at engineering and platform teams running customer-facing MCP servers, plus the security groups screening those servers for prompt injection and tool poisoning. Instrumentation takes about two minutes and requires no rebuild. Wrap the server with the CLI via `spanly run` or put `spanly proxy` in front of a live process, or drop in one line of middleware through `@spanly/sdk` for TypeScript or the `spanly` package for Python 3.10+ ASGI apps. A Docker sidecar covers the rest. The SDK ingests OpenTelemetry-formatted MCP spans and can export traces back to your APM, so Datadog, Sentry, or New Relic keep working alongside it. Dashboards break traffic down by tool, prompt, resource, client, and server, with per-client conformance across Claude Code, Cursor, Codex CLI, Windsurf, Copilot, and Zed. Security is a first-class tab: 132+ scanners flag prompt injection, tool poisoning, secrets in arguments, and schema problems, severity-ranked with per-tool issue counts. Health monitors poll your servers on a schedule, inventory their tools and resources, and alert your channels when one goes down. The patch loop is the part most teams notice. Spanly drafts a fix, tests it on a slice of live sessions by canary or A/B, then applies it until you ship the change upstream. Data residency is chosen per project: US or EU ingest endpoints, with no cross-region replication. Positioning-wise it complements a general APM rather than replacing one, and it only makes sense if you actually run MCP servers.
Behind the Verdict
The pitch that lands isn't the tracing — plenty of tools trace. It's that Spanly can name a cause. In its own dashboard, an issue reads "Tool name confuses the agent" against exec2, and the proposed fix is a rename with a target of cutting wrong-tool rate. That kind of finding is what you buy here, and it's why we'd steer teams to Spanly specifically when agents pick the wrong tool or pass malformed arguments rather than when p95 simply drifts. Pick it when your MCP server has real users across several clients. The per-client conformance view across Claude Code, Cursor, Codex CLI, Windsurf, Copilot, and Zed is the diagnostic that's hardest to build yourself, and the header claim on the vendor site — "works in Claude, broken in Cursor" — is the exact failure mode customers report to you first. Pick it too if security review is blocking a launch. The 132+ scanners run against live traffic on paid plans, rank findings by severity, and Monitor your registry listings for impostor entries. A recent Spanly post on agentjacking makes the read-to-exec pivot concrete: an attacker plants a shell command where your telemetry will surface it, and a tool that reads and executes it hands over control. Having that traffic screened matters more once you've read the writeup. Pass if you don't run MCP servers. Pass as well if you want one vendor to cover everything — Spanly is additive by design, and the pricing page says so outright, recommending you keep sending HTTP and infrastructure telemetry elsewhere. That's a second bill and a second dashboard to check. Volume is the other caveat. The graduated ladder drops from $5.00 per 100k packets to $3.50 per 100k between 25M and 75M, then hands you to Enterprise sales. Every request, response, and notification counts as a packet, so a
Researching Spanly? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Real-world workflow fit
Concrete scenarios for the personas Spanly actually fits — and what changes day-one when you adopt it.
Wrap the existing server with npx -y @spanly/spanly run -- node ./server.js, set SPANLY_API_KEY (region auto-detected from the spanly_us_ prefix), then watch the Requests view fill within seconds of the first MCP call from Claude Code or Cursor.
Outcome: Per-tool P50/P95/P99 latency and full JSON-RPC payloads land in the dashboard without a rebuild, and the CLI forwards original bytes verbatim while redacting credential headers.
Turn on live traffic scanners on Pro, then review the severity-ranked Issues list — for example a prompt injection found in web_search tool output or secrets returned in db_query arguments.
Outcome: Open issues are triaged by scanner and tool, registry monitoring catches impostor listings, and a patch can be drafted and A/B tested on 10-20% of live sessions before being applied broadly.
Create the project in the EU region so the API key carries the spanly_eu_ prefix, enable health monitors and, on Business, turn on the audit log and SAML/OIDC SSO for the team.
Outcome: Tool-call traceability stays inside the EU region, monitors inventory each server's tools, prompts and resources on a schedule, and the audit log gives reviewers a record of who did what.
Use Cases
- Monitor MCP server performance with real-time traces and P50/P95/P99 latency
- Debug tool call errors by inspecting full JSON-RPC payloads and stack traces
- Track session durations and per-client request volumes across deployments
- Alert on error rate spikes, slow tools, or resource access failures
- Correlate MCP traces with existing APM traces via W3C trace context
- Audit all actions with SSO and audit log for EU AI Act and SOC2 reviews
- Screen live MCP traffic for prompt injection, tool poisoning, and secrets in arguments
- Draft and canary-test patches for misbehaving tools without a deploy
Limitations
- Spanly is an MCP-server observability platform, not an AI model provider, so it has no underlying model.
- Metering is packet-based: every JSON-RPC request, response, and notification counts, with 50,000 free packets/month and $5.00/100k thereafter, so chatty servers incur cost quickly.
- Live traffic scanners, patch canaries/shims, and issue notifications (Slack, email, webhooks) start at Pro, while SAML/OIDC SSO, audit log, priority support, and custom-domain gateway require Business.
- Data retention is tier-gated: 30 days Free, 90 days Pro, 12 months Business, custom only on Enterprise.
as of 2026-10-13
Verification history
We have re-verified Spanly 11 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
- — re-checked, vendor evidence unchanged
- — re-checked, vendor evidence unchanged
- — re-verified summary, description, our verdict, our analysis, pricing model, pricing tiers, features, integrations, who it suits, who should skip it
Showing the 6 most recent of 11 verification passes.
Free to cite with attribution — this page re-verifies continuously.
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Plans compared
For each published Spanly tier: who it actually fits, and what it adds vs. the previous tier. Cross-reference the cost calculator above for projected annual outlay.
Free
$0/mo
Ideal for
A team evaluating Spanly on one MCP server, or a solo developer who wants traces without a card on file.
What this tier adds
Starting tier: 50,000 free packets per month (sampled at 10% past the allowance), 30 days retention, 2 seats, and 1 health monitor.
Pro
$82.50/mo billed annually at $990
Ideal for
A product team running a customer-facing MCP server that needs 90 days of history, live security scanners, and alerting.
What this tier adds
Adds 90-day retention, unlimited seats, security scans every 30 minutes, 5 health monitors, live traffic scanners, Mend patches/canaries/shims, Slack/email/webhook notifications, and public dashboards.
Business
$415.83/mo billed annually at $4,990
Ideal for
An organization needing SSO, an audit log, and priority support for compliance and larger MCP estates.
What this tier adds
Adds 12-month retention, MCP Gateway on your own domain, 100 health monitors, SAML & OIDC single sign-on, audit log, and priority support.
Enterprise
Custom
Ideal for
Teams with MCP traffic above 75M packets per month that need committed-use discounts, SLAs, and custom retention.
What this tier adds
Custom per-packet rate below $3.50/100k, dedicated support, custom data retention, committed-use discounts and SLA guarantees.
Where the pricing makes sense
The company stage and team size where Spanly's pricing actually pencils out — and where peers do it cheaper.
Spanly's ladder fits teams whose MCP traffic is real but not enormous. Free at $0/mo handles a single server up to 50,000 packets/month; Pro at $82.50/mo billed annually at $990 (90-day retention, unlimited seats, live scanners) suits a growing product team; Business at $415.83/mo billed annually at $4,990 adds SSO, audit log and your own-domain gateway. Above 75M packets/month, custom Enterprise rates drop below $3.50/100k.
Setup time & first value
How long it actually takes to get something useful out of Spanly — broken out by persona, not the marketing-page minute.
A single MCP server goes from zero to a first trace in under five minutes — the docs' quickstart is four steps: create a project, copy the API key, wrap the server with the CLI or mount one line of SDK middleware, and watch the request appear. SDK paths (TypeScript HTTP middleware, Python ASGI middleware, Docker sidecar) are the same one-line change. Gateway-on-your-own-domain and SSO work is
Switching to or from Spanly
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From a generic APM (Datadog/Sentry/New Relic): keep sending HTTP telemetry there and add the CLI or SDK to route MCP-shaped traffic to Spanly via OpenTelemetry spans.
- →From no MCP observability: run npx -y @spanly/spanly run -- node ./server.js against your server, no code changes and no rebuild.
- →From hand-rolled MCP logging: mount @spanly/sdk or spanly middleware and let the SDK attribute traffic to end users via the identity option instead of dropping it.
- ↗To Datadog or Sentry alone: export MCP spans over OpenTelemetry from the Spanly SDK into your existing APM, keeping the same trace context.
- ↗To a self-built OpenTelemetry pipeline: use the MCP Python SDK's SEP-414 tracing alongside your own collector, accepting coarser packet-level detail than Spanly's JSON-RPC capture.
Integrations
Resources & Guides
- Documentationspanly.com
Docs · Spanly
Full product docs from spanly.com
- Documentationspanly.com
Typescript Sdk · Spanly
Full product docs from spanly.com
- Documentationspanly.com
Python Sdk · Spanly
Full product docs from spanly.com
- API Referencespanly.com
Cli · Spanly
Methods, params, types from spanly.com
- Documentationspanly.com
Docker · Spanly
Full product docs from spanly.com
- Documentationspanly.com
Gateway · Spanly
Full product docs from spanly.com
- Documentationspanly.com
Troubleshooting · Spanly
Full product docs from spanly.com
- Resourcespanly.com
Pricing · Spanly
Helpful link from spanly.com
Tutorials & Learning
YouTube returned 6 videos for “Spanly”, and we withheld 6: 6 could not be judged, because “Spanly” is a single word that other videos use for other things. We are showing none, because we could not prove any of them are about Spanly.
Official links
Tools that pair well with Spanly
Common stack mates teams adopt alongside Spanly, with the specific reason each pairing earns its keep.
Chrome DevTools MCP
Open-source MCP server that gives coding agents live Chrome DevTools for debugging, traces, and browser automation.
Arize Phoenix
Arize Phoenix is open-source LLM observability: trace agent steps, run evals, and self-host your traces.
Comet
Opik by Comet turns LLM traces into root-cause groupings, eval scores and code fixes so agent teams stop shipping the same bug twice
Featured Head-to-Head Comparisons
Spanly vs Spider Cloud
Choose Spanly if you need dedicated observability for MCP servers in production—its real-time tracing, payload capture, and integrated alerting fill a gap APMs can't cover. Choose Spider Cloud if your AI agent requires fast, cost-effective web data extraction with structured output; its pay-as-you-go model and Rust engine make it ideal for high-volume scraping. Both are complementary, not directly competitive.
Spanly vs Temporal Ai
Choose Spanly if you already have an APM and need deep MCP-specific tracing with low overhead; it's purpose-built for MCP servers. Choose Temporal if you need to build reliable, long-running AI agent workflows with automatic retries and state persistence, even without MCP. For teams doing both, they complement each other.
Spanly vs Voyage Ai
For teams running MCP servers in production, Spanly is the clear choice with MCP-native observability, open-source SDK, and transparent freemium pricing. Voyage AI excels in enterprise RAG retrieval with domain-specific embeddings and rerankers, but lacks pricing transparency and pre-built integrations. Choose Spanly for monitoring MCP server health, Voyage for improving search accuracy over specialized documents.
Alternatives to Spanly
View all
Chrome DevTools MCP
Open-source MCP server that gives coding agents live Chrome DevTools for debugging, traces, and browser automation.
Arize Phoenix
Arize Phoenix is open-source LLM observability: trace agent steps, run evals, and self-host your traces.
Frequently Asked Questions
Used Spanly? Help shape our editorial sentiment research.