Spanly

Quick Verdict

Spanly is a hosted, protocol-aware observability layer for production MCP servers. It can capture tool calls, prompts, resource reads, errors, logs, sessions, payloads, and latency across stdio or HTTP, then break them down by server, client, tool, and version. It is most relevant to teams that already operate MCP servers and find that a conventional APM shows process or HTTP telemetry without enough MCP context. It is not an MCP server builder, model host, or replacement for a general APM.

Its central tradeoff is data exposure. Full JSON-RPC payloads make incidents easier to diagnose, but arguments and results may contain credentials, source code, personal data, customer records, or confidential business content. Spanly publishes claims about encryption, US/EU residency, retention, access controls, and subprocessors. However, its public legal materials leave important questions about the legal operator, data roles, international-transfer terms, and detailed deletion procedures for procurement to resolve. Test with non-sensitive traffic and complete a payload, DPA, access, and retention review before production use.

Best For

• MCP platform teams operating multiple production servers
• SRE and on-call engineers who need to move from an alert to one MCP exchange quickly
• Third-party server operators who can proxy traffic but cannot change the target code
• Security-mature organizations able to define collection, redaction, retention, and role policies
• Not ideal for local MCP experiments, strict self-hosting requirements, teams without sensitive-data controls, or workloads where basic logs are enough

Key Features

• Protocol-level traces for tools, prompts, resources, initialization, requests, responses, and notifications
• Error and performance analysis with grouped error codes, slow operations, and p50/p95/p99 latency
• Session and client analytics across clients such as Claude Code, Cursor, and Codex
• Multiple integration modes through TypeScript/Python SDKs, a CLI wrapper, proxying, or a Docker sidecar
• Operations features including alerts, health monitors, public dashboards, audit logs, SSO, and support on applicable plans
• US or EU project residency, with the vendor stating that telemetry and backups remain in the selected region
• Editor-based triage through a separate Spanly MCP server that queries stored observability data
• Clear license boundary: the SDK and CLI are Apache 2.0, but that license does not make the hosted Spanly service open source

Use Cases

• Diagnose a failed tool call by comparing arguments, errors, client version, and server version
• Separate a slow tool from a slow server or retry-heavy client
• Compare old and new deployment versions to catch regressions
• Find heavily used tools, unused resources, and changing client traffic
• Support an on-call workflow with alerts, status boards, sessions, and request-linked logs

Pricing

As of July 21, 2026, published annual pricing is $0 for Free, $990/year for Pro, $4,990/year for Business, and custom pricing for Enterprise. Every JSON-RPC request, response, and notification counts as a separate packet. All plans include 50,000 packets per month, while paid plans meter overage separately.

Published paid usage starts at $5 per 100,000 packets after the free allowance and decreases by volume. Model both sides of each request, notifications, retention, alerts, and overages rather than comparing subscription prices alone.

Pros

• MCP-shaped telemetry is more actionable than generic HTTP metrics for protocol incidents
• stdio, HTTP, proxy, and sidecar options reduce language constraints
• Requests, sessions, errors, logs, clients, and versions are connected in one view
• US/EU residency and published 30/90/365-day retention tiers support an initial review
• The free plan can validate the workflow with real but non-sensitive traffic

Cons

• Full payload collection creates privacy, credential, trade-secret, and minimization risk
• Public materials do not fully explain default redaction, field-level filtering, customer-managed keys, or independent audit results
• The privacy policy does not clearly identify the operating legal entity; data roles and international-transfer mechanisms need clarification
• SOC 2 Type II is described as roadmap work, while GDPR compliance is a vendor assertion
• Apache 2.0 covers the SDK and CLI, not the proprietary hosted service
• Packet overages can make a high-volume deployment materially more expensive than the base annual fee

Alternatives

Choose LangGraph when the job is workflow orchestration, or Cherry Studio when the job is client-side MCP testing. Spanly earns its place only when protocol-aware production triage is the requirement.

FAQ

Is Spanly an MCP server?

Its primary product is hosted observability for MCP servers. It also provides a separate MCP server for querying Spanly traces, but it does not implement your business tools.

Does Spanly record tool inputs and outputs?

Its site explicitly demonstrates full JSON-RPC request and response payloads. Inventory personal data, secrets, code, and customer content before enabling collection.

Is Spanly open source?

The public SDK and CLI use Apache 2.0. That does not mean the dashboard, storage layer, and hosted backend are open source or available for self-hosting.

Can the Free plan support production?

It can ingest traffic, but the 30-day retention, 2 seats, 1 monitor, and post-allowance sampling make it better suited to a low-risk evaluation than critical on-call coverage.

Does Spanly replace Datadog or Sentry?

No. The vendor positions it as an additive MCP layer while a general APM continues to cover infrastructure, HTTP, and application telemetry.

What should an enterprise verify before buying?

Verify the legal operator, DPA, international transfers, payload redaction and secret handling, employee access, backup deletion, incident notice, independent audits, data export, and billing caps.

Bottom Line

Spanly has a coherent use case: production incidents where engineers need the MCP method, payload, client, server, and version in one trace. The same payload visibility is its largest governance risk. Start with non-sensitive traffic, validate failure behavior and cost, and complete legal and security review before broad deployment. Do not treat the Apache 2.0 SDK license as a license for the hosted service or as evidence that enterprise compliance work is complete.