ClavionX SAML Debugger

Capture a SAML sign-in locally, get a plain-English diagnosis, and download a privacy-safe Support Bundle for your support team.

ClavionX SAML Debugger is a SAML Diagnostic Assistant, not a trace viewer. Most SAML tools give you a raw XML dump and leave you to figure out what went wrong. ClavionX watches your SAML SSO and SLO traffic locally in the browser, correlates the AuthnRequest, Response, and logout messages into a single flow, and runs that flow through a deterministic knowledge base of real-world SAML failure modes — clock skew, signature/algorithm mismatches, missing or malformed assertions, RelayState and InResponseTo mismatches, session/cookie issues, and more — to tell you what broke and why, with the evidence that led to that conclusion. Key capabilities: Root Cause Analysis, not just a trace. Every diagnosis comes with the evidence trail behind it and a confidence rating — the tool distinguishes "how sure we are" from "how much we actually captured," and says so plainly when it can't fully determine a cause. Identity provider / service provider awareness. Recognizes the major commercial and open-source IdP/SP products from the captured traffic itself and layers vendor-specific remediation guidance on top of the generic diagnosis. Configurable per-site allow/deny list controls exactly which sites are captured. Security posture summary. A separate, at-a-glance summary of security-relevant signals (structural signature presence/algorithm, HTTPS usage, etc.) — this is a structural check, not a cryptographic signature verification. Network Trace, on demand. Start a recording to capture the full network conversation alongside the decoded SAML, for the rare case the root-cause analysis needs supplementing with raw request/response detail — sensitive headers and tokens are redacted the moment they're captured, not afterward. Support Bundle. Download a privacy-safe .zip — diagnosis plus the underlying captured flow (and network trace, if you recorded one) — to attach directly to a support ticket. Share Diagnostics. Generate a text/Markdown report to hand to your identity team — built to omit raw NameID/attribute/cookie values so it's safe to share. 100% local. No backend, no analytics, no telemetry. Captured flows live in your browser's local storage until you delete them. Built for identity engineers, IT admins, and support teams who are tired of eyeballing base64 SAML blobs to figure out why a login is failing.