modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

review: set HOME explicitly + note healthcheck assumes --web

Browse source 
Follow-up on the re-review's two optional notes:

- Set `ENV HOME=/home/node` so the runtime-state dir (core/storage/store-io.ts
  resolves it from HOME) is explicit, rather than relying on the "." → WORKDIR
  fallback that happens to work because Docker doesn't set HOME on USER.
- Document that the HEALTHCHECK assumes the default --web mode; suggest
  `--no-healthcheck` for --cli/--tui runs (no web server to probe).

Re-verified: build ok, HOME=/home/node, runs as node (uid 1000), `/` → 200,
health → healthy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw
This commit is contained in:
cliffhall 2026-07-11 09:47:25 -04:00
commit 070f02e85f
2 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Dockerfile
View file

@ -31,14 +31,18 @@ ENV HOST=0.0.0.0 \
MCP_AUTO_OPEN_ENABLED=false
EXPOSE 6274
# Run as the non-root `node` user the base image ships. Its home (/home/node) is
# where the inspector writes runtime state (the default catalog, OAuth token
# storage), so use it as the working directory.
# Run as the non-root `node` user the base image ships. The inspector resolves
# its runtime-state dir (default catalog, OAuth token storage) from `HOME`
# (core/storage/store-io.ts), so set it explicitly to the node user's writable
# home and work from there.
ENV HOME=/home/node
USER node
WORKDIR /home/node
# Report readiness by probing the served SPA (`/` needs no auth). Uses Node's
# global fetch — no curl/wget in the slim image.
# global fetch — no curl/wget in the slim image. Assumes the default `--web`
# mode; running `--cli`/`--tui` has no web server, so add `--no-healthcheck` to
# `docker run` for those.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
CMD node -e "fetch('http://127.0.0.1:'+(process.env.CLIENT_PORT||6274)+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

2
README.md
View file

@ -178,7 +178,7 @@ docker build -t mcp-inspector .
docker run --rm -p 6274:6274 mcp-inspector
```
The image defaults to `--web` bound to `0.0.0.0:6274` with browser auto-open disabled; override the args to run another mode (`docker run --rm ghcr.io/modelcontextprotocol/inspector --cli …`). Pass `-e MCP_INSPECTOR_API_TOKEN=…` to set a known token (otherwise one is generated and printed in the logs), or `-e DANGEROUSLY_OMIT_AUTH=true` to disable auth.
The image defaults to `--web` bound to `0.0.0.0:6274` with browser auto-open disabled; override the args to run another mode (`docker run --rm ghcr.io/modelcontextprotocol/inspector --cli …`). Pass `-e MCP_INSPECTOR_API_TOKEN=…` to set a known token (otherwise one is generated and printed in the logs), or `-e DANGEROUSLY_OMIT_AUTH=true` to disable auth. The image runs as the non-root `node` user and has a `HEALTHCHECK` that probes the web UI — it assumes the default `--web` mode, so add `--no-healthcheck` when running `--cli`/`--tui` (which have no web server).
## Contributing — `AGENTS.md` and `CLAUDE.md`