modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Merge branch 'main' into tool-search

Browse source
This commit is contained in:
Cameron Roberts 2025-08-18 23:08:55 +01:00 • committed by GitHub
commit 092f2ed6e3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 52 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

10
README.md
View file

@ -166,6 +166,16 @@ If you need to disable authentication (NOT RECOMMENDED), you can set the `DANGER
DANGEROUSLY_OMIT_AUTH=true npm start
```
---
**🚨 WARNING 🚨**
Disabling authentication with `DANGEROUSLY_OMIT_AUTH` is incredibly dangerous! Disabling auth leaves your machine open to attack not just when exposed to the public internet, but also **via your web browser**. Meaning, visiting a malicious website OR viewing a malicious advertizement could allow an attacker to remotely compromise your computer. Do not disable this feature unless you truly understand the risks.
Read more about the risks of this vulnerability on Oligo's blog: [Critical RCE Vulnerability in Anthropic MCP Inspector - CVE-2025-49596](https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596)
---
You can also set the token via the `MCP_PROXY_AUTH_TOKEN` environment variable when starting the server:
```bash

4
cli/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector-cli",
"version": "0.16.4",
"version": "0.16.5",
"description": "CLI for the Model Context Protocol inspector",
"license": "MIT",
"author": "Anthropic, PBC (https://anthropic.com)",
@ -21,7 +21,7 @@
},
"devDependencies": {},
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"commander": "^13.1.0",
"spawn-rx": "^5.1.2"
}

4
client/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector-client",
"version": "0.16.4",
"version": "0.16.5",
"description": "Client-side application for the Model Context Protocol inspector",
"license": "MIT",
"author": "Anthropic, PBC (https://anthropic.com)",
@ -25,7 +25,7 @@
"cleanup:e2e": "node e2e/global-teardown.js"
},
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"@radix-ui/react-checkbox": "^1.1.4",
"@radix-ui/react-dialog": "^1.1.3",
"@radix-ui/react-icons": "^1.3.0",

8
client/src/lib/auth.ts
View file

@ -102,10 +102,15 @@ export const clearClientInformationFromSessionStorage = ({
};
export class InspectorOAuthClientProvider implements OAuthClientProvider {
constructor(protected serverUrl: string) {
constructor(
protected serverUrl: string,
scope?: string,
) {
this.scope = scope;
// Save the server URL to session storage
sessionStorage.setItem(SESSION_KEYS.SERVER_URL, serverUrl);
}
scope: string | undefined;
get redirectUrl() {
return window.location.origin + "/oauth/callback";
@ -119,6 +124,7 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
response_types: ["code"],
client_name: "MCP Inspector",
client_uri: "https://github.com/modelcontextprotocol/inspector",
scope: this.scope ?? "",
};
}

6
client/src/lib/hooks/useConnection.ts
View file

@ -319,8 +319,6 @@ export function useConnection({
const handleAuthError = async (error: unknown) => {
if (is401Error(error)) {
const serverAuthProvider = new InspectorOAuthClientProvider(sseUrl);
let scope = oauthScope?.trim();
if (!scope) {
// Only discover resource metadata when we need to discover scopes
@ -334,6 +332,10 @@ export function useConnection({
}
scope = await discoverScopes(sseUrl, resourceMetadata);
}
const serverAuthProvider = new InspectorOAuthClientProvider(
sseUrl,
scope,
);
const result = await auth(serverAuthProvider, {
serverUrl: sseUrl,

6
client/src/lib/oauth-state-machine.ts
View file

@ -177,7 +177,11 @@ export const oauthTransitions: Record<OAuthStep, StateTransition> = {
authorizationCode: context.state.authorizationCode,
codeVerifier,
redirectUri: context.provider.redirectUrl,
resource: context.state.resource ?? undefined,
resource: context.state.resource
? context.state.resource instanceof URL
? context.state.resource
: new URL(context.state.resource)
: undefined,
});
context.provider.saveTokens(tokens);

30
package-lock.json generated
View file

@ -1,12 +1,12 @@
{
"name": "@modelcontextprotocol/inspector",
"version": "0.16.4",
"version": "0.16.5",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "@modelcontextprotocol/inspector",
"version": "0.16.4",
"version": "0.16.5",
"license": "MIT",
"workspaces": [
"client",
@ -14,10 +14,10 @@
"cli"
],
"dependencies": {
"@modelcontextprotocol/inspector-cli": "^0.16.4",
"@modelcontextprotocol/inspector-client": "^0.16.4",
"@modelcontextprotocol/inspector-server": "^0.16.4",
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/inspector-cli": "^0.16.5",
"@modelcontextprotocol/inspector-client": "^0.16.5",
"@modelcontextprotocol/inspector-server": "^0.16.5",
"@modelcontextprotocol/sdk": "^1.17.3",
"concurrently": "^9.2.0",
"open": "^10.2.0",
"shell-quote": "^1.8.3",
@ -44,10 +44,10 @@
},
"cli": {
"name": "@modelcontextprotocol/inspector-cli",
"version": "0.16.4",
"version": "0.16.5",
"license": "MIT",
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"commander": "^13.1.0",
"spawn-rx": "^5.1.2"
},
@ -67,10 +67,10 @@
},
"client": {
"name": "@modelcontextprotocol/inspector-client",
"version": "0.16.4",
"version": "0.16.5",
"license": "MIT",
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"@radix-ui/react-checkbox": "^1.1.4",
"@radix-ui/react-dialog": "^1.1.3",
"@radix-ui/react-icons": "^1.3.0",
@ -1999,9 +1999,9 @@
"link": true
},
"node_modules/@modelcontextprotocol/sdk": {
"version": "1.17.2",
"resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.17.2.tgz",
"integrity": "sha512-EFLRNXR/ixpXQWu6/3Cu30ndDFIFNaqUXcTqsGebujeMan9FzhAaFFswLRiFj61rgygDRr8WO1N+UijjgRxX9g==",
"version": "1.17.3",
"resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.17.3.tgz",
"integrity": "sha512-JPwUKWSsbzx+DLFznf/QZ32Qa+ptfbUlHhRLrBQBAFu9iI1iYvizM4p+zhhRDceSsPutXp4z+R/HPVphlIiclg==",
"license": "MIT",
"dependencies": {
"ajv": "^6.12.6",
@ -11059,10 +11059,10 @@
},
"server": {
"name": "@modelcontextprotocol/inspector-server",
"version": "0.16.4",
"version": "0.16.5",
"license": "MIT",
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"cors": "^2.8.5",
"express": "^5.1.0",
"ws": "^8.18.0",

10
package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector",
"version": "0.16.4",
"version": "0.16.5",
"description": "Model Context Protocol inspector",
"license": "MIT",
"author": "Anthropic, PBC (https://anthropic.com)",
@ -47,10 +47,10 @@
"check-version": "node scripts/check-version-consistency.js"
},
"dependencies": {
"@modelcontextprotocol/inspector-cli": "^0.16.4",
"@modelcontextprotocol/inspector-client": "^0.16.4",
"@modelcontextprotocol/inspector-server": "^0.16.4",
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/inspector-cli": "^0.16.5",
"@modelcontextprotocol/inspector-client": "^0.16.5",
"@modelcontextprotocol/inspector-server": "^0.16.5",
"@modelcontextprotocol/sdk": "^1.17.3",
"concurrently": "^9.2.0",
"open": "^10.2.0",
"shell-quote": "^1.8.3",

4
server/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector-server",
"version": "0.16.4",
"version": "0.16.5",
"description": "Server-side application for the Model Context Protocol inspector",
"license": "MIT",
"author": "Anthropic, PBC (https://anthropic.com)",
@ -27,7 +27,7 @@
"typescript": "^5.6.2"
},
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"cors": "^2.8.5",
"express": "^5.1.0",
"ws": "^8.18.0",