modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'upstream/main' into setup-prettier-precommit

Browse source
This commit is contained in:
olaservo 2025-08-18 08:45:53 -07:00
commit 610cbddd35
11 changed files with 54 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

10
README.md
View file

@ -166,6 +166,16 @@ If you need to disable authentication (NOT RECOMMENDED), you can set the `DANGER
DANGEROUSLY_OMIT_AUTH=true npm start
```
---
**🚨 WARNING 🚨**
Disabling authentication with `DANGEROUSLY_OMIT_AUTH` is incredibly dangerous! Disabling auth leaves your machine open to attack not just when exposed to the public internet, but also **via your web browser**. Meaning, visiting a malicious website OR viewing a malicious advertizement could allow an attacker to remotely compromise your computer. Do not disable this feature unless you truly understand the risks.
Read more about the risks of this vulnerability on Oligo's blog: [Critical RCE Vulnerability in Anthropic MCP Inspector - CVE-2025-49596](https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596)
---
You can also set the token via the `MCP_PROXY_AUTH_TOKEN` environment variable when starting the server:
```bash

4
cli/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector-cli",
"version": "0.16.4",
"version": "0.16.5",
"description": "CLI for the Model Context Protocol inspector",
"license": "MIT",
"author": "Anthropic, PBC (https://anthropic.com)",
@ -21,7 +21,7 @@
},
"devDependencies": {},
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"commander": "^13.1.0",
"spawn-rx": "^5.1.2"
}

2
cli/src/transport.ts
View file

@ -32,8 +32,8 @@ function createStdioTransport(options: TransportOptions): Transport {
const defaultEnv = getDefaultEnvironment();
const env: Record<string, string> = {
...processEnv,
...defaultEnv,
...processEnv,
};
const { cmd: actualCommand, args: actualArgs } = findActualExecutable(

4
client/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector-client",
"version": "0.16.4",
"version": "0.16.5",
"description": "Client-side application for the Model Context Protocol inspector",
"license": "MIT",
"author": "Anthropic, PBC (https://anthropic.com)",
@ -25,7 +25,7 @@
"cleanup:e2e": "node e2e/global-teardown.js"
},
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"@radix-ui/react-checkbox": "^1.1.4",
"@radix-ui/react-dialog": "^1.1.3",
"@radix-ui/react-icons": "^1.3.0",

8
client/src/lib/auth.ts
View file

@ -102,10 +102,15 @@ export const clearClientInformationFromSessionStorage = ({
};
export class InspectorOAuthClientProvider implements OAuthClientProvider {
constructor(protected serverUrl: string) {
constructor(
protected serverUrl: string,
scope?: string,
) {
this.scope = scope;
// Save the server URL to session storage
sessionStorage.setItem(SESSION_KEYS.SERVER_URL, serverUrl);
}
scope: string | undefined;
get redirectUrl() {
return window.location.origin + "/oauth/callback";
@ -119,6 +124,7 @@ export class InspectorOAuthClientProvider implements OAuthClientProvider {
response_types: ["code"],
client_name: "MCP Inspector",
client_uri: "https://github.com/modelcontextprotocol/inspector",
scope: this.scope ?? "",
};
}

6
client/src/lib/hooks/useConnection.ts
View file

@ -319,8 +319,6 @@ export function useConnection({
const handleAuthError = async (error: unknown) => {
if (is401Error(error)) {
const serverAuthProvider = new InspectorOAuthClientProvider(sseUrl);
let scope = oauthScope?.trim();
if (!scope) {
// Only discover resource metadata when we need to discover scopes
@ -334,6 +332,10 @@ export function useConnection({
}
scope = await discoverScopes(sseUrl, resourceMetadata);
}
const serverAuthProvider = new InspectorOAuthClientProvider(
sseUrl,
scope,
);
const result = await auth(serverAuthProvider, {
serverUrl: sseUrl,

6
client/src/lib/oauth-state-machine.ts
View file

@ -177,7 +177,11 @@ export const oauthTransitions: Record<OAuthStep, StateTransition> = {
authorizationCode: context.state.authorizationCode,
codeVerifier,
redirectUri: context.provider.redirectUrl,
resource: context.state.resource ?? undefined,
resource: context.state.resource
? context.state.resource instanceof URL
? context.state.resource
: new URL(context.state.resource)
: undefined,
});
context.provider.saveTokens(tokens);

30
package-lock.json generated
View file

@ -1,12 +1,12 @@
{
"name": "@modelcontextprotocol/inspector",
"version": "0.16.4",
"version": "0.16.5",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "@modelcontextprotocol/inspector",
"version": "0.16.4",
"version": "0.16.5",
"license": "MIT",
"workspaces": [
"client",
@ -14,10 +14,10 @@
"cli"
],
"dependencies": {
"@modelcontextprotocol/inspector-cli": "^0.16.4",
"@modelcontextprotocol/inspector-client": "^0.16.4",
"@modelcontextprotocol/inspector-server": "^0.16.4",
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/inspector-cli": "^0.16.5",
"@modelcontextprotocol/inspector-client": "^0.16.5",
"@modelcontextprotocol/inspector-server": "^0.16.5",
"@modelcontextprotocol/sdk": "^1.17.3",
"concurrently": "^9.2.0",
"open": "^10.2.0",
"shell-quote": "^1.8.3",
@ -46,10 +46,10 @@
},
"cli": {
"name": "@modelcontextprotocol/inspector-cli",
"version": "0.16.4",
"version": "0.16.5",
"license": "MIT",
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"commander": "^13.1.0",
"spawn-rx": "^5.1.2"
},
@ -69,10 +69,10 @@
},
"client": {
"name": "@modelcontextprotocol/inspector-client",
"version": "0.16.4",
"version": "0.16.5",
"license": "MIT",
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"@radix-ui/react-checkbox": "^1.1.4",
"@radix-ui/react-dialog": "^1.1.3",
"@radix-ui/react-icons": "^1.3.0",
@ -2001,9 +2001,9 @@
"link": true
},
"node_modules/@modelcontextprotocol/sdk": {
"version": "1.17.2",
"resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.17.2.tgz",
"integrity": "sha512-EFLRNXR/ixpXQWu6/3Cu30ndDFIFNaqUXcTqsGebujeMan9FzhAaFFswLRiFj61rgygDRr8WO1N+UijjgRxX9g==",
"version": "1.17.3",
"resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.17.3.tgz",
"integrity": "sha512-JPwUKWSsbzx+DLFznf/QZ32Qa+ptfbUlHhRLrBQBAFu9iI1iYvizM4p+zhhRDceSsPutXp4z+R/HPVphlIiclg==",
"license": "MIT",
"dependencies": {
"ajv": "^6.12.6",
@ -11657,10 +11657,10 @@
},
"server": {
"name": "@modelcontextprotocol/inspector-server",
"version": "0.16.4",
"version": "0.16.5",
"license": "MIT",
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"cors": "^2.8.5",
"express": "^5.1.0",
"ws": "^8.18.0",

10
package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector",
"version": "0.16.4",
"version": "0.16.5",
"description": "Model Context Protocol inspector",
"license": "MIT",
"author": "Anthropic, PBC (https://anthropic.com)",
@ -47,10 +47,10 @@
"check-version": "node scripts/check-version-consistency.js"
},
"dependencies": {
"@modelcontextprotocol/inspector-cli": "^0.16.4",
"@modelcontextprotocol/inspector-client": "^0.16.4",
"@modelcontextprotocol/inspector-server": "^0.16.4",
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/inspector-cli": "^0.16.5",
"@modelcontextprotocol/inspector-client": "^0.16.5",
"@modelcontextprotocol/inspector-server": "^0.16.5",
"@modelcontextprotocol/sdk": "^1.17.3",
"concurrently": "^9.2.0",
"open": "^10.2.0",
"shell-quote": "^1.8.3",

4
server/package.json
View file

@ -1,6 +1,6 @@
{
"name": "@modelcontextprotocol/inspector-server",
"version": "0.16.4",
"version": "0.16.5",
"description": "Server-side application for the Model Context Protocol inspector",
"license": "MIT",
"author": "Anthropic, PBC (https://anthropic.com)",
@ -27,7 +27,7 @@
"typescript": "^5.6.2"
},
"dependencies": {
"@modelcontextprotocol/sdk": "^1.17.2",
"@modelcontextprotocol/sdk": "^1.17.3",
"cors": "^2.8.5",
"express": "^5.1.0",
"ws": "^8.18.0",

2
server/src/index.ts
View file

@ -184,7 +184,7 @@ const createTransport = async (req: express.Request): Promise<Transport> => {
const command = query.command as string;
const origArgs = shellParseArgs(query.args as string) as string[];
const queryEnv = query.env ? JSON.parse(query.env as string) : {};
const env = { ...process.env, ...defaultEnvironment, ...queryEnv };
const env = { ...defaultEnvironment, ...process.env, ...queryEnv };
const { cmd, args } = findActualExecutable(command, origArgs);