diff --git a/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.test.tsx b/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.test.tsx
index 9f5c92ce..0c472f8a 100644
--- a/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.test.tsx
+++ b/clients/web/src/components/groups/ClientSettingsForm/ClientSettingsForm.test.tsx
@@ -312,6 +312,60 @@ describe("ClientSettingsForm EMA IdP session", () => {
     expect(screen.getByText(CIMD_METADATA_URL_HTTPS_ERROR)).toBeInTheDocument();
   });
 
+  it("tells the reader the loopback exemption exists, in both pieces of CIMD copy", () => {
+    renderWithMantine(
+      <ClientSettingsForm
+        settings={{
+          ...EMPTY_CLIENT_SETTINGS,
+          cimdEnabled: true,
+          clientMetadataUrl: "",
+        }}
+        expandedSections={["cimd"]}
+        onExpandedSectionsChange={vi.fn()}
+        onSettingsChange={vi.fn()}
+        emaIdpLoginState="none"
+      />,
+    );
+
+    // The copy is part of this feature's contract, not decoration: the whole
+    // point of #2305 is that a local fixture URL is enterable, and an
+    // HTTPS-only instruction here puts that back out of reach for a reader
+    // even while the validator stays permissive. Both places that state the
+    // requirement are asserted, since either one alone would still mislead.
+    const hint = screen.getByText(/must be served over HTTPS/);
+    expect(hint).toHaveTextContent("localhost, 127.0.0.1 or [::1]");
+
+    expect(
+      screen.getByText(/HTTPS URL of your OAuth client metadata JSON document/),
+    ).toHaveTextContent(
+      "http:// is accepted only on localhost, 127.0.0.1 or [::1]",
+    );
+  });
+
+  it("shows no CIMD URL error for a loopback http URL", () => {
+    renderWithMantine(
+      <ClientSettingsForm
+        settings={{
+          ...EMPTY_CLIENT_SETTINGS,
+          cimdEnabled: true,
+          clientMetadataUrl: "http://localhost:8092/client-metadata.json",
+        }}
+        expandedSections={["cimd"]}
+        onExpandedSectionsChange={vi.fn()}
+        onSettingsChange={vi.fn()}
+        emaIdpLoginState="none"
+        revealErrors
+      />,
+    );
+
+    expect(
+      screen.queryByText(CIMD_METADATA_URL_HTTPS_ERROR),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText(CIMD_METADATA_URL_INVALID_ERROR),
+    ).not.toBeInTheDocument();
+  });
+
   it("shows no CIMD URL error for a valid URL", () => {
     renderWithMantine(
       <ClientSettingsForm
diff --git a/docs/test-servers.md b/docs/test-servers.md
index 50fa455d..7ba592c9 100644
--- a/docs/test-servers.md
+++ b/docs/test-servers.md
@@ -572,11 +572,20 @@ actually listening on; a host outside those three — `localhost.` and `tenant.a
 even though both resolve to loopback — is still rejected, deliberately, so this allow-list and the
 SDK's cannot disagree about one URL.
 
-⚠️ **Before [#2305](https://github.com/modelcontextprotocol/inspector/issues/2305) there was no
-loopback exemption at all**, so driving this flow meant standing up a throwaway self-signed HTTPS
-listener to hold the document and setting `NODE_TLS_REJECT_UNAUTHORIZED=0` in the *test server's*
-environment so its own fetch of that document would succeed. That workaround is no longer needed — if
-you find it in a script or an older note, delete it.
+⚠️ **Before [#2305](https://github.com/modelcontextprotocol/inspector/issues/2305) the config and
+form validator had no loopback exemption** — the *runtime* already tolerated an `http://` URL as an
+already-stored `client_id`, which is precisely the asymmetry that issue is about; there was simply no
+way to get such a value past validation and into `client.json`. So driving this flow meant standing
+up a throwaway self-signed HTTPS listener to hold the document and setting
+`NODE_TLS_REJECT_UNAUTHORIZED=0` in the *test server's* environment so its own fetch of that document
+would succeed. That workaround is no longer needed — if you find it in a script or an older note,
+delete it.
+
+⚠️ **Use the canonical spelling of the host.** `http://127.1/…` and `http://2130706433/…` are accepted
+by the validator (and by the SDK) because both canonicalize to `127.0.0.1` — but a CIMD `client_id`
+is compared as a **string** by the authorization server against the URL it dereferenced, so an
+exotic spelling can fail that comparison on a server that normalizes differently than the one here.
+Paste the origin the fixture announced rather than an equivalent you typed yourself.
 
 ⚠️ **Clear OAuth state before the run if you have connected to this fixture before.** Tokens and the
 registered client persist in `~/.mcp-inspector/storage/oauth.json` independently of the install-wide