From 9dbd17343cdeef02fbc2c6f1cadb8c26f165755e Mon Sep 17 00:00:00 2001
From: Felix Weinberger <fweinberger@anthropic.com>
Date: Tue, 10 Jun 2025 16:12:52 +0100
Subject: [PATCH] feat: disable auto-open when authentication is enabled

- Auto-open browser only works when DANGEROUSLY_OMIT_AUTH=true
- When auth is enabled (default), users must use the secure URL with token
- Server displays clear message that auto-open is disabled with auth
- Updates documentation to reflect this behavior

This improves UX by preventing the browser from opening without auth token,
forcing users to use the secure pre-filled URL instead.
---
 README.md           | 6 +++---
 client/bin/start.js | 4 +++-
 server/src/index.ts | 2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 122e86de..ae82a695 100644
--- a/README.md
+++ b/README.md
@@ -148,11 +148,11 @@ The MCP Inspector proxy server requires authentication by default. When starting
    http://localhost:6274/?MCP_PROXY_AUTH_TOKEN=3a1c267fad21f7150b7d624c160b7f09b0b8c4f623c7107bbf13378f051538d4
 ```
 
-This token must be included as a Bearer token in the Authorization header for all requests to the server. 
+This token must be included as a Bearer token in the Authorization header for all requests to the server. When authentication is enabled, auto-open is disabled by default to ensure you use the secure URL.
 
-**Option 1: Use the pre-filled URL** - Click the link shown in the console to open the inspector with the token already configured.
+**Recommended: Use the pre-filled URL** - Click or copy the link shown in the console to open the inspector with the token already configured.
 
-**Option 2: Manual configuration** - If you already have the inspector open:
+**Alternative: Manual configuration** - If you already have the inspector open:
 
 1. Click the "Configuration" button in the sidebar
 2. Find "Proxy Session Token" and enter the token displayed in the proxy console
diff --git a/client/bin/start.js b/client/bin/start.js
index 8e383b38..ccce7ade 100755
--- a/client/bin/start.js
+++ b/client/bin/start.js
@@ -100,7 +100,9 @@ async function main() {
 
   if (serverOk) {
     try {
-      if (process.env.MCP_AUTO_OPEN_ENABLED !== "false") {
+      // Only auto-open when auth is disabled
+      const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
+      if (process.env.MCP_AUTO_OPEN_ENABLED !== "false" && authDisabled) {
         open(`http://127.0.0.1:${CLIENT_PORT}`);
       }
       await spawnPromise("node", [inspectorClientPath], {
diff --git a/server/src/index.ts b/server/src/index.ts
index 5b3b0c50..c82227ac 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -470,7 +470,7 @@ server.on("listening", () => {
     // Display clickable URL with pre-filled token
     const clientPort = process.env.CLIENT_PORT || '6274';
     const clientUrl = `http://localhost:${clientPort}/?MCP_PROXY_AUTH_TOKEN=${sessionToken}`;
-    console.log(`\n🔗 Open inspector with token pre-filled:\n   ${clientUrl}`);
+    console.log(`\n🔗 Open inspector with token pre-filled:\n   ${clientUrl}\n   (Auto-open is disabled when authentication is enabled)\n`);
   } else {
     console.log(`⚠️  WARNING: Authentication is disabled. This is not recommended.`);
   }