The `stdin: 'ignore'` option was not working because spawn-rx expects
an Observable for its stdin option, not a string. This caused tsx watch
and vite dev server to hang waiting for stdin on Windows.
Use Node's native `stdio: ['ignore', 'pipe', 'pipe']` option instead,
which spawn-rx passes through correctly to child_process.spawn.
Fixes#550
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add --transport and --server-url support to client/bin/start.js
- Pass transport configuration through server to client via /config endpoint
- Update client App.tsx to use defaultTransport and defaultServerUrl from server
- Ensure SSE and HTTP transport configs work properly from CLI
Move transport configuration parsing to cli.js as suggested in PR review. The CLI entry point (cli.js) should handle config file parsing and pass parameters to start.js.
When launching the inspector with --config, automatically set the transport
dropdown and server URL based on the config file contents. This eliminates
the need to manually switch between stdio/sse/streamable-http in the UI.
- Use discriminated union for ServerConfig to properly type different transports
- Detect transport type and URL from config, pass via query params
- Maintain backwards compatibility for configs without explicit 'type' field
- Add comprehensive tests for the new functionality
Improves UX by making the config file the single source of truth for
server settings.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
This fixes the regression introduced in dc5fa6a where empty strings
were passed as arguments when no command or args were provided,
causing parseArgs to fail with "Unexpected argument ''" error.
The spread operator approach is more idiomatic and avoids creating
empty strings that need to be filtered out.
The server was invoked as:
`server/build/index.js --command comm --args arg1 arg2 arg3`
(`arg1 arg2 arg3` is a string in ARGV; the single value of `--args`.)
`util:parseArgs()` cannot handle an argument value with a leading dash
with this usage.
e.g.,
`server/build/index.js --command npm --args --silent --prefix path/to/servers/src/everything run start`
The above will throw, and indicate correct usage:
```
TypeError [ERR_PARSE_ARGS_INVALID_OPTION_VALUE]: Option '--args' argument is ambiguous.
Did you forget to specify the option argument for '--args'?
To specify an option argument starting with a dash use '--args=-XYZ'.
```
However, since users do not control the invocation of the server, they
cannot adjust the notation for their use-case.
`arguments`, and `command`, are unknown user input, so adjust the
argument form to the more lenient and robust notation. Although a
`command` beginning with `-` seems unlikely, consistent handling of both
improves code clarity and simplicity.
Running the server directly (e.g., on the command line in development)
may continue to use: `--args arg1 arg2 arg3` if desired, so this is a
non-breaking change.
When running the inspector with command-line arguments (e.g.,
`npx @modelcontextprotocol/inspector node build/index.js arg1 arg2`),
the command and arguments were not being properly passed through to
the UI for pre-filling.
Changes:
- cli.ts now passes command and args to start.js
- start.js uses --command for the command and --args for arguments
- Server parses the new --command parameter
- /config endpoint returns correct values for UI pre-filling
This ensures the UI correctly displays the command and arguments
passed on the command line instead of showing old localStorage values.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace explicit property assignments with shorthand syntax when
property names match variable names (e.g., SERVER_PORT: SERVER_PORT
becomes just SERVER_PORT).
Simplifies the startup flow by consolidating browser opening
in the client script rather than the start script for prod.
We were duplicating a lot of logging, making it easy for
logs to go out of sync - this is a proposal to consolidate:
- server only logs info about itself
- client only logs info about itself
To reduce the number of places we print connection information
to the user.
Refactored startProdClient to match startDevClient's logging pattern,
ensuring consistent user feedback whether auto-open is enabled or disabled.
Also ensures that we log full information on how to open the browser
regardless of whether MCP_AUTO_OPEN_ENABLED=false.
Address PR feedback by restructuring getClientUrl to always include
MCP_PROXY_PORT parameter when using non-default port, regardless of
auth status. Also improved code clarity by using params.size check.
- Update client to read MCP_PROXY_PORT from URL parameters
- Update server to include port in displayed URL when non-default
- Update start scripts to pass SERVER_PORT to client
- Use DEFAULT_MCP_PROXY_LISTEN_PORT constant instead of magic numbers
This fixes the issue where the client couldn't connect to the proxy
when SERVER_PORT was set to a non-default value.
Per PR feedback from cliffhall:
- Changed PORT to SERVER_PORT in server/src/index.ts
- Changed PORT to CLIENT_PORT in client/bin/client.js
- Added parseInt() for CLIENT_PORT consistency
- Updated start.js to pass correct env var names
This improves clarity by using specific environment variables for
server and client ports instead of the generic PORT variable.
- Extract duplicated URL generation code into getClientUrl() helper function in start.js
- Replace all 127.0.0.1 references with localhost for consistency across codebase
- Update server to respect HOST environment variable for URL generation
- Remove 127.0.0.1 from default allowed origins in CORS configuration
- Update documentation to use localhost instead of 127.0.0.1
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete the security hardening started in e8e9909 by also binding the client to localhost only.
Previously only the server was protected while the client remained exposed to the network,
allowing attackers to access the server through the client as a proxy.
Changes:
- Add HOST environment variable support to client (prod mode)
- Configure Vite dev server to bind to localhost by default
- Update browser auto-open URLs to use actual host instead of hardcoded 127.0.0.1
- Fix missing cancelled parameter in startProdClient function
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Extracted 4 functions: startDevServer, startProdServer, startDevClient, startProdClient
- Eliminated deep nesting in main() function
- Each function has a single responsibility
- Main function now clearly shows the flow: parse args → start server → start client
- No functional changes, purely organizational refactoring
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Unified start.js to handle both dev and production modes with --dev flag
- Generate session token in parent process, pass via MCP_PROXY_TOKEN env var
- Enable browser auto-open even when authentication is enabled by including token in URL
- Auto-reloads now work seamlessly with persistent tokens across hot reloads
- Simplified npm scripts - dev and dev:windows now use the same unified script
- Better developer experience with consistent token handling
The token is generated once per session and remains stable through server/client
reloads, making development smoother while maintaining security.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Auto-open browser only works when DANGEROUSLY_OMIT_AUTH=true
- When auth is enabled (default), users must use the secure URL with token
- Server displays clear message that auto-open is disabled with auth
- Updates documentation to reflect this behavior
This improves UX by preventing the browser from opening without auth token,
forcing users to use the secure pre-filled URL instead.
* I've noticed that on a new version of the inspector, I have to go to the browser's devtools panel and clear site data then reload the page.
* The assets are hashed and immutable, so caching should be allowed for them
* The index.html file is the problem, because if cached, it will point to old assets, and therefore needs to have caching turned forf
* This PR adds appropriate headers to the index.html and assets that are served.
* Remove bin folder, leaving cli, server, and client
* This fixes#315
* In .gitignore,
- add .idea
- remove bin/build
* Remove bin and bin/cli.js
* Remove bin/scripts/copy-cli.js
* Refactor/move bin/scripts to cli/scripts
* Refactor/move bin/src/index.ts to cli/src/cli.ts
* Refactor/renamed client/bin/cli.js to client/bin/client.js
* In .github/workflows/main.yml,
- add run of cli tests
* In cli/pacakge.json
- change main and bin/mcp-inspector-cli properties to build/cli.js
* In client/package.json,
- change bin/mcp-inspector-client properties to build/start.js
* In pacakge.json
- change bin/mcp-inspector property to ./cli/build/cli.js
- removed bin and cli/bin from files list
- removed @modelcontextprotocol/inspector-bin dependency
- rearranged and corrected scripts
Changes the default ports used by the MCP Inspector client UI and the MCP Proxy server to avoid conflicts with common development ports and provide a memorable mnemonic based on T9 mapping.
* In bin/cli.js
- in the delay function, have the setTimeout return a true value.
- try the server's spawnPromise call and within the try block, use Promise.race to get the return value of the first promise to resolve. If the server is up, it will not resolve and the 2 second delay will resolve with true, telling us the server is ok. Any error will have been reported by the server startup process, so we will not pile on with more output in the catch block.
- If the server started ok, then we will await the spawnPromise call for starting the client. If the client fails to start it will report and exit, otherwise we are done and both servers are running and have reported as much. If an error is caught and it isn't SIGINT or if process.env.DEBUG is true then the error will be thrown before exiting.
* In client/bin/cli.js
- add a "listening" handler to the server, logging that the MCP inspector is up at the given port
- Add an "error" handler to the server that reports that the client port is in use if the error message includes "EADDRINUSE", otherwise throw the error so the entire contents can be seen.
* In server/src/index.ts
- add a "listening" handler to the server, logging that the Proxy server is up at the given port
- Add an "error" handler to the server that reports that the server port is in use if the error message includes "EADDRINUSE", otherwise throw the error so the entire contents can be seen.
* In package.json
- in preview script
- add --port 5173 to start the client on the proper port. This was useful in getting an instance of the client running before trying the start script. otherwise it starts on 4173
