* chore: v1 deprecation notices in all four packages, bump to 1.0.1
Phase 2 of the v2 go-live runbook (#1804 §4). v1 publishes four separately
installable names, so each gets its own notice — a root-README-only change is
invisible to anyone who installed a sub-package. `cli/` and `server/` ship no
README at all, so for those two the runtime banner plus the forthcoming
`npm deprecate` (#1816) are the only notice their users ever get.
Notices, all using identical wording so the runtime banner and the npm warning
agree:
- root `README.md` and `client/README.md`
- `cli/src/cli.ts` — stderr banner in `main()`. Also covers the root
`mcp-inspector` bin, which is `cli/build/cli.js`. Deliberately **stderr**:
`--cli` mode emits JSON on stdout and callers pipe it, so a banner there
would corrupt output. Verified against a real server — stdout stays
parseable JSON while the banner goes to stderr.
- `server/src/index.ts` — alongside the existing proxy listening log
- `client/bin/start.js` — alongside the existing startup URL log
- `client/src/components/DeprecationBanner.tsx` — dismissible in-app banner,
dismissal persisted in localStorage with both read and write guarded so a
storage failure degrades to "banner reappears" rather than breaking the app
AGENTS.md is replaced with a hard stop: v1 takes security fixes only, by issue
only, and agents must never open a PR against v1/main.
Version bumped to 1.0.1 across all four package.json files plus the lockfile
(`npm run update-version`); `check-version` passes. The lockfile diff is
restricted to the version fields — the `libc` churn a newer npm wanted to
introduce was reverted as unrelated.
`publish-all` is deliberately NOT changed here: 1.0.1 must take `latest`, which
is the entire point of shipping this notice to npx users. Adding `--tag v1` is
#1816, immediately after this publishes.
Note for review: `client/src/App.tsx` shows ~836 changed lines but `git diff -w`
shows 8 — wrapping the layout in a flex column added one nesting level and
prettier re-indented the subtree. Review it with `-w`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
* docs: replace the README screenshot with one showing the deprecation banner
Captured from this branch's build: v1.0.1 in the sidebar heading, the
dismissible deprecation banner across the top, connected to the everything
server with tools listed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
* docs: pin the README screenshot to v1/main instead of main
The image URL must stay absolute — a relative path breaks on the npm package
page, which renders the README outside any repo context. But it was pinned to
`main`, so the v1 README rendered whatever `main` happened to hold: today the
pre-deprecation screenshot, and after the v2 tree swap (#1817) either the v2
screenshot or a 404 if that path doesn't exist there.
Pinning to `v1/main` keeps it absolute for npm, shows the deprecation banner
once this merges, and survives the swap. Verified all candidate refs resolve
200 — GitHub disambiguates the slash in `v1/main` as the ref without needing a
`refs/heads/` prefix.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The `stdin: 'ignore'` option was not working because spawn-rx expects
an Observable for its stdin option, not a string. This caused tsx watch
and vite dev server to hang waiting for stdin on Windows.
Use Node's native `stdio: ['ignore', 'pipe', 'pipe']` option instead,
which spawn-rx passes through correctly to child_process.spawn.
Fixes#550
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
- Add --transport and --server-url support to client/bin/start.js
- Pass transport configuration through server to client via /config endpoint
- Update client App.tsx to use defaultTransport and defaultServerUrl from server
- Ensure SSE and HTTP transport configs work properly from CLI
Move transport configuration parsing to cli.js as suggested in PR review. The CLI entry point (cli.js) should handle config file parsing and pass parameters to start.js.
When launching the inspector with --config, automatically set the transport
dropdown and server URL based on the config file contents. This eliminates
the need to manually switch between stdio/sse/streamable-http in the UI.
- Use discriminated union for ServerConfig to properly type different transports
- Detect transport type and URL from config, pass via query params
- Maintain backwards compatibility for configs without explicit 'type' field
- Add comprehensive tests for the new functionality
Improves UX by making the config file the single source of truth for
server settings.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
This fixes the regression introduced in dc5fa6a where empty strings
were passed as arguments when no command or args were provided,
causing parseArgs to fail with "Unexpected argument ''" error.
The spread operator approach is more idiomatic and avoids creating
empty strings that need to be filtered out.
The server was invoked as:
`server/build/index.js --command comm --args arg1 arg2 arg3`
(`arg1 arg2 arg3` is a string in ARGV; the single value of `--args`.)
`util:parseArgs()` cannot handle an argument value with a leading dash
with this usage.
e.g.,
`server/build/index.js --command npm --args --silent --prefix path/to/servers/src/everything run start`
The above will throw, and indicate correct usage:
```
TypeError [ERR_PARSE_ARGS_INVALID_OPTION_VALUE]: Option '--args' argument is ambiguous.
Did you forget to specify the option argument for '--args'?
To specify an option argument starting with a dash use '--args=-XYZ'.
```
However, since users do not control the invocation of the server, they
cannot adjust the notation for their use-case.
`arguments`, and `command`, are unknown user input, so adjust the
argument form to the more lenient and robust notation. Although a
`command` beginning with `-` seems unlikely, consistent handling of both
improves code clarity and simplicity.
Running the server directly (e.g., on the command line in development)
may continue to use: `--args arg1 arg2 arg3` if desired, so this is a
non-breaking change.
When running the inspector with command-line arguments (e.g.,
`npx @modelcontextprotocol/inspector node build/index.js arg1 arg2`),
the command and arguments were not being properly passed through to
the UI for pre-filling.
Changes:
- cli.ts now passes command and args to start.js
- start.js uses --command for the command and --args for arguments
- Server parses the new --command parameter
- /config endpoint returns correct values for UI pre-filling
This ensures the UI correctly displays the command and arguments
passed on the command line instead of showing old localStorage values.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Replace explicit property assignments with shorthand syntax when
property names match variable names (e.g., SERVER_PORT: SERVER_PORT
becomes just SERVER_PORT).
Simplifies the startup flow by consolidating browser opening
in the client script rather than the start script for prod.
We were duplicating a lot of logging, making it easy for
logs to go out of sync - this is a proposal to consolidate:
- server only logs info about itself
- client only logs info about itself
To reduce the number of places we print connection information
to the user.
Refactored startProdClient to match startDevClient's logging pattern,
ensuring consistent user feedback whether auto-open is enabled or disabled.
Also ensures that we log full information on how to open the browser
regardless of whether MCP_AUTO_OPEN_ENABLED=false.
Address PR feedback by restructuring getClientUrl to always include
MCP_PROXY_PORT parameter when using non-default port, regardless of
auth status. Also improved code clarity by using params.size check.
- Update client to read MCP_PROXY_PORT from URL parameters
- Update server to include port in displayed URL when non-default
- Update start scripts to pass SERVER_PORT to client
- Use DEFAULT_MCP_PROXY_LISTEN_PORT constant instead of magic numbers
This fixes the issue where the client couldn't connect to the proxy
when SERVER_PORT was set to a non-default value.
Per PR feedback from cliffhall:
- Changed PORT to SERVER_PORT in server/src/index.ts
- Changed PORT to CLIENT_PORT in client/bin/client.js
- Added parseInt() for CLIENT_PORT consistency
- Updated start.js to pass correct env var names
This improves clarity by using specific environment variables for
server and client ports instead of the generic PORT variable.
- Extract duplicated URL generation code into getClientUrl() helper function in start.js
- Replace all 127.0.0.1 references with localhost for consistency across codebase
- Update server to respect HOST environment variable for URL generation
- Remove 127.0.0.1 from default allowed origins in CORS configuration
- Update documentation to use localhost instead of 127.0.0.1
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Complete the security hardening started in e8e9909 by also binding the client to localhost only.
Previously only the server was protected while the client remained exposed to the network,
allowing attackers to access the server through the client as a proxy.
Changes:
- Add HOST environment variable support to client (prod mode)
- Configure Vite dev server to bind to localhost by default
- Update browser auto-open URLs to use actual host instead of hardcoded 127.0.0.1
- Fix missing cancelled parameter in startProdClient function
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Extracted 4 functions: startDevServer, startProdServer, startDevClient, startProdClient
- Eliminated deep nesting in main() function
- Each function has a single responsibility
- Main function now clearly shows the flow: parse args → start server → start client
- No functional changes, purely organizational refactoring
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Unified start.js to handle both dev and production modes with --dev flag
- Generate session token in parent process, pass via MCP_PROXY_TOKEN env var
- Enable browser auto-open even when authentication is enabled by including token in URL
- Auto-reloads now work seamlessly with persistent tokens across hot reloads
- Simplified npm scripts - dev and dev:windows now use the same unified script
- Better developer experience with consistent token handling
The token is generated once per session and remains stable through server/client
reloads, making development smoother while maintaining security.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Auto-open browser only works when DANGEROUSLY_OMIT_AUTH=true
- When auth is enabled (default), users must use the secure URL with token
- Server displays clear message that auto-open is disabled with auth
- Updates documentation to reflect this behavior
This improves UX by preventing the browser from opening without auth token,
forcing users to use the secure pre-filled URL instead.
* I've noticed that on a new version of the inspector, I have to go to the browser's devtools panel and clear site data then reload the page.
* The assets are hashed and immutable, so caching should be allowed for them
* The index.html file is the problem, because if cached, it will point to old assets, and therefore needs to have caching turned forf
* This PR adds appropriate headers to the index.html and assets that are served.
* Remove bin folder, leaving cli, server, and client
* This fixes#315
* In .gitignore,
- add .idea
- remove bin/build
* Remove bin and bin/cli.js
* Remove bin/scripts/copy-cli.js
* Refactor/move bin/scripts to cli/scripts
* Refactor/move bin/src/index.ts to cli/src/cli.ts
* Refactor/renamed client/bin/cli.js to client/bin/client.js
* In .github/workflows/main.yml,
- add run of cli tests
* In cli/pacakge.json
- change main and bin/mcp-inspector-cli properties to build/cli.js
* In client/package.json,
- change bin/mcp-inspector-client properties to build/start.js
* In pacakge.json
- change bin/mcp-inspector property to ./cli/build/cli.js
- removed bin and cli/bin from files list
- removed @modelcontextprotocol/inspector-bin dependency
- rearranged and corrected scripts
Changes the default ports used by the MCP Inspector client UI and the MCP Proxy server to avoid conflicts with common development ports and provide a memorable mnemonic based on T9 mapping.
* In bin/cli.js
- in the delay function, have the setTimeout return a true value.
- try the server's spawnPromise call and within the try block, use Promise.race to get the return value of the first promise to resolve. If the server is up, it will not resolve and the 2 second delay will resolve with true, telling us the server is ok. Any error will have been reported by the server startup process, so we will not pile on with more output in the catch block.
- If the server started ok, then we will await the spawnPromise call for starting the client. If the client fails to start it will report and exit, otherwise we are done and both servers are running and have reported as much. If an error is caught and it isn't SIGINT or if process.env.DEBUG is true then the error will be thrown before exiting.
* In client/bin/cli.js
- add a "listening" handler to the server, logging that the MCP inspector is up at the given port
- Add an "error" handler to the server that reports that the client port is in use if the error message includes "EADDRINUSE", otherwise throw the error so the entire contents can be seen.
* In server/src/index.ts
- add a "listening" handler to the server, logging that the Proxy server is up at the given port
- Add an "error" handler to the server that reports that the server port is in use if the error message includes "EADDRINUSE", otherwise throw the error so the entire contents can be seen.
* In package.json
- in preview script
- add --port 5173 to start the client on the proper port. This was useful in getting an instance of the client running before trying the start script. otherwise it starts on 4173
