0742f78357* docs: replace the markdown bug template with issue forms (#1844) Issues are the only intake channel now that external pull requests are off (#1820), so the chooser is where the contribution policy has to be stated — GitHub gives a would-be contributor no explanation when the "New pull request" button isn't there. The one existing template was a legacy **markdown** template, whose fields are prose headings a reporter can delete or ignore. Most reports still arrive missing the client and the transport, which are the two facts that decide where to look. Issue forms enforce them: this replaces `bug_report.md` with `1-bug_report.yml`, where client (web/cli/tui/core), version line (v1/v2), Inspector version, Node version, transport, MCP server, repro, expected, and actual are all `validations.required`. It auto-labels `bug`, and its intro says maintainers implement the fix, so a prompt plus screenshots beats a diff — with a field for exactly that. Adds `2-feature_request.yml` (auto-labels `enhancement`), which puts the problem statement first and marks the solution optional, since the problem is what survives when a specific solution turns out not to fit. Neither form applies a `v1`/`v2` label: GitHub can't map a form answer to a label, so the version line is a required dropdown and a maintainer still labels at triage. v1 takes security fixes only, so routing that answer early is the point. `config.yml` disables blank issues and carries the contact links. **There is deliberately no security *template*** — a template still opens a public issue, which is precisely what a vulnerability report must not do. The redirect is a contact link straight to the private advisory form (`/security/advisories/new`, verified enabled on this repo) plus one to `SECURITY.md`, which covers the v1 line too. The remaining links deflect the recurring misfiled classes: the specification repo and the TypeScript SDK for reports that aren't about this tool, the docs site, the contribution policy, and `#inspector-dev`. Also fixes three links the #1884 rename left dangling — `SECURITY.md` and the PR template still pointed at `CONTRIBUTORS.md`, which no longer exists on this branch. A policy nobody can open is the same as no policy. Validated against GitHub's issue-forms schema (unique ids, allowed `type`s, `markdown` blocks carrying no `id`/`validations`, `checkboxes` marking `required` per option rather than under `validations`). Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: address Copilot review on the issue forms (#1844) - PR template said `v2` targets `main`; the v2 base branch is `v2/main`. Correct on its face, and the one line in that template a reader acts on. - Scoped the Node floor on the bug form to v2, since the form serves both lines and v1's floor is older — reading `>= 22.19.0` as universal would make a legitimate v1 report look out of support. - Both the CONTRIBUTING.md paragraph and the AGENTS.md section now say the chooser is served from the **default branch**, so neither claims a form added on `v2/main` is live before the milestone merge. * docs: re-wrap the CONTRIBUTING chooser paragraph (#1844) Round-2 Copilot nit: the previous wrap left a dangling "The" at end of line, splitting a phrase mid-sentence in the raw markdown. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: clarify the protocol-era prompt on the bug form (#1844) Round-3 Copilot nit. "the protocol era (legacy / modern) if you selected one" reads as referring to a field on this form, which has none — the era is selected on the *connection*, in the Inspector's server settings. Reworded to "the protocol era you connected with (auto / legacy / modern)", which also picks up `auto`, the default the previous list omitted. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: stop describing the feature form as sharing the bug form's fields (#1844) Round-4 Copilot nits, and it was right three times over — I had described "client, version line, transport" as the required set for *both* forms in CONTRIBUTING.md, AGENTS.md, and the config.yml header. The feature form has neither a version-line dropdown nor a transport field, and cannot have the first: v1 takes security fixes only, so a feature request is v2 by construction. Each of the three now distinguishes the two forms rather than generalizing from the bug form. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: declare v2 statically on the feature form (#1844) Round-5 Copilot nit caught a real contradiction: the AGENTS.md paragraph said no form can apply a version label, then asserted the feature form "is always labeled v2". Both halves can't be true. Resolved in the direction that makes the claim true rather than softer. A form's `labels:` is static, which is only an obstacle when the value depends on a reporter's answer — and for the feature form it doesn't: v1 takes security fixes only, so a feature request is v2 by construction. So it now declares `["enhancement", "v2"]` outright, which also satisfies AGENTS.md's label-at-create-time rule without a triage step. The bug form still can't, and shouldn't: its version line is genuinely the reporter's to answer. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
163 lines
5 KiB
YAML
163 lines
5 KiB
YAML
name: Bug report
|
|
description: Report something broken in the Inspector (web, CLI, or TUI)
|
|
labels: ["bug"]
|
|
body:
|
|
- type: markdown
|
|
attributes:
|
|
value: |
|
|
Thanks for reporting a bug — **issues are how work reaches the Inspector.**
|
|
|
|
This repository accepts **issues, not pull requests**: design and
|
|
implementation are done by the maintainers through a prompt-driven
|
|
workflow ([`CONTRIBUTING.md`](https://github.com/modelcontextprotocol/inspector/blob/main/CONTRIBUTING.md)).
|
|
So if you have already prototyped a fix locally, **the prompt you used
|
|
plus screenshots is worth more to us than a diff** — there is a field
|
|
for it at the bottom of this form.
|
|
|
|
> 🔒 **Do not report security vulnerabilities here.** Use the
|
|
> [private advisory process](https://github.com/modelcontextprotocol/inspector/security/advisories/new)
|
|
> instead — see [`SECURITY.md`](https://github.com/modelcontextprotocol/inspector/blob/main/SECURITY.md).
|
|
|
|
- type: dropdown
|
|
id: version-line
|
|
attributes:
|
|
label: Which version line?
|
|
description: >
|
|
v2 is the current Inspector. v1 is deprecated and takes **security
|
|
fixes only**, so a v1 bug report gets a different answer. When in
|
|
doubt, it's v2.
|
|
options:
|
|
- v2 — current (`@modelcontextprotocol/inspector@latest`)
|
|
- v1 — deprecated (`@v1-latest`, security fixes only)
|
|
validations:
|
|
required: true
|
|
|
|
- type: dropdown
|
|
id: client
|
|
attributes:
|
|
label: Which client?
|
|
description: The Inspector ships three clients from one package.
|
|
options:
|
|
- Web
|
|
- CLI
|
|
- TUI
|
|
- All / shared core
|
|
validations:
|
|
required: true
|
|
|
|
- type: input
|
|
id: inspector-version
|
|
attributes:
|
|
label: Inspector version
|
|
description: The version you actually ran, not "latest".
|
|
placeholder: "2.0.0"
|
|
validations:
|
|
required: true
|
|
|
|
- type: input
|
|
id: node-version
|
|
attributes:
|
|
label: Node version
|
|
description: >
|
|
Output of `node --version`. The current v2 line requires Node >=
|
|
22.19.0; the deprecated v1 line has its own, older floor.
|
|
placeholder: "v22.19.0"
|
|
validations:
|
|
required: true
|
|
|
|
- type: input
|
|
id: os
|
|
attributes:
|
|
label: Operating system (and browser, for the web client)
|
|
placeholder: "macOS 15.5, Chrome 140"
|
|
validations:
|
|
required: false
|
|
|
|
- type: dropdown
|
|
id: transport
|
|
attributes:
|
|
label: Transport
|
|
description: How the Inspector was connected to the MCP server under inspection.
|
|
options:
|
|
- stdio
|
|
- Streamable HTTP
|
|
- SSE (legacy)
|
|
- Not applicable / never connected
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: mcp-server
|
|
attributes:
|
|
label: MCP server under inspection
|
|
description: >
|
|
Which server, and how it is configured — the command or URL, the
|
|
protocol era you connected with (auto / legacy / modern), and whether
|
|
OAuth is involved. Redact tokens and secrets.
|
|
placeholder: |
|
|
Server: @modelcontextprotocol/server-everything (npx)
|
|
Protocol era: modern
|
|
OAuth: no
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: repro
|
|
attributes:
|
|
label: Steps to reproduce
|
|
description: Numbered steps, starting from a fresh launch of the Inspector.
|
|
placeholder: |
|
|
1. Run `npx @modelcontextprotocol/inspector`
|
|
2. Add the server above and connect
|
|
3. Open the Tools tab and call `echo`
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: expected
|
|
attributes:
|
|
label: Expected behavior
|
|
description: What you expected to happen.
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: actual
|
|
attributes:
|
|
label: Actual behavior
|
|
description: What happened instead.
|
|
validations:
|
|
required: true
|
|
|
|
- type: textarea
|
|
id: logs
|
|
attributes:
|
|
label: Logs, errors, or screenshots
|
|
description: >
|
|
Console output, the Inspector's Protocol or Network tab, or a
|
|
screenshot. Redact tokens and secrets first. Screenshots can be pasted
|
|
directly into this field.
|
|
validations:
|
|
required: false
|
|
|
|
- type: textarea
|
|
id: prompt
|
|
attributes:
|
|
label: Already prototyped a fix?
|
|
description: >
|
|
Please don't attach a diff or open a pull request — share the **exact
|
|
prompt(s)** you used to produce the change, plus what you verified and
|
|
any before/after screenshots. We reproduce it through our own workflow
|
|
so it lands with the right conventions, tests, and coverage.
|
|
validations:
|
|
required: false
|
|
|
|
- type: checkboxes
|
|
id: acknowledgements
|
|
attributes:
|
|
label: Before you submit
|
|
options:
|
|
- label: I searched existing issues and this is not a duplicate.
|
|
required: true
|
|
- label: This is not a security vulnerability report (those go through the private advisory process).
|
|
required: true
|