0742f78357* docs: replace the markdown bug template with issue forms (#1844) Issues are the only intake channel now that external pull requests are off (#1820), so the chooser is where the contribution policy has to be stated — GitHub gives a would-be contributor no explanation when the "New pull request" button isn't there. The one existing template was a legacy **markdown** template, whose fields are prose headings a reporter can delete or ignore. Most reports still arrive missing the client and the transport, which are the two facts that decide where to look. Issue forms enforce them: this replaces `bug_report.md` with `1-bug_report.yml`, where client (web/cli/tui/core), version line (v1/v2), Inspector version, Node version, transport, MCP server, repro, expected, and actual are all `validations.required`. It auto-labels `bug`, and its intro says maintainers implement the fix, so a prompt plus screenshots beats a diff — with a field for exactly that. Adds `2-feature_request.yml` (auto-labels `enhancement`), which puts the problem statement first and marks the solution optional, since the problem is what survives when a specific solution turns out not to fit. Neither form applies a `v1`/`v2` label: GitHub can't map a form answer to a label, so the version line is a required dropdown and a maintainer still labels at triage. v1 takes security fixes only, so routing that answer early is the point. `config.yml` disables blank issues and carries the contact links. **There is deliberately no security *template*** — a template still opens a public issue, which is precisely what a vulnerability report must not do. The redirect is a contact link straight to the private advisory form (`/security/advisories/new`, verified enabled on this repo) plus one to `SECURITY.md`, which covers the v1 line too. The remaining links deflect the recurring misfiled classes: the specification repo and the TypeScript SDK for reports that aren't about this tool, the docs site, the contribution policy, and `#inspector-dev`. Also fixes three links the #1884 rename left dangling — `SECURITY.md` and the PR template still pointed at `CONTRIBUTORS.md`, which no longer exists on this branch. A policy nobody can open is the same as no policy. Validated against GitHub's issue-forms schema (unique ids, allowed `type`s, `markdown` blocks carrying no `id`/`validations`, `checkboxes` marking `required` per option rather than under `validations`). Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: address Copilot review on the issue forms (#1844) - PR template said `v2` targets `main`; the v2 base branch is `v2/main`. Correct on its face, and the one line in that template a reader acts on. - Scoped the Node floor on the bug form to v2, since the form serves both lines and v1's floor is older — reading `>= 22.19.0` as universal would make a legitimate v1 report look out of support. - Both the CONTRIBUTING.md paragraph and the AGENTS.md section now say the chooser is served from the **default branch**, so neither claims a form added on `v2/main` is live before the milestone merge. * docs: re-wrap the CONTRIBUTING chooser paragraph (#1844) Round-2 Copilot nit: the previous wrap left a dangling "The" at end of line, splitting a phrase mid-sentence in the raw markdown. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: clarify the protocol-era prompt on the bug form (#1844) Round-3 Copilot nit. "the protocol era (legacy / modern) if you selected one" reads as referring to a field on this form, which has none — the era is selected on the *connection*, in the Inspector's server settings. Reworded to "the protocol era you connected with (auto / legacy / modern)", which also picks up `auto`, the default the previous list omitted. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: stop describing the feature form as sharing the bug form's fields (#1844) Round-4 Copilot nits, and it was right three times over — I had described "client, version line, transport" as the required set for *both* forms in CONTRIBUTING.md, AGENTS.md, and the config.yml header. The feature form has neither a version-line dropdown nor a transport field, and cannot have the first: v1 takes security fixes only, so a feature request is v2 by construction. Each of the three now distinguishes the two forms rather than generalizing from the bug form. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: declare v2 statically on the feature form (#1844) Round-5 Copilot nit caught a real contradiction: the AGENTS.md paragraph said no form can apply a version label, then asserted the feature form "is always labeled v2". Both halves can't be true. Resolved in the direction that makes the claim true rather than softer. A form's `labels:` is static, which is only an obstacle when the value depends on a reporter's answer — and for the feature form it doesn't: v1 takes security fixes only, so a feature request is v2 by construction. So it now declares `["enhancement", "v2"]` outright, which also satisfies AGENTS.md's label-at-create-time rule without a triage step. The bug form still can't, and shouldn't: its version line is genuinely the reporter's to answer. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
57 lines
2.7 KiB
YAML
57 lines
2.7 KiB
YAML
# Issue chooser configuration.
|
|
#
|
|
# Blank issues are disabled so every report lands in a form. The bug form
|
|
# requires the facts triage needs first (client, version line, transport); the
|
|
# feature form requires the client and a problem statement, and is v2-only.
|
|
#
|
|
# Security reports are deliberately a *contact link* rather than a template:
|
|
# a template would still open a public issue, which is exactly what a
|
|
# vulnerability report must not do. These links leave GitHub's issue flow and
|
|
# go straight to the private advisory form. See SECURITY.md.
|
|
blank_issues_enabled: false
|
|
contact_links:
|
|
- name: 🔒 Security vulnerability (v1 or v2) — report privately
|
|
url: https://github.com/modelcontextprotocol/inspector/security/advisories/new
|
|
about: >
|
|
Never report a vulnerability in a public issue. Private vulnerability
|
|
reporting is enabled on this repository — this link opens the advisory
|
|
form, which is the fastest route to a maintainer. v1 is deprecated and
|
|
takes security fixes only, so this is the channel for a v1 security
|
|
issue.
|
|
|
|
- name: 📜 Security policy (supported versions, what to include)
|
|
url: https://github.com/modelcontextprotocol/inspector/blob/main/SECURITY.md
|
|
about: >
|
|
Which versions are supported, how reports are handled, and what to
|
|
include in one.
|
|
|
|
- name: 🤝 Contribution policy — why there is no "New pull request"
|
|
url: https://github.com/modelcontextprotocol/inspector/blob/main/CONTRIBUTING.md
|
|
about: >
|
|
This repository accepts issues, not pull requests — maintainers do the
|
|
implementation. If you already built a change locally, open an issue and
|
|
share the prompt you used rather than a diff.
|
|
|
|
- name: 📖 MCP documentation
|
|
url: https://modelcontextprotocol.io
|
|
about: >
|
|
Guides and reference for the Model Context Protocol itself. Start here
|
|
for "how does MCP work" questions.
|
|
|
|
- name: 📐 MCP specification — protocol questions and proposals
|
|
url: https://github.com/modelcontextprotocol/modelcontextprotocol/issues
|
|
about: >
|
|
If the behavior you're reporting is defined by the protocol rather than
|
|
by this tool, file it against the specification repository instead.
|
|
|
|
- name: 🧰 MCP TypeScript SDK
|
|
url: https://github.com/modelcontextprotocol/typescript-sdk/issues
|
|
about: >
|
|
The Inspector is built on the TypeScript SDK. If the bug reproduces
|
|
against the SDK directly (outside the Inspector), file it there.
|
|
|
|
- name: 💬 MCP Contributor Discord (#inspector-dev)
|
|
url: https://discord.gg/6CSzBmMkjX
|
|
about: >
|
|
Questions, usage help, and day-to-day Inspector development discussion.
|
|
Also where to say hello if you'd like to work on the Inspector with us.
|