0742f78357* docs: replace the markdown bug template with issue forms (#1844) Issues are the only intake channel now that external pull requests are off (#1820), so the chooser is where the contribution policy has to be stated — GitHub gives a would-be contributor no explanation when the "New pull request" button isn't there. The one existing template was a legacy **markdown** template, whose fields are prose headings a reporter can delete or ignore. Most reports still arrive missing the client and the transport, which are the two facts that decide where to look. Issue forms enforce them: this replaces `bug_report.md` with `1-bug_report.yml`, where client (web/cli/tui/core), version line (v1/v2), Inspector version, Node version, transport, MCP server, repro, expected, and actual are all `validations.required`. It auto-labels `bug`, and its intro says maintainers implement the fix, so a prompt plus screenshots beats a diff — with a field for exactly that. Adds `2-feature_request.yml` (auto-labels `enhancement`), which puts the problem statement first and marks the solution optional, since the problem is what survives when a specific solution turns out not to fit. Neither form applies a `v1`/`v2` label: GitHub can't map a form answer to a label, so the version line is a required dropdown and a maintainer still labels at triage. v1 takes security fixes only, so routing that answer early is the point. `config.yml` disables blank issues and carries the contact links. **There is deliberately no security *template*** — a template still opens a public issue, which is precisely what a vulnerability report must not do. The redirect is a contact link straight to the private advisory form (`/security/advisories/new`, verified enabled on this repo) plus one to `SECURITY.md`, which covers the v1 line too. The remaining links deflect the recurring misfiled classes: the specification repo and the TypeScript SDK for reports that aren't about this tool, the docs site, the contribution policy, and `#inspector-dev`. Also fixes three links the #1884 rename left dangling — `SECURITY.md` and the PR template still pointed at `CONTRIBUTORS.md`, which no longer exists on this branch. A policy nobody can open is the same as no policy. Validated against GitHub's issue-forms schema (unique ids, allowed `type`s, `markdown` blocks carrying no `id`/`validations`, `checkboxes` marking `required` per option rather than under `validations`). Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: address Copilot review on the issue forms (#1844) - PR template said `v2` targets `main`; the v2 base branch is `v2/main`. Correct on its face, and the one line in that template a reader acts on. - Scoped the Node floor on the bug form to v2, since the form serves both lines and v1's floor is older — reading `>= 22.19.0` as universal would make a legitimate v1 report look out of support. - Both the CONTRIBUTING.md paragraph and the AGENTS.md section now say the chooser is served from the **default branch**, so neither claims a form added on `v2/main` is live before the milestone merge. * docs: re-wrap the CONTRIBUTING chooser paragraph (#1844) Round-2 Copilot nit: the previous wrap left a dangling "The" at end of line, splitting a phrase mid-sentence in the raw markdown. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: clarify the protocol-era prompt on the bug form (#1844) Round-3 Copilot nit. "the protocol era (legacy / modern) if you selected one" reads as referring to a field on this form, which has none — the era is selected on the *connection*, in the Inspector's server settings. Reworded to "the protocol era you connected with (auto / legacy / modern)", which also picks up `auto`, the default the previous list omitted. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs: stop describing the feature form as sharing the bug form's fields (#1844) Round-4 Copilot nits, and it was right three times over — I had described "client, version line, transport" as the required set for *both* forms in CONTRIBUTING.md, AGENTS.md, and the config.yml header. The feature form has neither a version-line dropdown nor a transport field, and cannot have the first: v1 takes security fixes only, so a feature request is v2 by construction. Each of the three now distinguishes the two forms rather than generalizing from the bug form. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: declare v2 statically on the feature form (#1844) Round-5 Copilot nit caught a real contradiction: the AGENTS.md paragraph said no form can apply a version label, then asserted the feature form "is always labeled v2". Both halves can't be true. Resolved in the direction that makes the claim true rather than softer. A form's `labels:` is static, which is only an obstacle when the value depends on a reporter's answer — and for the feature form it doesn't: v1 takes security fixes only, so a feature request is v2 by construction. So it now declares `["enhancement", "v2"]` outright, which also satisfies AGENTS.md's label-at-create-time rule without a triage step. The bug form still can't, and shouldn't: its version line is genuinely the reporter's to answer. Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
53 lines
2.6 KiB
Markdown
53 lines
2.6 KiB
Markdown
# Security Policy
|
|
|
|
Thank you for helping keep the Model Context Protocol and its ecosystem secure.
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Package | Support |
|
|
| ------- | ---------------------------------------- | ------------------------------------------------------- |
|
|
| **2.x** | `@modelcontextprotocol/inspector` | ✅ Actively supported |
|
|
| 1.x | `@modelcontextprotocol/inspector` | ⚠️ **Security fixes only**, published under `v1-latest` |
|
|
| 1.x | `@modelcontextprotocol/inspector-client` | ⚠️ Security fixes only |
|
|
| 1.x | `@modelcontextprotocol/inspector-server` | ⚠️ Security fixes only |
|
|
| 1.x | `@modelcontextprotocol/inspector-cli` | ⚠️ Security fixes only |
|
|
| < 1.0.0 | any | ❌ Unsupported |
|
|
|
|
v2 ships as a **single** package — `@modelcontextprotocol/inspector`. The three
|
|
`inspector-client` / `inspector-server` / `inspector-cli` sub-packages exist only
|
|
on the v1 line and are deprecated.
|
|
|
|
v1 development happens on the `v1/main` branch and is limited to security fixes.
|
|
Those releases are published under the **`v1-latest`** dist-tag so they never
|
|
displace the current v2 release:
|
|
|
|
```bash
|
|
npm i @modelcontextprotocol/inspector@v1-latest
|
|
```
|
|
|
|
Everything else — features, bug fixes, improvements — lands in v2 only.
|
|
|
|
## Reporting Security Issues
|
|
|
|
If you discover a security vulnerability in this repository, please report it through
|
|
the [GitHub Security Advisory process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)
|
|
for this repository. Private vulnerability reporting is enabled, so this is the
|
|
fastest route to a maintainer.
|
|
|
|
Please **do not** report security vulnerabilities through public GitHub issues, discussions,
|
|
or pull requests.
|
|
|
|
Note that this repository does not accept pull requests from outside contributors
|
|
(see [CONTRIBUTING.md](./CONTRIBUTING.md)) — **this does not apply to security
|
|
reports**, which should always go through the advisory process above rather than
|
|
any public channel.
|
|
|
|
## What to Include
|
|
|
|
To help us triage and respond quickly, please include:
|
|
|
|
- A description of the vulnerability
|
|
- Steps to reproduce the issue
|
|
- The potential impact
|
|
- Whether it affects v2, v1, or both
|
|
- Any suggested fixes (optional)
|