modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
inspector/specification/v2_scope.md
cliffhall d68202a88b docs(spec): add V2 Auth landing page and canonicalize spec top menus (closes #1605) 
Add a specification/v2_auth.md landing page summarizing the four auth specs
(EMA / XAA, Hardening, Mid-session, Smoke testing) with a section submenu,
mirroring the V2 UX index pattern.

Add a V2 Auth link (after V2 UX) and a V2 New Spec Impact link to every spec
page's top menu so the top-level nav is uniform, and restructure the four
v2_auth_*.md pages onto the shared two-tier menu (top menu + auth submenu).

Docs only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX
2026-07-02 17:20:06 -04:00

3.9 KiB
Raw Blame History

Inspector V2 Scope

Brief | V1 Problems | V2 Scope | V2 Tech Stack | V2 UX | V2 Auth | V2 New Spec Impact

Table of Contents

Protocol Features

  • Tools
  • Resources
  • Resource Subscriptions
  • Resource Templates
  • Prompts
  • Elicitation
  • Sampling with stubbed response
  • Roots
  • Logging
  • Completions
  • Metadata
  • Pagination
    • resources/list
    • resources/templates/list
    • prompts/list
    • tools/list
  • Cancellation (of in progress requests)
  • Ping

OAuth Handling

  • authenticate() / completeOAuthFlow() (SDK-backed authorization-code flow)
  • Connection Info for auth debugging
  • Enterprise-managed authorization (EMA / XAA) — see EMA / XAA
  • Mid-session authorization (401 after connect: token refresh, step-up scopes, web remote reconnect) — see Mid-session auth
  • Authorization hardening (MCP 2026-07-28 SEPs: iss, DCR client type, issuer-bound credentials, step-up scope union) — see Auth hardening
  • OAuth smoke testing (manual procedures against hosted servers) — see Smoke testing

Transport Types

  • STDIO
  • SSE
  • SHTTP

Logging Level Control

  • Present and synchronized when connecting to server with logging capability

Copy Server configuration

  • As config file server entry
  • As config file containing server entry

Custom Auth-related properties

  • Custom headers
  • Client ID
  • Secret
  • Scope

Timeout management

  • Request timeout
  • Request timeout on progress (bool)
  • Maximum total timeout

Schema parsing for Elicitation, Tool Input Schemas

  • New enum types
  • anyOf /oneOf
  • $ref
  • $defs

Form inputs vs JSON editor for:

  • Elicitation, tool input, resource template, and prompt vars, sampling response
  • Field types of primitive, object, array
  • Nullable field types
  • Defaults

Proxy server

  • Required for testing STDIO servers and HTTP servers that can’t open up their CORS origin for testing
  • Implement a feature configuration file rather than disparate environment variables for everything
  • Handle auth flows instead of browser when "via proxy" connection type selected

Previous Security Fixes

  • Unique proxy server session token to prevent unauthorized access to the proxy server's ability to execute local processes and connect to MCP servers.
  • Bind to localhost by default to prevent DNS rebinding attacks (never 0.0.0.0)
  • Fix/validate redirect urls for http/https scheme only in auth flow

Server file maintenance

  • Opening screen similar to MCPJam servers list
  • Adding, changing, and deleting a server would hit endpoints on the proxy server update the inspector’s servers.json config file

Plugin architecture

  • Allow third parties to extend the Inspector with functionality we do not wish to maintain, but which would still be useful to developers within the context of the Inspector, e.g., LLMs, evals, OpenAI Apps SDK playground