Mirror of https://github.com/modelcontextprotocol/inspector — Visual testing tool for MCP servers
  • TypeScript 90.8%
  • JavaScript 8.8%
  • CSS 0.2%
  • HTML 0.2%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
cliffhall d05e76d470 chore: address Copilot review round 4
- verify:skills:cli — the authoritative validator is now a GUARANTEED step in
  `local:gate` and CI, not a best-effort hand-off. It resolves the CLI itself
  (an installed one at 2.1.233+, else a pinned `npx -y`), so both tiers run the
  same script and cannot drift. `verify:skills` keeps skipping when the CLI is
  absent, which is right for `validate`: fast, offline, no Claude Code required.
- skill-manifest: the 1,536-char listing-entry cap covers `description` +
  `when_to_use` together; checking the description alone passed an over-cap
  entry. `when_to_use` is now parsed, validated and counted, with boundary tests
  at 1,536/1,537.
- verify-skills: report the budget as *this repo's contribution*. The real
  listing budget is shared with bundled skills and the contributor's own
  ~/.claude/skills, none of which is visible from here, so the number was
  claiming more than it measured.
- skill-eval: a negative case now means "no skill OF THIS REPO'S fired". It
  failed on any Skill invocation, so a contributor with an unrelated global
  skill got a false failure about their environment rather than these skills.
- docs/architecture + local-dev: the Node backend runner gets its
  `@inspector/core` alias from `clients/web/tsup.runner.config.ts`, not from
  Vite. The old text sent runner work to the wrong config.
- local-dev: the tarball does not ship "only each client's build/" — the
  allowlist also carries `clients/web/dist`, `clients/web/static` and the
  install helper. States the invariant that actually matters instead.
- issue-triage: the test for needing triage is "no board card". Adding "and no
  milestone" would skip the approved-but-unboarded case the same section then
  handles. Also corrected the `$M` note: the lookup is `--state all`, so closed
  issues DO have entries — `isopen` is about the invariants, not the lookup.
- issue-create: replaced "all five" with a per-version table. Steps 3 and 6
  (milestone, Priority) do not exist for v1, so the old list opened with a rule
  the same skill later tells you to violate.

Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-29 01:47:43 -04:00
.claude chore: address Copilot review round 4 2026-08-29 01:47:43 -04:00
.github chore: address Copilot review round 4 2026-08-29 01:47:43 -04:00
clients chore: address Copilot review round 1 2026-08-29 00:52:45 -04:00
core Merge remote-tracking branch 'origin/v2/main' into v2/fix/2172-oidc-discovery-compat 2026-08-28 10:10:57 -04:00
docs chore: address Copilot review round 4 2026-08-29 01:47:43 -04:00
scripts chore: address Copilot review round 4 2026-08-29 01:47:43 -04:00
specification fix: cancel a Streamable HTTP call by closing its stream (#2140) 2026-08-28 00:55:29 -04:00
test-servers Merge remote-tracking branch 'origin/v2/main' into v2/fix/2172-oidc-discovery-compat 2026-08-28 10:10:57 -04:00
.dockerignore review: harden the Docker image + align GHCR action versions 2026-07-11 09:43:04 -04:00
.gitattributes fix: add eol=lf policy to .gitattributes so Windows checkouts stay clean 2026-08-12 08:56:24 -07:00
.gitignore chore: extract AGENTS.md recipes into agent skills 2026-08-29 00:36:37 -04:00
.mcp.json ci: restore the Claude Code workflow and .mcp.json, lost in the v2 tree swap (#1869) 2026-07-31 23:03:14 -04:00
.npmignore feat: port CLI, TUI, and launcher from v1.5 into v2 (#1452) 2026-06-14 20:27:49 -04:00
AGENTS.md chore: address Copilot review round 4 2026-08-29 01:47:43 -04:00
CLAUDE.md chore: extract AGENTS.md recipes into agent skills 2026-08-29 00:36:37 -04:00
CODE_OF_CONDUCT.md chore: restore repo files dropped by the v2 tree swap (#1871) 2026-07-31 23:03:24 -04:00
CONTRIBUTING.md docs: replace the markdown bug template with GitHub issue forms (#1894) 2026-08-01 19:50:49 -04:00
Dockerfile fix(web): move the app origin off 6276, bound the publish route 2026-08-24 08:45:40 -04:00
eslint.config.js chore(scripts): treat an expression-built script name as forbidden too (#2146) 2026-08-27 00:15:07 -04:00
package-lock.json chore: bump version to 2.4.0 2026-08-26 10:58:34 -04:00
package.json chore: address Copilot review round 4 2026-08-29 01:47:43 -04:00
README.md chore: address Copilot review round 4 2026-08-29 01:47:43 -04:00
SECURITY.md docs: replace the markdown bug template with GitHub issue forms (#1894) 2026-08-01 19:50:49 -04:00
tsconfig.base.json Auth hardening CI gaps + SDK consolidation: EMA leg 2 / scopes (#1527) (#1725) 2026-07-19 22:36:21 -04:00
tsconfig.lint.json fix: address round-2 review — stale disconnect, lint-project gap, coverage 2026-08-16 21:52:43 -04:00
vitest.shared.mts fix(auth): address Copilot review round 1 on the secrets-file lock (#2082) 2026-08-23 09:49:01 -04:00

MCP Inspector

A developer tool for inspecting Model Context Protocol (MCP) servers. It ships as a single package, @modelcontextprotocol/inspector, that provides three ways to inspect a server:

  • Web — a Vite + React + Mantine single-page app with a Node backend.
  • CLI — a scriptable command-line client for automation, CI, and fast agent feedback loops.
  • TUI — an interactive terminal UI built with Ink.

All three run through one global mcp-inspector binary:

npx @modelcontextprotocol/inspector          # web UI (default)
npx @modelcontextprotocol/inspector --cli    # CLI
npx @modelcontextprotocol/inspector --tui    # TUI

Upgrading from v1? Read the v1 → v2 migration guide — CLI flags, the new --config vs. --catalog split, the Node engine bump, and what no longer ships.

Repo status. This is the v2 line of the Inspector. Active development happens on v2/main (the develop branch — all v2 PRs target it), which is merged into main at milestone releases; main is the default branch and holds the latest released v2, published to the npm latest tag. The legacy v1 line lives on v1/main — security fixes only, published straight from that branch to the npm v1-latest tag (npx @modelcontextprotocol/inspector@v1-latest). See AGENTS.md for branch/board conventions.

Quick start (development)

Requires Node >=22.19.0.

npm install          # at the repo root; postinstall cascades into every client
npm run build        # web → cli → tui → launcher

For day-to-day web iteration, run Vite directly — fast HMR, no launcher build needed:

cd clients/web && npm run dev

The launcher-driven scripts run the built launcher, so build first:

npm run web        # prod web launcher against clients/web/dist
npm run web:dev    # web launcher in --dev mode (Vite)

v2 is not an npm workspace — each client under clients/* keeps its own package.json and node_modules, and shared code lives in core/, consumed via a @inspector/core build-time alias. What that means for adding a dependency (root vs. client, dependencies vs. devDependencies, and the bundler external lists) is in the local-dev skill.

Project layout

inspector/
├── clients/
│   ├── web/          Web client (Vite + React + Mantine). src/ = browser app; server/ = Node backend
│   ├── cli/          CLI client (tsup bundle, @inspector/core alias)
│   ├── tui/          TUI client (Ink + React, tsup bundle)
│   └── launcher/     Shared launcher — provides the `mcp-inspector` bin, dispatches to web/cli/tui
├── core/             Shared code consumed via the `@inspector/core` alias (no package.json)
├── test-servers/     Composable MCP test servers + fixtures used by integration and smoke tests
├── scripts/          Root build/verify tooling (install cascade, smokes, the verify:* guards)
├── docs/             Task-oriented guides — see below
├── specification/    Design/build specifications
├── .claude/skills/   Agent skills: the repo's procedures, invokable by name
├── AGENTS.md         Contribution rules for agents AND humans
└── README.md         You are here

Each client has its own README with client-specific detail: web · cli · tui · launcher.

Documentation

Guide Covers
Architecture The @inspector/core shared package, and the web client's "dumb components" + Storybook approach
Testing and the quality gate What each validate / coverage / smoke / verify:* script covers, the GitHub-CI-vs-local-gate split, and the supported browsers
Test servers The composable test servers and the showcase config for every feature — what to run, what to click, and what the broken build did
Publishing What ships in the tarball, the packaging invariants, and pack:verify
Docker Running the container image — ports, volumes, and where secrets go
Migrating from v1 to v2 CLI flag mapping, --config vs. --catalog, the Node engine bump, env-var renames
MCP server configuration Which server(s) the Inspector connects to, and the config file format
Reviewing an MCP App The CLI-first → one-shot-web recipe for automated App-tool review
Launcher and config consolidation Why the launcher runs a client in-process rather than spawning it

Testing and the quality gate

Each client self-validates from its own folder; the root scripts chain them. There is no aggregate root test script.

npm run validate     # fast inner loop: format:check + lint + typecheck + build + unit tests
npm run coverage     # the per-file ≥90% gate (lines/statements/functions/branches)
npm run local:gate   # MANDATORY before pushing — a strict superset of GitHub CI

npm run local:gate is validate → verify:skills:cli → coverage → verify:build-gate → verify:bundle-externals → smoke → smoke:web:firefox → local:storybook. See Testing and the quality gate for what each stage covers and why two of them are local-only, and AGENTS.md for the testing rules themselves.

Contributing — AGENTS.md, CLAUDE.md, and the skills

AGENTS.md is the contract for changing this codebase, and it applies to humans and AI agents alike. It is not agent-only boilerplate — it holds the project's real rules: the version/label conventions, the TypeScript and Mantine/React standards, the testing and coverage requirements, and the mandatory pre-push gate. Read it before making changes, and keep it up to date when you change structure, tooling, or rules.

The repo's procedures — multi-step recipes with commands and live IDs — live in .claude/skills/ instead, one directory per procedure, so they are loaded only when the task calls for them. They are ordinary committed Markdown: an agent that doesn't understand skills can read them, and AGENTS.md carries an index of what exists. Claude Code users invoke one by name (/release, /issue-triage, …).

CLAUDE.md is the entry point Claude Code loads automatically; it includes AGENTS.md, so agents and humans work from the same source of truth. If you use a different agent that reads AGENTS.md, you get the same rules.

A key rule worth surfacing here: all work is issue-driven. Before starting, find or create a tracking issue on the v2 project board; open PRs against v2/main with Closes #<issue>. External contributions are accepted as issues, not pull requests — see CONTRIBUTING.md.

License

MIT.