@modelcontextprotocol/inspector 0.13.0 → 0.14.1

package/client/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-Dhd4mhZ2.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CIxCnj5w.css">
+    <script type="module" crossorigin src="/assets/index-TghXC4TH.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-C1MLjTGf.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "Model Context Protocol inspector",
   "license": "MIT",
   "author": "Anthropic, PBC (https://anthropic.com)",
@@ -36,14 +36,15 @@
     "test-cli": "cd cli && npm run test",
     "prettier-fix": "prettier --write .",
     "prettier-check": "prettier --check .",
+    "lint": "prettier --check . && cd client && npm run lint",
     "prepare": "npm run build",
     "publish-all": "npm publish --workspaces --access public && npm publish --access public"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.13.0",
-    "@modelcontextprotocol/inspector-client": "^0.13.0",
-    "@modelcontextprotocol/inspector-server": "^0.13.0",
-    "@modelcontextprotocol/sdk": "^1.11.5",
+    "@modelcontextprotocol/inspector-cli": "^0.14.1",
+    "@modelcontextprotocol/inspector-client": "^0.14.1",
+    "@modelcontextprotocol/inspector-server": "^0.14.1",
+    "@modelcontextprotocol/sdk": "^1.12.1",
     "concurrently": "^9.0.1",
     "open": "^10.1.0",
     "shell-quote": "^1.8.2",

package/server/build/index.js

@@ -10,7 +10,7 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
 import express from "express";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
-import { randomUUID } from "node:crypto";
+import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
 const SSE_HEADERS_PASSTHROUGH = ["authorization"];
 const STREAMABLE_HTTP_HEADERS_PASSTHROUGH = [
     "authorization",
@@ -28,16 +28,100 @@ const { values } = parseArgs({
         args: { type: "string", default: "" },
     },
 });
+// Function to get HTTP headers.
+// Supports only "sse" and "streamable-http" transport types.
+const getHttpHeaders = (req, transportType) => {
+    const headers = {
+        Accept: transportType === "sse"
+            ? "text/event-stream"
+            : "text/event-stream, application/json",
+    };
+    const defaultHeaders = transportType === "sse"
+        ? SSE_HEADERS_PASSTHROUGH
+        : STREAMABLE_HTTP_HEADERS_PASSTHROUGH;
+    for (const key of defaultHeaders) {
+        if (req.headers[key] === undefined) {
+            continue;
+        }
+        const value = req.headers[key];
+        headers[key] = Array.isArray(value) ? value[value.length - 1] : value;
+    }
+    // If the header "x-custom-auth-header" is present, use its value as the custom header name.
+    if (req.headers["x-custom-auth-header"] !== undefined) {
+        const customHeaderName = req.headers["x-custom-auth-header"];
+        const lowerCaseHeaderName = customHeaderName.toLowerCase();
+        if (req.headers[lowerCaseHeaderName] !== undefined) {
+            const value = req.headers[lowerCaseHeaderName];
+            headers[customHeaderName] = value;
+        }
+    }
+    return headers;
+};
 const app = express();
 app.use(cors());
 app.use((req, res, next) => {
     res.header("Access-Control-Expose-Headers", "mcp-session-id");
     next();
 });
-const webAppTransports = new Map(); // Transports by sessionId
+const webAppTransports = new Map(); // Web app transports by web app sessionId
+const serverTransports = new Map(); // Server Transports by web app sessionId
+const sessionToken = randomBytes(32).toString("hex");
+const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
+// Origin validation middleware to prevent DNS rebinding attacks
+const originValidationMiddleware = (req, res, next) => {
+    const origin = req.headers.origin;
+    // Default origins based on CLIENT_PORT or use environment variable
+    const clientPort = process.env.CLIENT_PORT || "6274";
+    const defaultOrigins = [
+        `http://localhost:${clientPort}`,
+        `http://127.0.0.1:${clientPort}`,
+    ];
+    const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || defaultOrigins;
+    if (origin && !allowedOrigins.includes(origin)) {
+        console.error(`Invalid origin: ${origin}`);
+        res.status(403).json({
+            error: "Forbidden - invalid origin",
+            message: "Request blocked to prevent DNS rebinding attacks. Configure allowed origins via environment variable.",
+        });
+        return;
+    }
+    next();
+};
+const authMiddleware = (req, res, next) => {
+    if (authDisabled) {
+        return next();
+    }
+    const sendUnauthorized = () => {
+        res.status(401).json({
+            error: "Unauthorized",
+            message: "Authentication required. Use the session token shown in the console when starting the server.",
+        });
+    };
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        sendUnauthorized();
+        return;
+    }
+    const providedToken = authHeader.substring(7); // Remove 'Bearer ' prefix
+    const expectedToken = sessionToken;
+    // Convert to buffers for timing-safe comparison
+    const providedBuffer = Buffer.from(providedToken);
+    const expectedBuffer = Buffer.from(expectedToken);
+    // Check length first to prevent timing attacks
+    if (providedBuffer.length !== expectedBuffer.length) {
+        sendUnauthorized();
+        return;
+    }
+    // Perform timing-safe comparison
+    if (!timingSafeEqual(providedBuffer, expectedBuffer)) {
+        sendUnauthorized();
+        return;
+    }
+    next();
+};
 const createTransport = async (req) => {
     const query = req.query;
-    console.log("Query parameters:", query);
+    console.log("Query parameters:", JSON.stringify(query));
     const transportType = query.transportType;
     if (transportType === "stdio") {
         const command = query.command;
@@ -45,7 +129,7 @@ const createTransport = async (req) => {
         const queryEnv = query.env ? JSON.parse(query.env) : {};
         const env = { ...process.env, ...defaultEnvironment, ...queryEnv };
         const { cmd, args } = findActualExecutable(command, origArgs);
-        console.log(`Stdio transport: command=${cmd}, args=${args}`);
+        console.log(`STDIO transport: command=${cmd}, args=${args}`);
         const transport = new StdioClientTransport({
             command: cmd,
             args,
@@ -53,21 +137,11 @@ const createTransport = async (req) => {
             stderr: "pipe",
         });
         await transport.start();
-        console.log("Spawned stdio transport");
         return transport;
     }
     else if (transportType === "sse") {
         const url = query.url;
-        const headers = {
-            Accept: "text/event-stream",
-        };
-        for (const key of SSE_HEADERS_PASSTHROUGH) {
-            if (req.headers[key] === undefined) {
-                continue;
-            }
-            const value = req.headers[key];
-            headers[key] = Array.isArray(value) ? value[value.length - 1] : value;
-        }
+        const headers = getHttpHeaders(req, transportType);
         console.log(`SSE transport: url=${url}, headers=${Object.keys(headers)}`);
         const transport = new SSEClientTransport(new URL(url), {
             eventSourceInit: {
@@ -78,27 +152,16 @@ const createTransport = async (req) => {
             },
         });
         await transport.start();
-        console.log("Connected to SSE transport");
         return transport;
     }
     else if (transportType === "streamable-http") {
-        const headers = {
-            Accept: "text/event-stream, application/json",
-        };
-        for (const key of STREAMABLE_HTTP_HEADERS_PASSTHROUGH) {
-            if (req.headers[key] === undefined) {
-                continue;
-            }
-            const value = req.headers[key];
-            headers[key] = Array.isArray(value) ? value[value.length - 1] : value;
-        }
+        const headers = getHttpHeaders(req, transportType);
         const transport = new StreamableHTTPClientTransport(new URL(query.url), {
             requestInit: {
                 headers,
             },
         });
         await transport.start();
-        console.log("Connected to Streamable HTTP transport");
         return transport;
     }
     else {
@@ -106,8 +169,7 @@ const createTransport = async (req) => {
         throw new Error("Invalid transport type specified");
     }
 };
-let backingServerTransport;
-app.get("/mcp", async (req, res) => {
+app.get("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
     console.log(`Received GET message for sessionId ${sessionId}`);
     try {
@@ -125,15 +187,14 @@ app.get("/mcp", async (req, res) => {
         res.status(500).json(error);
     }
 });
-app.post("/mcp", async (req, res) => {
+app.post("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
     const sessionId = req.headers["mcp-session-id"];
-    console.log(`Received POST message for sessionId ${sessionId}`);
+    let serverTransport;
     if (!sessionId) {
         try {
-            console.log("New streamable-http connection");
+            console.log("New StreamableHttp connection request");
             try {
-                await backingServerTransport?.close();
-                backingServerTransport = await createTransport(req);
+                serverTransport = await createTransport(req);
             }
             catch (error) {
                 if (error instanceof SseError && error.code === 401) {
@@ -143,18 +204,20 @@ app.post("/mcp", async (req, res) => {
                 }
                 throw error;
             }
-            console.log("Connected MCP client to backing server transport");
+            console.log("Created StreamableHttp server transport");
             const webAppTransport = new StreamableHTTPServerTransport({
                 sessionIdGenerator: randomUUID,
                 onsessioninitialized: (sessionId) => {
                     webAppTransports.set(sessionId, webAppTransport);
-                    console.log("Created streamable web app transport " + sessionId);
+                    serverTransports.set(sessionId, serverTransport);
+                    console.log("Client <-> Proxy  sessionId: " + sessionId);
                 },
             });
+            console.log("Created StreamableHttp client transport");
             await webAppTransport.start();
             mcpProxy({
                 transportToClient: webAppTransport,
-                transportToServer: backingServerTransport,
+                transportToServer: serverTransport,
             });
             await webAppTransport.handleRequest(req, res, req.body);
         }
@@ -164,6 +227,7 @@ app.post("/mcp", async (req, res) => {
         }
     }
     else {
+        console.log(`Received POST message for sessionId ${sessionId}`);
         try {
             const transport = webAppTransports.get(sessionId);
             if (!transport) {
@@ -179,81 +243,134 @@ app.post("/mcp", async (req, res) => {
         }
     }
 });
-app.get("/stdio", async (req, res) => {
+app.delete("/mcp", originValidationMiddleware, authMiddleware, async (req, res) => {
+    const sessionId = req.headers["mcp-session-id"];
+    console.log(`Received DELETE message for sessionId ${sessionId}`);
+    let serverTransport;
+    if (sessionId) {
+        try {
+            serverTransport = serverTransports.get(sessionId);
+            if (!serverTransport) {
+                res.status(404).end("Transport not found for sessionId " + sessionId);
+            }
+            else {
+                await serverTransport.terminateSession();
+                webAppTransports.delete(sessionId);
+                serverTransports.delete(sessionId);
+                console.log(`Transports removed for sessionId ${sessionId}`);
+            }
+            res.status(200).end();
+        }
+        catch (error) {
+            console.error("Error in /mcp route:", error);
+            res.status(500).json(error);
+        }
+    }
+});
+app.get("/stdio", originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
-        console.log("New connection");
+        console.log("New STDIO connection request");
+        let serverTransport;
         try {
-            await backingServerTransport?.close();
-            backingServerTransport = await createTransport(req);
+            serverTransport = await createTransport(req);
+            console.log("Created server transport");
         }
         catch (error) {
             if (error instanceof SseError && error.code === 401) {
-                console.error("Received 401 Unauthorized from MCP server:", error.message);
+                console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
                 res.status(401).json(error);
                 return;
             }
             throw error;
         }
-        console.log("Connected MCP client to backing server transport");
         const webAppTransport = new SSEServerTransport("/message", res);
+        console.log("Created client transport");
         webAppTransports.set(webAppTransport.sessionId, webAppTransport);
-        console.log("Created web app transport");
+        serverTransports.set(webAppTransport.sessionId, serverTransport);
         await webAppTransport.start();
-        backingServerTransport.stderr.on("data", (chunk) => {
-            webAppTransport.send({
-                jsonrpc: "2.0",
-                method: "notifications/stderr",
-                params: {
-                    content: chunk.toString(),
-                },
-            });
+        serverTransport.stderr.on("data", (chunk) => {
+            if (chunk.toString().includes("MODULE_NOT_FOUND")) {
+                webAppTransport.send({
+                    jsonrpc: "2.0",
+                    method: "notifications/stderr",
+                    params: {
+                        content: "Command not found, transports removed",
+                    },
+                });
+                webAppTransport.close();
+                serverTransport.close();
+                webAppTransports.delete(webAppTransport.sessionId);
+                serverTransports.delete(webAppTransport.sessionId);
+                console.error("Command not found, transports removed");
+            }
+            else {
+                webAppTransport.send({
+                    jsonrpc: "2.0",
+                    method: "notifications/stderr",
+                    params: {
+                        content: chunk.toString(),
+                    },
+                });
+            }
         });
         mcpProxy({
             transportToClient: webAppTransport,
-            transportToServer: backingServerTransport,
+            transportToServer: serverTransport,
         });
-        console.log("Set up MCP proxy");
     }
     catch (error) {
         console.error("Error in /stdio route:", error);
         res.status(500).json(error);
     }
 });
-app.get("/sse", async (req, res) => {
+app.get("/sse", originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
-        console.log("New SSE connection. NOTE: The sse transport is deprecated and has been replaced by streamable-http");
+        console.log("New SSE connection request. NOTE: The sse transport is deprecated and has been replaced by StreamableHttp");
+        let serverTransport;
         try {
-            await backingServerTransport?.close();
-            backingServerTransport = await createTransport(req);
+            serverTransport = await createTransport(req);
         }
         catch (error) {
             if (error instanceof SseError && error.code === 401) {
-                console.error("Received 401 Unauthorized from MCP server:", error.message);
+                console.error("Received 401 Unauthorized from MCP server. Authentication failure.");
                 res.status(401).json(error);
                 return;
             }
-            throw error;
+            else if (error instanceof SseError && error.code === 404) {
+                console.error("Received 404 not found from MCP server. Does the MCP server support SSE?");
+                res.status(404).json(error);
+                return;
+            }
+            else if (JSON.stringify(error).includes("ECONNREFUSED")) {
+                console.error("Connection refused. Is the MCP server running?");
+                res.status(500).json(error);
+            }
+            else {
+                throw error;
+            }
+        }
+        if (serverTransport) {
+            const webAppTransport = new SSEServerTransport("/message", res);
+            webAppTransports.set(webAppTransport.sessionId, webAppTransport);
+            console.log("Created client transport");
+            serverTransports.set(webAppTransport.sessionId, serverTransport);
+            console.log("Created server transport");
+            await webAppTransport.start();
+            mcpProxy({
+                transportToClient: webAppTransport,
+                transportToServer: serverTransport,
+            });
         }
-        console.log("Connected MCP client to backing server transport");
-        const webAppTransport = new SSEServerTransport("/message", res);
-        webAppTransports.set(webAppTransport.sessionId, webAppTransport);
-        console.log("Created web app transport");
-        await webAppTransport.start();
-        mcpProxy({
-            transportToClient: webAppTransport,
-            transportToServer: backingServerTransport,
-        });
-        console.log("Set up MCP proxy");
     }
     catch (error) {
         console.error("Error in /sse route:", error);
         res.status(500).json(error);
     }
 });
-app.post("/message", async (req, res) => {
+app.post("/message", originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
         const sessionId = req.query.sessionId;
-        console.log(`Received message for sessionId ${sessionId}`);
+        console.log(`Received POST message for sessionId ${sessionId}`);
         const transport = webAppTransports.get(sessionId);
         if (!transport) {
             res.status(404).end("Session not found");
@@ -271,7 +388,7 @@ app.get("/health", (req, res) => {
         status: "ok",
     });
 });
-app.get("/config", (req, res) => {
+app.get("/config", originValidationMiddleware, authMiddleware, (req, res) => {
     try {
         res.json({
             defaultEnvironment,
@@ -284,10 +401,22 @@ app.get("/config", (req, res) => {
         res.status(500).json(error);
     }
 });
-const PORT = process.env.PORT || 6277;
-const server = app.listen(PORT);
+const PORT = parseInt(process.env.PORT || "6277", 10);
+const HOST = process.env.HOST || "127.0.0.1";
+const server = app.listen(PORT, HOST);
 server.on("listening", () => {
-    console.log(`⚙️ Proxy server listening on port ${PORT}`);
+    console.log(`⚙️ Proxy server listening on ${HOST}:${PORT}`);
+    if (!authDisabled) {
+        console.log(`🔑 Session token: ${sessionToken}`);
+        console.log(`Use this token to authenticate requests or set DANGEROUSLY_OMIT_AUTH=true to disable auth`);
+        // Display clickable URL with pre-filled token
+        const clientPort = process.env.CLIENT_PORT || "6274";
+        const clientUrl = `http://localhost:${clientPort}/?MCP_PROXY_AUTH_TOKEN=${sessionToken}`;
+        console.log(`\n🔗 Open inspector with token pre-filled:\n   ${clientUrl}\n   (Auto-open is disabled when authentication is enabled)\n`);
+    }
+    else {
+        console.log(`⚠️  WARNING: Authentication is disabled. This is not recommended.`);
+    }
 });
 server.on("error", (err) => {
     if (err.message.includes(`EADDRINUSE`)) {

package/server/build/mcpProxy.js

@@ -3,11 +3,19 @@ function onClientError(error) {
     console.error("Error from inspector client:", error);
 }
 function onServerError(error) {
-    console.error("Error from MCP server:", error);
+    if ((error?.message &&
+        error.message.includes("Error POSTing to endpoint (HTTP 404)")) ||
+        (error?.cause && JSON.stringify(error.cause).includes("ECONNREFUSED"))) {
+        console.error("Connection refused. Is the MCP server running?");
+    }
+    else {
+        console.error("Error from MCP server:", error);
+    }
 }
 export default function mcpProxy({ transportToClient, transportToServer, }) {
     let transportToClientClosed = false;
     let transportToServerClosed = false;
+    let reportedServerSession = false;
     transportToClient.onmessage = (message) => {
         transportToServer.send(message).catch((error) => {
             // Send error response back to client if it was a request (has id) and connection is still open
@@ -26,6 +34,13 @@ export default function mcpProxy({ transportToClient, transportToServer, }) {
         });
     };
     transportToServer.onmessage = (message) => {
+        if (!reportedServerSession) {
+            if (transportToServer.sessionId) {
+                // Can only report for StreamableHttp
+                console.error("Proxy  <-> Server sessionId: " + transportToServer.sessionId);
+            }
+            reportedServerSession = true;
+        }
         transportToClient.send(message).catch(onClientError);
     };
     transportToClient.onclose = () => {