@modelcontextprotocol/inspector 0.14.3 → 0.16.0

package/README.md

@@ -148,9 +148,9 @@ The MCP Inspector proxy server requires authentication by default. When starting
    http://localhost:6274/?MCP_PROXY_AUTH_TOKEN=3a1c267fad21f7150b7d624c160b7f09b0b8c4f623c7107bbf13378f051538d4
 ```
 
-This token must be included as a Bearer token in the Authorization header for all requests to the server. When authentication is enabled, auto-open is disabled by default to ensure you use the secure URL.
+This token must be included as a Bearer token in the Authorization header for all requests to the server. The inspector will automatically open your browser with the token pre-filled in the URL.
 
-**Recommended: Use the pre-filled URL** - Click or copy the link shown in the console to open the inspector with the token already configured.
+**Automatic browser opening** - The inspector now automatically opens your browser with the token pre-filled in the URL when authentication is enabled.
 
 **Alternative: Manual configuration** - If you already have the inspector open:
 
@@ -168,33 +168,33 @@ DANGEROUSLY_OMIT_AUTH=true npm start
 
 #### Local-only Binding
 
-By default, the MCP Inspector proxy server binds only to `127.0.0.1` (localhost) to prevent network access. This ensures the server is not accessible from other devices on the network. If you need to bind to all interfaces for development purposes, you can override this with the `HOST` environment variable:
+By default, both the MCP Inspector proxy server and client bind only to `localhost` to prevent network access. This ensures they are not accessible from other devices on the network. If you need to bind to all interfaces for development purposes, you can override this with the `HOST` environment variable:
 
 ```bash
 HOST=0.0.0.0 npm start
 ```
 
-**Warning:** Only bind to all interfaces in trusted network environments, as this exposes the proxy server's ability to execute local processes.
+**Warning:** Only bind to all interfaces in trusted network environments, as this exposes the proxy server's ability to execute local processes and both services to network access.
 
 #### DNS Rebinding Protection
 
 To prevent DNS rebinding attacks, the MCP Inspector validates the `Origin` header on incoming requests. By default, only requests from the client origin are allowed (respects `CLIENT_PORT` if set, defaulting to port 6274). You can configure additional allowed origins by setting the `ALLOWED_ORIGINS` environment variable (comma-separated list):
 
 ```bash
-ALLOWED_ORIGINS=http://localhost:6274,http://127.0.0.1:6274,http://localhost:8000 npm start
+ALLOWED_ORIGINS=http://localhost:6274,http://localhost:8000 npm start
 ```
 
 ### Configuration
 
 The MCP Inspector supports the following configuration settings. To change them, click on the `Configuration` button in the MCP Inspector UI:
 
-| Setting                                 | Description                                                                                                   | Default |
-| --------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------- |
-| `MCP_SERVER_REQUEST_TIMEOUT`            | Timeout for requests to the MCP server (ms)                                                                   | 10000   |
-| `MCP_REQUEST_TIMEOUT_RESET_ON_PROGRESS` | Reset timeout on progress notifications                                                                       | true    |
-| `MCP_REQUEST_MAX_TOTAL_TIMEOUT`         | Maximum total timeout for requests sent to the MCP server (ms) (Use with progress notifications)              | 60000   |
-| `MCP_PROXY_FULL_ADDRESS`                | Set this if you are running the MCP Inspector Proxy on a non-default address. Example: http://10.1.1.22:5577  | ""      |
-| `MCP_AUTO_OPEN_ENABLED`                 | Enable automatic browser opening when inspector starts. Only as environment var, not configurable in browser. | true    |
+| Setting                                 | Description                                                                                                                                       | Default |
+| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
+| `MCP_SERVER_REQUEST_TIMEOUT`            | Timeout for requests to the MCP server (ms)                                                                                                       | 10000   |
+| `MCP_REQUEST_TIMEOUT_RESET_ON_PROGRESS` | Reset timeout on progress notifications                                                                                                           | true    |
+| `MCP_REQUEST_MAX_TOTAL_TIMEOUT`         | Maximum total timeout for requests sent to the MCP server (ms) (Use with progress notifications)                                                  | 60000   |
+| `MCP_PROXY_FULL_ADDRESS`                | Set this if you are running the MCP Inspector Proxy on a non-default address. Example: http://10.1.1.22:5577                                      | ""      |
+| `MCP_AUTO_OPEN_ENABLED`                 | Enable automatic browser opening when inspector starts (works with authentication enabled). Only as environment var, not configurable in browser. | true    |
 
 These settings can be adjusted in real-time through the UI and will persist across sessions.
 
@@ -299,9 +299,12 @@ npx @modelcontextprotocol/inspector --cli node build/index.js --method resources
 # List available prompts
 npx @modelcontextprotocol/inspector --cli node build/index.js --method prompts/list
 
-# Connect to a remote MCP server
+# Connect to a remote MCP server (default is SSE transport)
 npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com
 
+# Connect to a remote MCP server (with Streamable HTTP transport)
+npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com --transport http
+
 # Call a tool on a remote server
 npx @modelcontextprotocol/inspector --cli https://my-mcp-server.example.com --method tools/call --tool-name remotetool --tool-arg param=value
 

package/cli/build/index.js

@@ -4,7 +4,7 @@ import { Command } from "commander";
 import { callTool, connect, disconnect, getPrompt, listPrompts, listResources, listResourceTemplates, listTools, readResource, setLoggingLevel, validLogLevels, } from "./client/index.js";
 import { handleError } from "./error-handler.js";
 import { createTransport } from "./transport.js";
-function createTransportOptions(target) {
+function createTransportOptions(target, transport) {
     if (target.length === 0) {
         throw new Error("Target is required. Specify a URL or a command to execute.");
     }
@@ -16,15 +16,40 @@ function createTransportOptions(target) {
     if (isUrl && commandArgs.length > 0) {
         throw new Error("Arguments cannot be passed to a URL-based MCP server.");
     }
+    let transportType;
+    if (transport) {
+        if (!isUrl && transport !== "stdio") {
+            throw new Error("Only stdio transport can be used with local commands.");
+        }
+        if (isUrl && transport === "stdio") {
+            throw new Error("stdio transport cannot be used with URLs.");
+        }
+        transportType = transport;
+    }
+    else if (isUrl) {
+        const url = new URL(command);
+        if (url.pathname.endsWith("/mcp")) {
+            transportType = "http";
+        }
+        else if (url.pathname.endsWith("/sse")) {
+            transportType = "sse";
+        }
+        else {
+            transportType = "sse";
+        }
+    }
+    else {
+        transportType = "stdio";
+    }
     return {
-        transportType: isUrl ? "sse" : "stdio",
+        transportType,
         command: isUrl ? undefined : command,
         args: isUrl ? undefined : commandArgs,
         url: isUrl ? command : undefined,
     };
 }
 async function callMethod(args) {
-    const transportOptions = createTransportOptions(args.target);
+    const transportOptions = createTransportOptions(args.target, args.transport);
     const transport = createTransport(transportOptions);
     const client = new Client({
         name: "inspector-cli",
@@ -136,6 +161,16 @@ function parseArgs() {
             throw new Error(`Invalid log level: ${value}. Valid levels are: ${validLogLevels.join(", ")}`);
         }
         return value;
+    })
+        //
+        // Transport options
+        //
+        .option("--transport <type>", "Transport type (sse, http, or stdio). Auto-detected from URL: /mcp → http, /sse → sse, commands → stdio", (value) => {
+        const validTransports = ["sse", "http", "stdio"];
+        if (!validTransports.includes(value)) {
+            throw new Error(`Invalid transport type: ${value}. Valid types are: ${validTransports.join(", ")}`);
+        }
+        return value;
     });
     // Parse only the arguments before --
     program.parse(preArgs);

package/cli/build/transport.js

@@ -1,11 +1,21 @@
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { getDefaultEnvironment, StdioClientTransport, } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { findActualExecutable } from "spawn-rx";
 function createSSETransport(options) {
     const baseUrl = new URL(options.url ?? "");
-    const sseUrl = new URL("/sse", baseUrl);
+    const sseUrl = baseUrl.pathname.endsWith("/sse")
+        ? baseUrl
+        : new URL("/sse", baseUrl);
     return new SSEClientTransport(sseUrl);
 }
+function createHTTPTransport(options) {
+    const baseUrl = new URL(options.url ?? "");
+    const mcpUrl = baseUrl.pathname.endsWith("/mcp")
+        ? baseUrl
+        : new URL("/mcp", baseUrl);
+    return new StreamableHTTPClientTransport(mcpUrl);
+}
 function createStdioTransport(options) {
     let args = [];
     if (options.args !== undefined) {
@@ -39,6 +49,9 @@ export function createTransport(options) {
         if (transportType === "sse") {
             return createSSETransport(options);
         }
+        if (transportType === "http") {
+            return createHTTPTransport(options);
+        }
         throw new Error(`Unsupported transport type: ${transportType}`);
     }
     catch (error) {

package/client/bin/client.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import open from "open";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import handler from "serve-handler";
@@ -39,19 +40,23 @@ const server = http.createServer((request, response) => {
   return handler(request, response, handlerOptions);
 });
 
-const port = process.env.PORT || 6274;
+const port = parseInt(process.env.CLIENT_PORT || "6274", 10);
+const host = process.env.HOST || "localhost";
 server.on("listening", () => {
-  console.log(
-    `🔍 MCP Inspector is up and running at http://127.0.0.1:${port} 🚀`,
-  );
+  const url = process.env.INSPECTOR_URL || `http://${host}:${port}`;
+  console.log(`\n🚀 MCP Inspector is up and running at:\n   ${url}\n`);
+  if (process.env.MCP_AUTO_OPEN_ENABLED !== "false") {
+    console.log(`🌐 Opening browser...`);
+    open(url);
+  }
 });
 server.on("error", (err) => {
   if (err.message.includes(`EADDRINUSE`)) {
     console.error(
-      `❌  MCP Inspector PORT IS IN USE at http://127.0.0.1:${port} ❌ `,
+      `❌  MCP Inspector PORT IS IN USE at http://${host}:${port} ❌ `,
     );
   } else {
     throw err;
   }
 });
-server.listen(port);
+server.listen(port, host);

package/client/bin/start.js

@@ -2,15 +2,202 @@
 
 import open from "open";
 import { resolve, dirname } from "path";
-import { spawnPromise } from "spawn-rx";
+import { spawnPromise, spawn } from "spawn-rx";
 import { fileURLToPath } from "url";
+import { randomBytes } from "crypto";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_MCP_PROXY_LISTEN_PORT = "6277";
 
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms, true));
 }
 
+function getClientUrl(port, authDisabled, sessionToken, serverPort) {
+  const host = process.env.HOST || "localhost";
+  const baseUrl = `http://${host}:${port}`;
+
+  const params = new URLSearchParams();
+  if (serverPort && serverPort !== DEFAULT_MCP_PROXY_LISTEN_PORT) {
+    params.set("MCP_PROXY_PORT", serverPort);
+  }
+  if (!authDisabled) {
+    params.set("MCP_PROXY_AUTH_TOKEN", sessionToken);
+  }
+  return params.size > 0 ? `${baseUrl}/?${params.toString()}` : baseUrl;
+}
+
+async function startDevServer(serverOptions) {
+  const { SERVER_PORT, CLIENT_PORT, sessionToken, envVars, abort } =
+    serverOptions;
+  const serverCommand = "npx";
+  const serverArgs = ["tsx", "watch", "--clear-screen=false", "src/index.ts"];
+  const isWindows = process.platform === "win32";
+
+  const spawnOptions = {
+    cwd: resolve(__dirname, "../..", "server"),
+    env: {
+      ...process.env,
+      SERVER_PORT,
+      CLIENT_PORT,
+      MCP_PROXY_TOKEN: sessionToken,
+      MCP_ENV_VARS: JSON.stringify(envVars),
+    },
+    signal: abort.signal,
+    echoOutput: true,
+  };
+
+  // For Windows, we need to use stdin: 'ignore' to simulate < NUL
+  if (isWindows) {
+    spawnOptions.stdin = "ignore";
+  }
+
+  const server = spawn(serverCommand, serverArgs, spawnOptions);
+
+  // Give server time to start
+  const serverOk = await Promise.race([
+    new Promise((resolve) => {
+      server.subscribe({
+        complete: () => resolve(false),
+        error: () => resolve(false),
+        next: () => {}, // We're using echoOutput
+      });
+    }),
+    delay(3000).then(() => true),
+  ]);
+
+  return { server, serverOk };
+}
+
+async function startProdServer(serverOptions) {
+  const {
+    SERVER_PORT,
+    CLIENT_PORT,
+    sessionToken,
+    envVars,
+    abort,
+    command,
+    mcpServerArgs,
+  } = serverOptions;
+  const inspectorServerPath = resolve(
+    __dirname,
+    "../..",
+    "server",
+    "build",
+    "index.js",
+  );
+
+  const server = spawnPromise(
+    "node",
+    [
+      inspectorServerPath,
+      ...(command ? [`--env`, command] : []),
+      ...(mcpServerArgs ? [`--args=${mcpServerArgs.join(" ")}`] : []),
+    ],
+    {
+      env: {
+        ...process.env,
+        SERVER_PORT,
+        CLIENT_PORT,
+        MCP_PROXY_TOKEN: sessionToken,
+        MCP_ENV_VARS: JSON.stringify(envVars),
+      },
+      signal: abort.signal,
+      echoOutput: true,
+    },
+  );
+
+  // Make sure server started before starting client
+  const serverOk = await Promise.race([server, delay(2 * 1000)]);
+
+  return { server, serverOk };
+}
+
+async function startDevClient(clientOptions) {
+  const {
+    CLIENT_PORT,
+    SERVER_PORT,
+    authDisabled,
+    sessionToken,
+    abort,
+    cancelled,
+  } = clientOptions;
+  const clientCommand = "npx";
+  const host = process.env.HOST || "localhost";
+  const clientArgs = ["vite", "--port", CLIENT_PORT, "--host", host];
+
+  const client = spawn(clientCommand, clientArgs, {
+    cwd: resolve(__dirname, ".."),
+    env: { ...process.env, CLIENT_PORT },
+    signal: abort.signal,
+    echoOutput: true,
+  });
+
+  const url = getClientUrl(
+    CLIENT_PORT,
+    authDisabled,
+    sessionToken,
+    SERVER_PORT,
+  );
+
+  // Give vite time to start before opening or logging the URL
+  setTimeout(() => {
+    console.log(`\n🚀 MCP Inspector is up and running at:\n   ${url}\n`);
+    if (process.env.MCP_AUTO_OPEN_ENABLED !== "false") {
+      console.log("🌐 Opening browser...");
+      open(url);
+    }
+  }, 3000);
+
+  await new Promise((resolve) => {
+    client.subscribe({
+      complete: resolve,
+      error: (err) => {
+        if (!cancelled || process.env.DEBUG) {
+          console.error("Client error:", err);
+        }
+        resolve(null);
+      },
+      next: () => {}, // We're using echoOutput
+    });
+  });
+}
+
+async function startProdClient(clientOptions) {
+  const {
+    CLIENT_PORT,
+    SERVER_PORT,
+    authDisabled,
+    sessionToken,
+    abort,
+    cancelled,
+  } = clientOptions;
+  const inspectorClientPath = resolve(
+    __dirname,
+    "../..",
+    "client",
+    "bin",
+    "client.js",
+  );
+
+  const url = getClientUrl(
+    CLIENT_PORT,
+    authDisabled,
+    sessionToken,
+    SERVER_PORT,
+  );
+
+  await spawnPromise("node", [inspectorClientPath], {
+    env: {
+      ...process.env,
+      CLIENT_PORT,
+      INSPECTOR_URL: url,
+    },
+    signal: abort.signal,
+    echoOutput: true,
+  });
+}
+
 async function main() {
   // Parse command line arguments
   const args = process.argv.slice(2);
@@ -18,6 +205,7 @@ async function main() {
   const mcpServerArgs = [];
   let command = null;
   let parsingFlags = true;
+  let isDev = false;
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
@@ -27,6 +215,11 @@ async function main() {
       continue;
     }
 
+    if (parsingFlags && arg === "--dev") {
+      isDev = true;
+      continue;
+    }
+
     if (parsingFlags && arg === "-e" && i + 1 < args.length) {
       const envVar = args[++i];
       const equalsIndex = envVar.indexOf("=");
@@ -38,34 +231,25 @@ async function main() {
       } else {
         envVars[envVar] = "";
       }
-    } else if (!command) {
+    } else if (!command && !isDev) {
       command = arg;
-    } else {
+    } else if (!isDev) {
       mcpServerArgs.push(arg);
     }
   }
 
-  const inspectorServerPath = resolve(
-    __dirname,
-    "../..",
-    "server",
-    "build",
-    "index.js",
-  );
+  const CLIENT_PORT = process.env.CLIENT_PORT ?? "6274";
+  const SERVER_PORT = process.env.SERVER_PORT ?? DEFAULT_MCP_PROXY_LISTEN_PORT;
 
-  // Path to the client entry point
-  const inspectorClientPath = resolve(
-    __dirname,
-    "../..",
-    "client",
-    "bin",
-    "client.js",
+  console.log(
+    isDev
+      ? "Starting MCP inspector in development mode..."
+      : "Starting MCP inspector...",
   );
 
-  const CLIENT_PORT = process.env.CLIENT_PORT ?? "6274";
-  const SERVER_PORT = process.env.SERVER_PORT ?? "6277";
-
-  console.log("Starting MCP inspector...");
+  // Generate session token for authentication
+  const sessionToken = randomBytes(32).toString("hex");
+  const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
 
   const abort = new AbortController();
 
@@ -74,42 +258,42 @@ async function main() {
     cancelled = true;
     abort.abort();
   });
+
   let server, serverOk;
+
   try {
-    server = spawnPromise(
-      "node",
-      [
-        inspectorServerPath,
-        ...(command ? [`--env`, command] : []),
-        ...(mcpServerArgs ? [`--args=${mcpServerArgs.join(" ")}`] : []),
-      ],
-      {
-        env: {
-          ...process.env,
-          PORT: SERVER_PORT,
-          MCP_ENV_VARS: JSON.stringify(envVars),
-        },
-        signal: abort.signal,
-        echoOutput: true,
-      },
-    );
+    const serverOptions = {
+      SERVER_PORT,
+      CLIENT_PORT,
+      sessionToken,
+      envVars,
+      abort,
+      command,
+      mcpServerArgs,
+    };
 
-    // Make sure server started before starting client
-    serverOk = await Promise.race([server, delay(2 * 1000)]);
+    const result = isDev
+      ? await startDevServer(serverOptions)
+      : await startProdServer(serverOptions);
+
+    server = result.server;
+    serverOk = result.serverOk;
   } catch (error) {}
 
   if (serverOk) {
     try {
-      // Only auto-open when auth is disabled
-      const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
-      if (process.env.MCP_AUTO_OPEN_ENABLED !== "false" && authDisabled) {
-        open(`http://127.0.0.1:${CLIENT_PORT}`);
-      }
-      await spawnPromise("node", [inspectorClientPath], {
-        env: { ...process.env, PORT: CLIENT_PORT },
-        signal: abort.signal,
-        echoOutput: true,
-      });
+      const clientOptions = {
+        CLIENT_PORT,
+        SERVER_PORT,
+        authDisabled,
+        sessionToken,
+        abort,
+        cancelled,
+      };
+
+      await (isDev
+        ? startDevClient(clientOptions)
+        : startProdClient(clientOptions));
     } catch (e) {
       if (!cancelled || process.env.DEBUG) throw e;
     }

package/client/dist/assets/{OAuthCallback-BrCtrNqU.js → OAuthCallback-DMQy4ibj.js}

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-DYfnI33L.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-DI7JCTeu.js";
 import { p as parseOAuthCallbackParams, g as generateOAuthErrorDescription } from "./oauthUtils-DTcoXpSP.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();

package/client/dist/assets/{OAuthDebugCallback-CnQiL6bh.js → OAuthDebugCallback-9JxBAysc.js}

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, j as jsxRuntimeExports } from "./index-DYfnI33L.js";
+import { r as reactExports, S as SESSION_KEYS, j as jsxRuntimeExports } from "./index-DI7JCTeu.js";
 import { p as parseOAuthCallbackParams, g as generateOAuthErrorDescription } from "./oauthUtils-DTcoXpSP.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {

package/client/dist/assets/{index-C1MLjTGf.css → index-BwWj6LL9.css}

@@ -1,7 +1,3 @@
-#root {
-  margin: 0 auto;
-}
-
 .logo {
   height: 6em;
   padding: 1.5em;