@modelcontextprotocol/inspector 0.14.3 → 0.16.0

package/client/dist/index.html

@@ -5,10 +5,10 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-DYfnI33L.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-C1MLjTGf.css">
+    <script type="module" crossorigin src="/assets/index-DI7JCTeu.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BwWj6LL9.css">
   </head>
   <body>
-    <div id="root"></div>
+    <div id="root" class="w-full"></div>
   </body>
 </html>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.14.3",
+  "version": "0.16.0",
   "description": "Model Context Protocol inspector",
   "license": "MIT",
   "author": "Anthropic, PBC (https://anthropic.com)",
@@ -27,13 +27,14 @@
     "build-client": "cd client && npm run build",
     "build-cli": "cd cli && npm run build",
     "clean": "rimraf ./node_modules ./client/node_modules ./cli/node_modules ./build ./client/dist ./server/build ./cli/build ./package-lock.json && npm install",
-    "dev": "concurrently \"cd client && npm run dev\" \"cd server && npm run dev\"",
-    "dev:windows": "concurrently \"cd client && npm run dev\" \"cd server && npm run dev:windows\"",
+    "dev": "node client/bin/start.js --dev",
+    "dev:windows": "node client/bin/start.js --dev",
     "start": "node client/bin/start.js",
     "start-server": "cd server && npm run start",
     "start-client": "cd client && npm run preview",
     "test": "npm run prettier-check && cd client && npm test",
     "test-cli": "cd cli && npm run test",
+    "test:e2e": "MCP_AUTO_OPEN_ENABLED=false npm run test:e2e --workspace=client",
     "prettier-fix": "prettier --write .",
     "prettier-check": "prettier --check .",
     "lint": "prettier --check . && cd client && npm run lint",
@@ -43,10 +44,10 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.14.3",
-    "@modelcontextprotocol/inspector-client": "^0.14.3",
-    "@modelcontextprotocol/inspector-server": "^0.14.3",
-    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@modelcontextprotocol/inspector-cli": "^0.16.0",
+    "@modelcontextprotocol/inspector-client": "^0.16.0",
+    "@modelcontextprotocol/inspector-server": "^0.16.0",
+    "@modelcontextprotocol/sdk": "^1.13.1",
     "concurrently": "^9.0.1",
     "open": "^10.1.0",
     "shell-quote": "^1.8.2",
@@ -55,6 +56,7 @@
     "zod": "^3.23.8"
   },
   "devDependencies": {
+    "@playwright/test": "^1.52.0",
     "@types/jest": "^29.5.14",
     "@types/node": "^22.7.5",
     "@types/shell-quote": "^1.7.5",
@@ -62,5 +64,8 @@
     "prettier": "3.3.3",
     "rimraf": "^6.0.1",
     "typescript": "^5.4.2"
+  },
+  "engines": {
+    "node": ">=22.7.5"
   }
 }

package/server/build/index.js

@@ -11,6 +11,7 @@ import express from "express";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
+const DEFAULT_MCP_PROXY_LISTEN_PORT = "6277";
 const SSE_HEADERS_PASSTHROUGH = ["authorization"];
 const STREAMABLE_HTTP_HEADERS_PASSTHROUGH = [
     "authorization",
@@ -65,18 +66,18 @@ app.use((req, res, next) => {
 });
 const webAppTransports = new Map(); // Web app transports by web app sessionId
 const serverTransports = new Map(); // Server Transports by web app sessionId
-const sessionToken = randomBytes(32).toString("hex");
+// Use provided token from environment or generate a new one
+const sessionToken = process.env.MCP_PROXY_TOKEN || randomBytes(32).toString("hex");
 const authDisabled = !!process.env.DANGEROUSLY_OMIT_AUTH;
 // Origin validation middleware to prevent DNS rebinding attacks
 const originValidationMiddleware = (req, res, next) => {
     const origin = req.headers.origin;
     // Default origins based on CLIENT_PORT or use environment variable
     const clientPort = process.env.CLIENT_PORT || "6274";
-    const defaultOrigins = [
-        `http://localhost:${clientPort}`,
-        `http://127.0.0.1:${clientPort}`,
+    const defaultOrigin = `http://localhost:${clientPort}`;
+    const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [
+        defaultOrigin,
     ];
-    const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || defaultOrigins;
     if (origin && !allowedOrigins.includes(origin)) {
         console.error(`Invalid origin: ${origin}`);
         res.status(403).json({
@@ -404,18 +405,14 @@ app.get("/config", originValidationMiddleware, authMiddleware, (req, res) => {
         res.status(500).json(error);
     }
 });
-const PORT = parseInt(process.env.PORT || "6277", 10);
-const HOST = process.env.HOST || "127.0.0.1";
+const PORT = parseInt(process.env.SERVER_PORT || DEFAULT_MCP_PROXY_LISTEN_PORT, 10);
+const HOST = process.env.HOST || "localhost";
 const server = app.listen(PORT, HOST);
 server.on("listening", () => {
     console.log(`⚙️ Proxy server listening on ${HOST}:${PORT}`);
     if (!authDisabled) {
-        console.log(`🔑 Session token: ${sessionToken}`);
-        console.log(`Use this token to authenticate requests or set DANGEROUSLY_OMIT_AUTH=true to disable auth`);
-        // Display clickable URL with pre-filled token
-        const clientPort = process.env.CLIENT_PORT || "6274";
-        const clientUrl = `http://localhost:${clientPort}/?MCP_PROXY_AUTH_TOKEN=${sessionToken}`;
-        console.log(`\n🔗 Open inspector with token pre-filled:\n   ${clientUrl}\n   (Auto-open is disabled when authentication is enabled)\n`);
+        console.log(`🔑 Session token: ${sessionToken}\n   ` +
+            `Use this token to authenticate requests or set DANGEROUSLY_OMIT_AUTH=true to disable auth`);
     }
     else {
         console.log(`⚠️  WARNING: Authentication is disabled. This is not recommended.`);

package/server/build/mcpProxy.js

@@ -3,11 +3,12 @@ function onClientError(error) {
     console.error("Error from inspector client:", error);
 }
 function onServerError(error) {
-    if ((error?.message &&
-        error.message.includes("Error POSTing to endpoint (HTTP 404)")) ||
-        (error?.cause && JSON.stringify(error.cause).includes("ECONNREFUSED"))) {
+    if (error?.cause && JSON.stringify(error.cause).includes("ECONNREFUSED")) {
         console.error("Connection refused. Is the MCP server running?");
     }
+    else if (error.message && error.message.includes("404")) {
+        console.error("Error accessing endpoint (HTTP 404)");
+    }
     else {
         console.error("Error from MCP server:", error);
     }