@modelcontextprotocol/inspector 0.22.0 → 1.0.0

package/client/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-CngsKvMW.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CfzB1GD8.css">
+    <script type="module" crossorigin src="/assets/index-DjSLdS7f.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BlUSNvoM.css">
   </head>
   <body>
     <div id="root" class="w-full"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.22.0",
+  "version": "1.0.0",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -52,14 +52,14 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.22.0",
-    "@modelcontextprotocol/inspector-client": "^0.22.0",
-    "@modelcontextprotocol/inspector-server": "^0.22.0",
+    "@modelcontextprotocol/inspector-cli": "^1.0.0",
+    "@modelcontextprotocol/inspector-client": "^1.0.0",
+    "@modelcontextprotocol/inspector-server": "^1.0.0",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
     "open": "^10.2.0",
-    "shell-quote": "^1.8.3",
+    "shell-quote": "^1.8.4",
     "spawn-rx": "^5.1.2",
     "ts-node": "^10.9.2",
     "zod": "^3.25.76"
@@ -73,12 +73,20 @@
     "jest-fixed-jsdom": "^0.0.9",
     "lint-staged": "^16.1.5",
     "playwright": "^1.56.1",
-    "prettier": "^3.7.1",
+    "prettier": "3.9.5",
     "rimraf": "^6.0.1",
     "typescript": "^5.4.2"
   },
   "overrides": {
-    "get-intrinsic": "1.3.0"
+    "get-intrinsic": "1.3.0",
+    "shell-quote": "^1.8.4",
+    "hono": "^4.12.25",
+    "form-data": "^4.0.6",
+    "@babel/core@<=7.29.0": "^7.29.6",
+    "esbuild@<0.28.1": "^0.28.1",
+    "minimatch@<3.1.4": "3.1.5",
+    "js-yaml@<4": "3.15.0",
+    "js-yaml@>=4": "4.2.0"
   },
   "engines": {
     "node": ">=22.7.5"

package/server/build/index.js

@@ -16,6 +16,8 @@ import rateLimit from "express-rate-limit";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
 import { readFileSync } from "fs";
@@ -673,6 +675,116 @@ app.get("/health", (req, res) => {
         status: "ok",
     });
 });
+// Raised when the /fetch proxy is asked to reach a disallowed target, so the
+// route can distinguish an SSRF rejection (403) from an upstream failure (500).
+class ProxyTargetError extends Error {
+}
+const MAX_PROXY_REDIRECTS = 5;
+// The /fetch proxy is used by the client to reach OAuth discovery/token
+// endpoints on the connected MCP server (bypassing browser CORS). Connecting
+// to loopback and RFC1918/private LAN hosts is a core use case (testing local
+// or self-hosted MCP servers), so those stay reachable. We only block
+// link-local addresses — 169.254.0.0/16 (the AWS/GCP/Azure/etc. cloud metadata
+// endpoint 169.254.169.254 lives here) and IPv6 link-local / the AWS IPv6 IMDS
+// address — which are never legitimate proxy targets and are the real SSRF
+// exfiltration vector.
+function isBlockedProxyAddress(ip) {
+    const kind = isIP(ip);
+    if (kind === 4) {
+        const parts = ip.split(".").map(Number);
+        // 169.254.0.0/16 — IPv4 link-local (incl. cloud metadata 169.254.169.254)
+        return parts[0] === 169 && parts[1] === 254;
+    }
+    if (kind === 6) {
+        const addr = ip.toLowerCase();
+        // IPv4-mapped IPv6 (::ffff:x). The WHATWG URL parser serializes the embedded
+        // IPv4 in hex (::ffff:a9fe:a9fe for 169.254.169.254), while DNS and other
+        // sources may use the dotted form (::ffff:169.254.169.254) — handle both by
+        // extracting the IPv4 and re-checking it.
+        const mapped = addr.match(/^::ffff:(.+)$/);
+        if (mapped) {
+            const tail = mapped[1];
+            if (isIP(tail) === 4) {
+                return isBlockedProxyAddress(tail);
+            }
+            const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+            if (hex) {
+                const high = parseInt(hex[1], 16);
+                const low = parseInt(hex[2], 16);
+                return isBlockedProxyAddress(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);
+            }
+        }
+        // fe80::/10 — IPv6 link-local
+        if (/^fe[89ab]/.test(addr)) {
+            return true;
+        }
+        // fd00:ec2::254 — AWS IPv6 instance metadata endpoint
+        return addr === "fd00:ec2::254";
+    }
+    return false;
+}
+// Resolves the target host and rejects it if any resolved address is a blocked
+// (link-local/metadata) address, mitigating SSRF including the DNS case where a
+// hostname resolves to the cloud metadata IP.
+async function assertSafeProxyTarget(parsedUrl) {
+    const host = parsedUrl.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
+    let addresses;
+    if (isIP(host)) {
+        addresses = [host];
+    }
+    else {
+        try {
+            addresses = (await dnsLookup(host, { all: true })).map((r) => r.address);
+        }
+        catch {
+            throw new ProxyTargetError(`Could not resolve host: ${host}`);
+        }
+    }
+    if (addresses.length === 0) {
+        throw new ProxyTargetError(`Could not resolve host: ${host}`);
+    }
+    for (const address of addresses) {
+        if (isBlockedProxyAddress(address)) {
+            throw new ProxyTargetError(`Refusing to proxy request to blocked address (${address})`);
+        }
+    }
+}
+// Fetch that follows redirects manually so every hop's target is re-validated
+// against assertSafeProxyTarget — otherwise an allowed host could redirect the
+// proxy into a blocked internal/metadata address.
+async function safeProxyFetch(initialUrl, init) {
+    let currentUrl = new URL(initialUrl);
+    let method = init?.method ?? "GET";
+    let body = init?.body;
+    const headers = init?.headers ?? {};
+    for (let hop = 0; hop <= MAX_PROXY_REDIRECTS; hop++) {
+        if (!["http:", "https:"].includes(currentUrl.protocol)) {
+            throw new ProxyTargetError("Only http/https URLs are allowed");
+        }
+        await assertSafeProxyTarget(currentUrl);
+        const response = await fetch(currentUrl.toString(), {
+            method,
+            headers,
+            body,
+            redirect: "manual",
+        });
+        if (response.status >= 300 && response.status < 400) {
+            const location = response.headers.get("location");
+            if (!location) {
+                return response;
+            }
+            currentUrl = new URL(location, currentUrl);
+            // Mirror browser/fetch semantics: 301/302/303 downgrade to a bodyless GET.
+            if ([301, 302, 303].includes(response.status)) {
+                method = "GET";
+                body = undefined;
+            }
+            continue;
+        }
+        return response;
+    }
+    throw new ProxyTargetError("Too many redirects");
+}
 app.post("/fetch", express.json(), originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
         const { url, init } = req.body;
@@ -692,11 +804,17 @@ app.post("/fetch", express.json(), originValidationMiddleware, authMiddleware, a
             res.status(400).json({ error: "Only http/https URLs are allowed" });
             return;
         }
-        const response = await fetch(url, {
-            method: init?.method ?? "GET",
-            headers: init?.headers ?? {},
-            body: init?.body,
-        });
+        let response;
+        try {
+            response = await safeProxyFetch(url, init);
+        }
+        catch (error) {
+            if (error instanceof ProxyTargetError) {
+                res.status(403).json({ error: error.message });
+                return;
+            }
+            throw error;
+        }
         const responseBody = await response.text();
         const headers = {};
         response.headers.forEach((value, key) => {