@modelcontextprotocol/inspector 0.22.0 → 1.0.1

package/client/dist/assets/{index-CfzB1GD8.css → index-DXy0twoH.css}

@@ -65,11 +65,6 @@ code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-select
 	background: #b3d4fc;
 }
 
-pre[class*="language-"]::-moz-selection, pre[class*="language-"] ::-moz-selection, code[class*="language-"]::-moz-selection, code[class*="language-"] ::-moz-selection {
-	text-shadow: none;
-	background: #b3d4fc;
-}
-
 pre[class*="language-"]::selection, pre[class*="language-"] ::selection,
 code[class*="language-"]::selection, code[class*="language-"] ::selection {
 	text-shadow: none;
@@ -1023,6 +1018,9 @@ video {
 .max-h-screen {
   max-height: 100vh;
 }
+.min-h-0 {
+  min-height: 0px;
+}
 .min-h-\[100px\] {
   min-height: 100px;
 }
@@ -1371,6 +1369,10 @@ video {
 .border-transparent {
   border-color: transparent;
 }
+.border-yellow-300 {
+  --tw-border-opacity: 1;
+  border-color: rgb(253 224 71 / var(--tw-border-opacity, 1));
+}
 .border-t-transparent {
   border-top-color: transparent;
 }
@@ -1462,6 +1464,14 @@ video {
 .bg-transparent {
   background-color: transparent;
 }
+.bg-yellow-100 {
+  --tw-bg-opacity: 1;
+  background-color: rgb(254 249 195 / var(--tw-bg-opacity, 1));
+}
+.bg-yellow-200 {
+  --tw-bg-opacity: 1;
+  background-color: rgb(254 240 138 / var(--tw-bg-opacity, 1));
+}
 .object-contain {
   -o-object-fit: contain;
      object-fit: contain;
@@ -1748,6 +1758,10 @@ video {
   --tw-text-opacity: 1;
   color: rgb(202 138 4 / var(--tw-text-opacity, 1));
 }
+.text-yellow-900 {
+  --tw-text-opacity: 1;
+  color: rgb(113 63 18 / var(--tw-text-opacity, 1));
+}
 .underline-offset-4 {
   text-underline-offset: 4px;
 }
@@ -2017,6 +2031,11 @@ h1 {
   background-color: hsl(var(--secondary) / 0.8);
 }
 
+.hover\:bg-yellow-200:hover {
+  --tw-bg-opacity: 1;
+  background-color: rgb(254 240 138 / var(--tw-bg-opacity, 1));
+}
+
 .hover\:text-accent-foreground:hover {
   color: hsl(var(--accent-foreground));
 }
@@ -2436,6 +2455,11 @@ h1 {
   border-color: rgb(71 85 105 / var(--tw-border-opacity, 1));
 }
 
+.dark\:border-yellow-700:is(.dark *) {
+  --tw-border-opacity: 1;
+  border-color: rgb(161 98 7 / var(--tw-border-opacity, 1));
+}
+
 .dark\:bg-blue-900:is(.dark *) {
   --tw-bg-opacity: 1;
   background-color: rgb(30 58 138 / var(--tw-bg-opacity, 1));
@@ -2465,11 +2489,24 @@ h1 {
   background-color: rgb(127 29 29 / 0.2);
 }
 
+.dark\:bg-red-950\/30:is(.dark *) {
+  background-color: rgb(69 10 10 / 0.3);
+}
+
 .dark\:bg-slate-800:is(.dark *) {
   --tw-bg-opacity: 1;
   background-color: rgb(30 41 59 / var(--tw-bg-opacity, 1));
 }
 
+.dark\:bg-yellow-800:is(.dark *) {
+  --tw-bg-opacity: 1;
+  background-color: rgb(133 77 14 / var(--tw-bg-opacity, 1));
+}
+
+.dark\:bg-yellow-900\/40:is(.dark *) {
+  background-color: rgb(113 63 18 / 0.4);
+}
+
 .dark\:text-blue-200:is(.dark *) {
   --tw-text-opacity: 1;
   color: rgb(191 219 254 / var(--tw-text-opacity, 1));
@@ -2530,6 +2567,11 @@ h1 {
   color: rgb(255 255 255 / var(--tw-text-opacity, 1));
 }
 
+.dark\:text-yellow-100:is(.dark *) {
+  --tw-text-opacity: 1;
+  color: rgb(254 249 195 / var(--tw-text-opacity, 1));
+}
+
 .dark\:text-yellow-500:is(.dark *) {
   --tw-text-opacity: 1;
   color: rgb(234 179 8 / var(--tw-text-opacity, 1));
@@ -2552,6 +2594,11 @@ h1 {
   background-color: hsl(var(--secondary));
 }
 
+.dark\:hover\:bg-yellow-800:hover:is(.dark *) {
+  --tw-bg-opacity: 1;
+  background-color: rgb(133 77 14 / var(--tw-bg-opacity, 1));
+}
+
 .dark\:hover\:text-blue-300:hover:is(.dark *) {
   --tw-text-opacity: 1;
   color: rgb(147 197 253 / var(--tw-text-opacity, 1));

package/client/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-CngsKvMW.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CfzB1GD8.css">
+    <script type="module" crossorigin src="/assets/index-CH-qD91V.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DXy0twoH.css">
   </head>
   <body>
     <div id="root" class="w-full"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "0.22.0",
+  "version": "1.0.1",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -52,14 +52,14 @@
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^0.22.0",
-    "@modelcontextprotocol/inspector-client": "^0.22.0",
-    "@modelcontextprotocol/inspector-server": "^0.22.0",
+    "@modelcontextprotocol/inspector-cli": "^1.0.1",
+    "@modelcontextprotocol/inspector-client": "^1.0.1",
+    "@modelcontextprotocol/inspector-server": "^1.0.1",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
     "open": "^10.2.0",
-    "shell-quote": "^1.8.3",
+    "shell-quote": "^1.8.4",
     "spawn-rx": "^5.1.2",
     "ts-node": "^10.9.2",
     "zod": "^3.25.76"
@@ -73,12 +73,20 @@
     "jest-fixed-jsdom": "^0.0.9",
     "lint-staged": "^16.1.5",
     "playwright": "^1.56.1",
-    "prettier": "^3.7.1",
+    "prettier": "3.9.5",
     "rimraf": "^6.0.1",
     "typescript": "^5.4.2"
   },
   "overrides": {
-    "get-intrinsic": "1.3.0"
+    "get-intrinsic": "1.3.0",
+    "shell-quote": "^1.8.4",
+    "hono": "^4.12.25",
+    "form-data": "^4.0.6",
+    "@babel/core@<=7.29.0": "^7.29.6",
+    "esbuild@<0.28.1": "^0.28.1",
+    "minimatch@<3.1.4": "3.1.5",
+    "js-yaml@<4": "3.15.0",
+    "js-yaml@>=4": "4.2.0"
   },
   "engines": {
     "node": ">=22.7.5"

package/server/build/index.js

@@ -16,6 +16,8 @@ import rateLimit from "express-rate-limit";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
+import { lookup as dnsLookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
 import { readFileSync } from "fs";
@@ -673,6 +675,116 @@ app.get("/health", (req, res) => {
         status: "ok",
     });
 });
+// Raised when the /fetch proxy is asked to reach a disallowed target, so the
+// route can distinguish an SSRF rejection (403) from an upstream failure (500).
+class ProxyTargetError extends Error {
+}
+const MAX_PROXY_REDIRECTS = 5;
+// The /fetch proxy is used by the client to reach OAuth discovery/token
+// endpoints on the connected MCP server (bypassing browser CORS). Connecting
+// to loopback and RFC1918/private LAN hosts is a core use case (testing local
+// or self-hosted MCP servers), so those stay reachable. We only block
+// link-local addresses — 169.254.0.0/16 (the AWS/GCP/Azure/etc. cloud metadata
+// endpoint 169.254.169.254 lives here) and IPv6 link-local / the AWS IPv6 IMDS
+// address — which are never legitimate proxy targets and are the real SSRF
+// exfiltration vector.
+function isBlockedProxyAddress(ip) {
+    const kind = isIP(ip);
+    if (kind === 4) {
+        const parts = ip.split(".").map(Number);
+        // 169.254.0.0/16 — IPv4 link-local (incl. cloud metadata 169.254.169.254)
+        return parts[0] === 169 && parts[1] === 254;
+    }
+    if (kind === 6) {
+        const addr = ip.toLowerCase();
+        // IPv4-mapped IPv6 (::ffff:x). The WHATWG URL parser serializes the embedded
+        // IPv4 in hex (::ffff:a9fe:a9fe for 169.254.169.254), while DNS and other
+        // sources may use the dotted form (::ffff:169.254.169.254) — handle both by
+        // extracting the IPv4 and re-checking it.
+        const mapped = addr.match(/^::ffff:(.+)$/);
+        if (mapped) {
+            const tail = mapped[1];
+            if (isIP(tail) === 4) {
+                return isBlockedProxyAddress(tail);
+            }
+            const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+            if (hex) {
+                const high = parseInt(hex[1], 16);
+                const low = parseInt(hex[2], 16);
+                return isBlockedProxyAddress(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);
+            }
+        }
+        // fe80::/10 — IPv6 link-local
+        if (/^fe[89ab]/.test(addr)) {
+            return true;
+        }
+        // fd00:ec2::254 — AWS IPv6 instance metadata endpoint
+        return addr === "fd00:ec2::254";
+    }
+    return false;
+}
+// Resolves the target host and rejects it if any resolved address is a blocked
+// (link-local/metadata) address, mitigating SSRF including the DNS case where a
+// hostname resolves to the cloud metadata IP.
+async function assertSafeProxyTarget(parsedUrl) {
+    const host = parsedUrl.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
+    let addresses;
+    if (isIP(host)) {
+        addresses = [host];
+    }
+    else {
+        try {
+            addresses = (await dnsLookup(host, { all: true })).map((r) => r.address);
+        }
+        catch {
+            throw new ProxyTargetError(`Could not resolve host: ${host}`);
+        }
+    }
+    if (addresses.length === 0) {
+        throw new ProxyTargetError(`Could not resolve host: ${host}`);
+    }
+    for (const address of addresses) {
+        if (isBlockedProxyAddress(address)) {
+            throw new ProxyTargetError(`Refusing to proxy request to blocked address (${address})`);
+        }
+    }
+}
+// Fetch that follows redirects manually so every hop's target is re-validated
+// against assertSafeProxyTarget — otherwise an allowed host could redirect the
+// proxy into a blocked internal/metadata address.
+async function safeProxyFetch(initialUrl, init) {
+    let currentUrl = new URL(initialUrl);
+    let method = init?.method ?? "GET";
+    let body = init?.body;
+    const headers = init?.headers ?? {};
+    for (let hop = 0; hop <= MAX_PROXY_REDIRECTS; hop++) {
+        if (!["http:", "https:"].includes(currentUrl.protocol)) {
+            throw new ProxyTargetError("Only http/https URLs are allowed");
+        }
+        await assertSafeProxyTarget(currentUrl);
+        const response = await fetch(currentUrl.toString(), {
+            method,
+            headers,
+            body,
+            redirect: "manual",
+        });
+        if (response.status >= 300 && response.status < 400) {
+            const location = response.headers.get("location");
+            if (!location) {
+                return response;
+            }
+            currentUrl = new URL(location, currentUrl);
+            // Mirror browser/fetch semantics: 301/302/303 downgrade to a bodyless GET.
+            if ([301, 302, 303].includes(response.status)) {
+                method = "GET";
+                body = undefined;
+            }
+            continue;
+        }
+        return response;
+    }
+    throw new ProxyTargetError("Too many redirects");
+}
 app.post("/fetch", express.json(), originValidationMiddleware, authMiddleware, async (req, res) => {
     try {
         const { url, init } = req.body;
@@ -692,11 +804,17 @@ app.post("/fetch", express.json(), originValidationMiddleware, authMiddleware, a
             res.status(400).json({ error: "Only http/https URLs are allowed" });
             return;
         }
-        const response = await fetch(url, {
-            method: init?.method ?? "GET",
-            headers: init?.headers ?? {},
-            body: init?.body,
-        });
+        let response;
+        try {
+            response = await safeProxyFetch(url, init);
+        }
+        catch (error) {
+            if (error instanceof ProxyTargetError) {
+                res.status(403).json({ error: error.message });
+                return;
+            }
+            throw error;
+        }
         const responseBody = await response.text();
         const headers = {};
         response.headers.forEach((value, key) => {
@@ -748,6 +866,9 @@ const PORT = parseInt(process.env.SERVER_PORT || DEFAULT_MCP_PROXY_LISTEN_PORT,
 const HOST = process.env.HOST || "localhost";
 const server = app.listen(PORT, HOST);
 server.on("listening", () => {
+    console.log(`\n⚠️  @modelcontextprotocol/inspector v1 is deprecated.\n` +
+        `    Upgrade:  npx @modelcontextprotocol/inspector@latest\n` +
+        `    v1 receives security fixes only.\n`);
     console.log(`⚙️ Proxy server listening on ${HOST}:${PORT}`);
     if (!authDisabled) {
         console.log(`🔑 Session token: ${sessionToken}\n   ` +