@modelcontextprotocol/inspector 1.0.0 → 1.0.2

package/client/dist/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-DjSLdS7f.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BlUSNvoM.css">
+    <script type="module" crossorigin src="/assets/index-DdyO6kfY.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DXy0twoH.css">
   </head>
   <body>
     <div id="root" class="w-full"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -42,19 +42,20 @@
     "start-client": "cd client && npm run preview",
     "test": "npm run prettier-check && cd client && npm test",
     "test-cli": "cd cli && npm run test",
+    "test-server": "cd server && npm run test",
     "test:e2e": "MCP_AUTO_OPEN_ENABLED=false npm run test:e2e --workspace=client",
     "prettier-fix": "prettier --write .",
     "prettier-check": "prettier --check .",
     "lint": "prettier --check . && cd client && npm run lint",
     "prepare": "husky && npm run build",
-    "publish-all": "npm publish --workspaces --access public && npm publish --access public",
+    "publish-all": "npm publish --workspaces --access public --tag v1-latest && npm publish --access public --tag v1-latest",
     "update-version": "node scripts/update-version.js",
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^1.0.0",
-    "@modelcontextprotocol/inspector-client": "^1.0.0",
-    "@modelcontextprotocol/inspector-server": "^1.0.0",
+    "@modelcontextprotocol/inspector-cli": "^1.0.2",
+    "@modelcontextprotocol/inspector-client": "^1.0.2",
+    "@modelcontextprotocol/inspector-server": "^1.0.2",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
@@ -80,13 +81,20 @@
   "overrides": {
     "get-intrinsic": "1.3.0",
     "shell-quote": "^1.8.4",
-    "hono": "^4.12.25",
+    "hono": "^4.13.3",
     "form-data": "^4.0.6",
     "@babel/core@<=7.29.0": "^7.29.6",
     "esbuild@<0.28.1": "^0.28.1",
     "minimatch@<3.1.4": "3.1.5",
-    "js-yaml@<4": "3.15.0",
-    "js-yaml@>=4": "4.2.0"
+    "js-yaml@<4": "3.15.1",
+    "js-yaml@>=4": "4.3.1",
+    "@hono/node-server@<1.19.15": "^1.19.15",
+    "ip-address@<=10.3.0": "^10.5.0",
+    "fast-uri@<3.1.5": "^3.1.5",
+    "brace-expansion@<2": "^1.1.18",
+    "brace-expansion@>=4": "^5.0.9",
+    "nanoid@<3.3.18": "^3.3.18",
+    "postcss@<=8.5.22": "^8.5.26"
   },
   "engines": {
     "node": ">=22.7.5"
@@ -95,5 +103,9 @@
     "**/*.{js,ts,jsx,tsx,json,md}": [
       "prettier --write"
     ]
+  },
+  "allowScripts": {
+    "esbuild": false,
+    "fsevents": false
   }
 }

package/server/build/index.js

@@ -3,6 +3,7 @@ import cors from "cors";
 import { parseArgs } from "node:util";
 import { parse as shellParseArgs } from "shell-quote";
 import nodeFetch, { Headers as NodeHeaders } from "node-fetch";
+import { assertSafeProxyTarget, createPinnedAgent, ProxyTargetError, } from "./proxy-security.js";
 // Type-compatible wrappers for node-fetch to work with browser-style types
 const fetch = nodeFetch;
 const Headers = NodeHeaders;
@@ -16,8 +17,6 @@ import rateLimit from "express-rate-limit";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
-import { lookup as dnsLookup } from "node:dns/promises";
-import { isIP } from "node:net";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
 import { readFileSync } from "fs";
@@ -675,83 +674,16 @@ app.get("/health", (req, res) => {
         status: "ok",
     });
 });
-// Raised when the /fetch proxy is asked to reach a disallowed target, so the
-// route can distinguish an SSRF rejection (403) from an upstream failure (500).
-class ProxyTargetError extends Error {
-}
 const MAX_PROXY_REDIRECTS = 5;
-// The /fetch proxy is used by the client to reach OAuth discovery/token
-// endpoints on the connected MCP server (bypassing browser CORS). Connecting
-// to loopback and RFC1918/private LAN hosts is a core use case (testing local
-// or self-hosted MCP servers), so those stay reachable. We only block
-// link-local addresses — 169.254.0.0/16 (the AWS/GCP/Azure/etc. cloud metadata
-// endpoint 169.254.169.254 lives here) and IPv6 link-local / the AWS IPv6 IMDS
-// address — which are never legitimate proxy targets and are the real SSRF
-// exfiltration vector.
-function isBlockedProxyAddress(ip) {
-    const kind = isIP(ip);
-    if (kind === 4) {
-        const parts = ip.split(".").map(Number);
-        // 169.254.0.0/16 — IPv4 link-local (incl. cloud metadata 169.254.169.254)
-        return parts[0] === 169 && parts[1] === 254;
-    }
-    if (kind === 6) {
-        const addr = ip.toLowerCase();
-        // IPv4-mapped IPv6 (::ffff:x). The WHATWG URL parser serializes the embedded
-        // IPv4 in hex (::ffff:a9fe:a9fe for 169.254.169.254), while DNS and other
-        // sources may use the dotted form (::ffff:169.254.169.254) — handle both by
-        // extracting the IPv4 and re-checking it.
-        const mapped = addr.match(/^::ffff:(.+)$/);
-        if (mapped) {
-            const tail = mapped[1];
-            if (isIP(tail) === 4) {
-                return isBlockedProxyAddress(tail);
-            }
-            const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
-            if (hex) {
-                const high = parseInt(hex[1], 16);
-                const low = parseInt(hex[2], 16);
-                return isBlockedProxyAddress(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);
-            }
-        }
-        // fe80::/10 — IPv6 link-local
-        if (/^fe[89ab]/.test(addr)) {
-            return true;
-        }
-        // fd00:ec2::254 — AWS IPv6 instance metadata endpoint
-        return addr === "fd00:ec2::254";
-    }
-    return false;
-}
-// Resolves the target host and rejects it if any resolved address is a blocked
-// (link-local/metadata) address, mitigating SSRF including the DNS case where a
-// hostname resolves to the cloud metadata IP.
-async function assertSafeProxyTarget(parsedUrl) {
-    const host = parsedUrl.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
-    let addresses;
-    if (isIP(host)) {
-        addresses = [host];
-    }
-    else {
-        try {
-            addresses = (await dnsLookup(host, { all: true })).map((r) => r.address);
-        }
-        catch {
-            throw new ProxyTargetError(`Could not resolve host: ${host}`);
-        }
-    }
-    if (addresses.length === 0) {
-        throw new ProxyTargetError(`Could not resolve host: ${host}`);
-    }
-    for (const address of addresses) {
-        if (isBlockedProxyAddress(address)) {
-            throw new ProxyTargetError(`Refusing to proxy request to blocked address (${address})`);
-        }
-    }
-}
 // Fetch that follows redirects manually so every hop's target is re-validated
 // against assertSafeProxyTarget — otherwise an allowed host could redirect the
 // proxy into a blocked internal/metadata address.
+//
+// On each hop we call assertSafeProxyTarget (which resolves DNS and validates
+// every returned IP) and then pass a createPinnedAgent to node-fetch so it
+// connects to the IP we just validated instead of re-resolving the hostname.
+// This eliminates the TOCTOU window between the block-list check and the
+// actual TCP connection that a DNS-rebinding attack would exploit.
 async function safeProxyFetch(initialUrl, init) {
     let currentUrl = new URL(initialUrl);
     let method = init?.method ?? "GET";
@@ -761,12 +693,18 @@ async function safeProxyFetch(initialUrl, init) {
         if (!["http:", "https:"].includes(currentUrl.protocol)) {
             throw new ProxyTargetError("Only http/https URLs are allowed");
         }
-        await assertSafeProxyTarget(currentUrl);
+        // Resolve DNS once, validate every address, and pin the connection to that
+        // validated set so node-fetch never does a second DNS lookup. All of them
+        // are passed through, so Node's address-family fallback still works while
+        // the reachable set stays limited to what was just validated.
+        const validatedAddresses = await assertSafeProxyTarget(currentUrl);
+        const agent = createPinnedAgent(currentUrl.protocol, validatedAddresses);
         const response = await fetch(currentUrl.toString(), {
             method,
             headers,
             body,
             redirect: "manual",
+            agent,
         });
         if (response.status >= 300 && response.status < 400) {
             const location = response.headers.get("location");
@@ -866,6 +804,9 @@ const PORT = parseInt(process.env.SERVER_PORT || DEFAULT_MCP_PROXY_LISTEN_PORT,
 const HOST = process.env.HOST || "localhost";
 const server = app.listen(PORT, HOST);
 server.on("listening", () => {
+    console.log(`\n⚠️  @modelcontextprotocol/inspector v1 is deprecated.\n` +
+        `    Upgrade:  npx @modelcontextprotocol/inspector@latest\n` +
+        `    v1 receives security fixes only.\n`);
     console.log(`⚙️ Proxy server listening on ${HOST}:${PORT}`);
     if (!authDisabled) {
         console.log(`🔑 Session token: ${sessionToken}\n   ` +

package/server/build/proxy-security.js

@@ -0,0 +1,154 @@
+/**
+ * SSRF-prevention helpers for the /fetch reverse proxy.
+ *
+ * Extracted from index.ts so they can be unit-tested independently.
+ *
+ * ## DNS-rebinding / TOCTOU threat model
+ *
+ * `assertSafeProxyTarget` resolves the target hostname and validates every
+ * returned IP against the block-list.  The resolved IPs are returned to the
+ * caller so they can be passed to `createPinnedAgent`, which builds an
+ * http/https.Agent whose `lookup` callback unconditionally returns the
+ * pre-validated IP.  The agent is then passed to `node-fetch`, which calls the
+ * lookup hook instead of doing its own DNS query.
+ *
+ * Without this pinning there is a TOCTOU race: an attacker who controls the
+ * target domain can flip its DNS record to 169.254.169.254 (AWS/GCP/Azure
+ * instance-metadata) in the window between `assertSafeProxyTarget` returning
+ * and `fetch` performing its own resolution.  Pinning eliminates that window.
+ */
+import http from "node:http";
+import https from "node:https";
+import { isIP } from "node:net";
+import { lookup as dnsLookup } from "node:dns/promises";
+// ---------------------------------------------------------------------------
+// Block-list
+// ---------------------------------------------------------------------------
+/**
+ * Returns true if `ip` is a link-local or cloud-metadata address that must
+ * never be reachable through the proxy.
+ *
+ * Blocked ranges:
+ *  - 169.254.0.0/16  (IPv4 link-local; includes 169.254.169.254 IMDS)
+ *  - ::ffff:169.254.x.x  (IPv4-mapped IPv6 variants of the above)
+ *  - fe80::/10  (IPv6 link-local)
+ *  - fd00:ec2::254  (AWS IPv6 instance-metadata)
+ */
+export function isBlockedProxyAddress(ip) {
+    const kind = isIP(ip);
+    if (kind === 4) {
+        const parts = ip.split(".").map(Number);
+        return parts[0] === 169 && parts[1] === 254;
+    }
+    if (kind === 6) {
+        const addr = ip.toLowerCase();
+        // IPv4-mapped IPv6 — two serialization forms:
+        //   dotted   ::ffff:169.254.169.254
+        //   hex      ::ffff:a9fe:a9fe
+        const mapped = addr.match(/^::ffff:(.+)$/);
+        if (mapped) {
+            const tail = mapped[1];
+            if (isIP(tail) === 4) {
+                return isBlockedProxyAddress(tail);
+            }
+            const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+            if (hex) {
+                const high = parseInt(hex[1], 16);
+                const low = parseInt(hex[2], 16);
+                return isBlockedProxyAddress(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);
+            }
+        }
+        if (/^fe[89ab]/.test(addr))
+            return true; // fe80::/10
+        return addr === "fd00:ec2::254"; // AWS IPv6 IMDS
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// DNS validation
+// ---------------------------------------------------------------------------
+/** Raised when the /fetch proxy is asked to reach a disallowed target. */
+export class ProxyTargetError extends Error {
+}
+/**
+ * Resolves `parsedUrl`'s hostname and asserts that every returned IP is
+ * outside the block-list.
+ *
+ * Returns the list of validated IP strings so the caller can pin one of them
+ * into an HTTP agent (see `createPinnedAgent`), eliminating the TOCTOU window
+ * between this check and the actual `fetch()` call.
+ *
+ * @throws {ProxyTargetError} if the host cannot be resolved or any resolved
+ *   address falls inside the block-list.
+ */
+export async function assertSafeProxyTarget(parsedUrl) {
+    const host = parsedUrl.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
+    let addresses;
+    if (isIP(host)) {
+        addresses = [host];
+    }
+    else {
+        try {
+            addresses = (await dnsLookup(host, { all: true })).map((r) => r.address);
+        }
+        catch {
+            throw new ProxyTargetError(`Could not resolve host: ${host}`);
+        }
+    }
+    if (addresses.length === 0) {
+        throw new ProxyTargetError(`Could not resolve host: ${host}`);
+    }
+    for (const address of addresses) {
+        if (isBlockedProxyAddress(address)) {
+            throw new ProxyTargetError(`Refusing to proxy request to blocked address (${address})`);
+        }
+    }
+    return addresses;
+}
+// ---------------------------------------------------------------------------
+// IP-pinned agent factory
+// ---------------------------------------------------------------------------
+/**
+ * Creates an `http.Agent` or `https.Agent` whose internal `lookup` hook always
+ * returns `pinnedIps`, bypassing the OS resolver entirely.
+ *
+ * Pass this agent to `node-fetch` on every hop of `safeProxyFetch` so the TCP
+ * connection always goes to an IP that was validated by `assertSafeProxyTarget`
+ * — even if the domain's DNS record changes mid-flight.
+ *
+ * Every address `assertSafeProxyTarget` returned is handed to the hook, not
+ * just the first, so Node keeps its normal address-family fallback: a
+ * dual-stack host whose first address is unreachable (IPv6 on an IPv4-only
+ * network, say) still connects via a later one. The set it may choose from is
+ * exactly the prevalidated set, so the TOCTOU guarantee is unchanged.
+ *
+ * @param protocol - `"http:"` or `"https:"` (from `URL.protocol`)
+ * @param pinnedIps - Validated IPv4/IPv6 address strings, in preference order
+ */
+export function createPinnedAgent(protocol, pinnedIps) {
+    if (pinnedIps.length === 0) {
+        throw new ProxyTargetError("No validated address to connect to");
+    }
+    const resolved = pinnedIps.map((address) => ({
+        address,
+        family: isIP(address) === 6 ? 6 : 4,
+    }));
+    // Node.js lookup signature: (hostname, options, callback).
+    //
+    // The callback shape depends on `options.all`. Node's `net.connect` runs with
+    // `autoSelectFamily` enabled by default (Node >= 20), so it calls the hook
+    // with `{ all: true }` and expects an ARRAY of `{ address, family }` — handing
+    // it the scalar form there fails the connection with ERR_INVALID_IP_ADDRESS.
+    // Both shapes are supported so the agent works on either call path.
+    const lookup = (_hostname, opts, callback) => {
+        if (opts?.all) {
+            callback(null, resolved);
+            return;
+        }
+        callback(null, resolved[0].address, resolved[0].family);
+    };
+    if (protocol === "https:") {
+        return new https.Agent({ lookup });
+    }
+    return new http.Agent({ lookup });
+}