2.0.0

The v2 Inspector is now the default release.

npx @modelcontextprotocol/inspector          # web UI
npx @modelcontextprotocol/inspector --cli    # CLI
npx @modelcontextprotocol/inspector --tui    # TUI

What's new

v2 ships as a single package with three clients — a Vite + React + Mantine web UI, a scriptable CLI, and an Ink-based TUI — over a shared @inspector/core runtime, so all three behave identically.

Upgrading from v1

• Node >= 22.19.0 is now required (was >= 22.7.5).
• CLI flags changed substantially. In particular --config now means a read-only session file; --catalog is the writable server list. See MCP server configuration.
• The v1 sub-packages (inspector-client, inspector-server, inspector-cli) are deprecated and not part of v2 — v2 publishes a single package.

v1

v1 is deprecated and receives security fixes only, published under the v1-latest tag:

npm i @modelcontextprotocol/inspector@v1-latest

2.0.0-rc.3

Release candidate for 2.0.0.

Adds the vite 8.1.5 bump on top of rc.2, closing three high-severity dev-server file-read advisories.

Published under the next dist-tag — latest remains on 1.0.1.

Install: npx @modelcontextprotocol/inspector@next

Prerelease for validating the publish pipeline (#1818). Not for general use.

2.0.0-rc.2

Release candidate for 2.0.0, with all runtime dependency vulnerabilities cleared.

Published under the next dist-tag — latest remains on 1.0.1.

Install: npx @modelcontextprotocol/inspector@next

Prerelease for validating the publish pipeline against the swept dependency tree (#1818). Not for general use.

2.0.0-rc.1

Release candidate for 2.0.0. Published under the next dist-tag — latest remains on 1.0.1.

Install: npx @modelcontextprotocol/inspector@next

Prerelease for validating the publish pipeline (#1818). Not for general use.

1.0.1 — v1 deprecated

v1 is deprecated. Use @modelcontextprotocol/inspector@latest (v2). v1 receives security fixes only.

1.0.0

Versioning Note

Since this should be the last release of the classic MCP Inspector, it is finally being promoted to 1.0.0, primarily so that it can be referred to as the V1 implementation. It fixes outstanding security warnings and includes a couple of bug fixes.

Along with the release of the the upcoming 2026-07-28 MCP specification, we will be publishing an entirely new Inspector with a completely different codebase. The V2 web-based inspector client, the CLI, and a new TUI — all of which have a shared code architecture — will all ship as a single npm package. The V1 Inspector package will be officially deprecated at that time, and no further work will be done on that line.

What's Changed

• fix: call tasks/result when task status is input_required by @galagaevdc in #1174
• Fix resource refresh button not triggering re-fetch by @olaservo in #1148
• chore: pin prettier to 3.9.5 and run format check after install by @cliffhall in #1716
• chore(deps): bump vitest to ^4.1.0 (CVE fix) by @cliffhall in #1707
• chore(deps): bump vite to ^7.3.5 (CVE fixes) by @cliffhall in #1709
• chore(deps): bump shell-quote to ^1.8.4 (CVE fix) by @cliffhall in #1711
• chore(deps): override hono to ^4.12.25 (CVE fixes) by @cliffhall in #1708
• chore(deps): override form-data to ^4.0.6 (CVE fix) by @cliffhall in #1710
• chore(deps): override @babel/core to ^7.29.6 (CVE fix) by @cliffhall in #1712
• chore(deps): finalize security overrides and regenerate lockfile by @cliffhall in #1718
• fix(server): guard the /fetch proxy against SSRF to link-local/metadata (alert 53) by @cliffhall in #1717
• Bump to version 1.0.0 by @cliffhall in #1720

New Contributors

• @galagaevdc made their first contribution in #1174

Full Changelog: 0.22.0...1.0.0

0.22.0

What's Changed

• ci: switch npm publish to OIDC trusted publishing by @pcarleton in #1199
• Update package.json to contain repository.url in for npm trusted publisher setup by @cliffhall in #1201
• fix: add repository field to workspace package.json files for npm trusted publishing by @cliffhall in #1202
• ci: gate claude.yml on author_association to skip unauthorized invokes by @cliffhall in #1270
• chore(deps): npm audit fix for transitive security advisories by @olaservo in #1380
• feat: add URL-mode elicitation support by @cliffhall in #1423
• chore: bump version to 0.22.0 by @Copilot in #1428

Full Changelog: 0.21.2...0.22.0

0.21.2

What's Changed

• Fix decimal typing behavior for number inputs in tools form by @MumuTW in #1127
• fix: ensure DCR always registers both redirect URIs by @asoorm in #1173
• fix: add horizontal scrolling for long values in json view by @Dinesht04 in #1177
• Inspector client: Added proxy fetch for use by auth (to avoid CORS issues) by @BobDickinson in #1047
• chore(deps): bump hono from 4.12.1 to 4.12.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1117
• chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #1125
• chore(deps): bump actions/attest-build-provenance from 3 to 4 by @dependabot[bot] in #1126
• chore(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #1136
• chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #1137
• chore(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #1138
• fix: validate serverInfo.websiteUrl before rendering as link by @cliffhall in #1186
• fix(server): sanitize error responses to prevent stack trace exposure by @cliffhall in #1187
• chore: bump version to 0.21.2 by @olaservo in #1194
• ci: switch npm publish to OIDC trusted publishing by @pcarleton in #1199
• Update package.json to contain repository.url in for npm trusted publisher setup by @cliffhall in #1201
• fix: add repository field to workspace package.json files for npm trusted publishing by @cliffhall in #1202

New Contributors

• @MumuTW made their first contribution in #1127
• @Dinesht04 made their first contribution in #1177

Full Changelog: 0.21.1...0.21.2-hotfix-3

0.21.1

What's Changed

• fix: include server/static in published package files by @jwoods02 in #1113
• Remove misleading structured content compatibility warning by @olaservo in #1098
• chore: bump version to 0.21.1 by @Copilot in #1116

New Contributors

• @jwoods02 made their first contribution in #1113

Full Changelog: 0.21.0...0.21.1

0.21.0

What's Changed

• Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #1057
• Bump actions/upload-artifact from 4 to 6 by @dependabot[bot] in #1058
• Bump actions/attest-build-provenance from 2 to 3 by @dependabot[bot] in #1059
• Bump actions/cache from 4 to 5 by @dependabot[bot] in #1060
• Bump actions/github-script from 7 to 8 by @dependabot[bot] in #1061
• fix: display tool title field in Inspector UI by @olaservo in #1054
• Bump actions/checkout from 4 to 6 by @dependabot[bot] in #1079
• fix: enhance resolution and enum handling in anyOf schemas by @Edison-A-N in #901
• fix: include LICENSE file in published npm packages by @olaservo in #1055
• feat(client): display tool annotations in Tools tab by @olaservo in #1066
• Bump qs from 6.14.1 to 6.14.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1088
• fix: add missing tool result to AppsRenderer by @infoxicator in #1075
• Update SECURITY.md to use GitHub Security Advisories by @localden in #1097
• oauth: add tenant suffix to oauth flow by @howardjohn in #1096
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1106
• Manage display of "Run as Task" checkbox on Tools Tab by @cliffhall in #1072
• chore: bump version to 0.21.0 by @Copilot in #1112

New Contributors

• @Edison-A-N made their first contribution in #901
• @infoxicator made their first contribution in #1075
• @localden made their first contribution in #1097

Full Changelog: 0.20.0...0.21.0