Back to Home
modelcontextprotocol icon

inspector

by modelcontextprotocol

Overview

A web-based client and proxy server for inspecting and interacting with Model Context Protocol (MCP) servers, allowing users to browse resources, prompts, and tools, perform requests, and debug OAuth authentication flows.

Installation

Run Command
node client/bin/start.js

Environment Variables

  • PORT
  • HOST
  • DANGEROUSLY_OMIT_AUTH
  • ALLOWED_ORIGINS
  • CLIENT_PORT
  • SERVER_PORT
  • INSPECTOR_URL

Security Notes

The proxy server (`server/src/index.ts`) is designed to execute arbitrary commands and arguments (e.g., `command`, `args`, `env`) received via URL query parameters if the `stdio` transport is used. This is a critical remote code execution vulnerability if the proxy is exposed to untrusted networks or users. While potentially intended for local/trusted development environments, this design choice poses a severe risk. Additionally, the server can be configured with the `DANGEROUSLY_OMIT_AUTH` environment variable, bypassing its session token authentication and increasing exposure risk. The client-side OAuth implementation adheres to standard practices, but the proxy's inherent capability for arbitrary command execution significantly lowers the overall security score.

Similar Servers

Stats

Interest Score100
Security Score2
Cost ClassLow
Stars8342
Forks1097
Last Update2026-01-19

Tags

MCP ClientAPI InspectorDebugging ToolOAuth 2.0Proxy Server