Security changeddocs/2026-07-28/tools/inspector/security
Nearest release: v2.1.295, published 5 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 8 Oct 2026 12:58 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 20:07 UTC.
Upstream edited
Recorded here
Lines+16added
Lines−16removed
From line
26
where the diff opens
First seen
8 Oct 2026
this site's first read of the page
Recorded edits2to this page, all time
The whole hunk
from line 26, old and new numbered
/
from line 26
2626
2727The backend binds `127.0.0.1` by default. Binding every interface (`0.0.0.0`, `::` and equivalent spellings) is refused unless you set `DANGEROUSLY_BIND_ALL_INTERFACES=true`. Binding one specific address is allowed without that opt-in, because it is one deliberate exposure rather than all of them at once. See [Hosting on a network](/docs/2026-07-28/tools/inspector/recipes#hosting-on-a-network).
2828
29<Warning>
30 Never combine `DANGEROUSLY_OMIT_AUTH` with a non-loopback bind. If you need
31 the Inspector reachable by others, put a real access-control boundary in front
32 of it: an authenticating reverse proxy, an SSH tunnel, or a private network.
33</Warning>
29> [!WARNING]
30>
31> Never combine `DANGEROUSLY_OMIT_AUTH` with a non-loopback bind. If you need
32> the Inspector reachable by others, put a real access-control boundary in front
33> of it: an authenticating reverse proxy, an SSH tunnel, or a private network.
3434
3535## Docker
3636
from line 68
6868
6969### The automatic plaintext fallback
7070
71<Warning>
72 On a host where the OS keychain cannot be reached (Linux without libsecret or a running Secret Service, a headless server or SSH session with no D-Bus session, Android/Termux), the Inspector **automatically** stores secrets in `~/.mcp-inspector/secrets.json`. You do not have to ask for it, and unless you supply a key that file is **unencrypted**.
71> [!WARNING]
72>
73> On a host where the OS keychain cannot be reached (Linux without libsecret or a running Secret Service, a headless server or SSH session with no D-Bus session, Android/Termux), the Inspector **automatically** stores secrets in `~/.mcp-inspector/secrets.json`. You do not have to ask for it, and unless you supply a key that file is **unencrypted**.
74>
75> The only signs are a warning on stderr when the store is selected and a footer in the web client's settings dialogs.
7376
74 The only signs are a warning on stderr when the store is selected and a footer in the web client's settings dialogs.
75</Warning>
76
7777Treat that as a risk, not just a configuration fact. The file is written with mode `0600`, which keeps out other non-root users and nothing else. To close it, do one of the following:
7878
7979* get a keychain back (install libsecret and run a Secret Service such as `gnome-keyring`, or run inside a desktop session);
from line 145
145145
146146Tokens are compared in constant time. A request line larger than 1 MiB is rejected. A command presenting the wrong token to a live daemon fails loudly. It never replaces that daemon.
147147
148<Note>
149 Private mode separates connections and daemon state between shells. It is
150 **not** a security boundary against other processes running as your user:
151 anything with your UID that learns the daemon directory can read its token.
152 For a hard boundary, use a separate user account or a container.
153</Note>
148> [!NOTE]
149>
150> Private mode separates connections and daemon state between shells. It is
151> **not** a security boundary against other processes running as your user:
152> anything with your UID that learns the daemon directory can read its token.
153> For a hard boundary, use a separate user account or a container.
154154
155155### What it holds in memory
156156
No line in this hunk matches that.