Authorization changeddocs/draft/tools/inspector/authorization
Nearest release: v2.1.295, published 5 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 8 Oct 2026 12:58 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.
Upstream edited
Recorded here
Lines+11added
Lines−9removed
From line
2
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
The whole hunk
from line 2, old and new numbered
/
from line 2
22
33> How the MCP Inspector performs OAuth, re-authorizes mid-session, and shares tokens between its clients
44
5Remote MCP servers usually require authorization. The Inspector implements the full [authorization](/specification/latest/basic/authorization) flow in all three clients, sharing the resulting tokens on disk so a login done once is usable everywhere.
5Remote MCP servers usually require authorization. The Inspector implements the full [authorization](/specification/latest/basic/authorization.md) flow in all three clients, sharing the resulting tokens on disk so a login done once is usable everywhere.
66
77## The flow, end to end
88
from line 17
1717
1818The Inspector fetches the server's [protected-resource and
1919authorization-server
20metadata](/specification/latest/basic/authorization/authorization-server-discovery)
20metadata](/specification/latest/basic/authorization/authorization-server-discovery.md)
2121to learn the endpoints and the supported grants.
2222
2323**3. Register or identify the client**
from line 24
2424
2525The Inspector identifies itself to the authorization server through
2626whichever mechanism is configured: [dynamic client
27registration](/specification/latest/basic/authorization/client-registration#dynamic-client-registration),
27registration](/specification/latest/basic/authorization/client-registration.md#dynamic-client-registration),
2828a pre-registered static client (`--client-id` / `--client-secret`), a
2929[Client ID Metadata
30Document](/specification/latest/basic/authorization/client-registration#client-id-metadata-documents)
30Document](/specification/latest/basic/authorization/client-registration.md#client-id-metadata-documents)
3131(`--client-metadata-url`), or an [enterprise-managed
32IdP](/extensions/auth/enterprise-managed-authorization).
32IdP](/extensions/auth/enterprise-managed-authorization.md).
3333
3434**4. Authorize in the browser**
3535
from line 49
4949
5050
5151
52Connection Info after a completed OAuth flow: the authorization status, the dynamically registered client, and the granted scopes.
53
5254## Callback URLs
5355
5456The web app listens for the OAuth callback on its own URL, while the CLI and TUI deliberately share a second one:
from line 87
8587| - | - |
8688| `~/.mcp-inspector/storage/oauth.json` | Non-secret OAuth state (discovery metadata, PKCE verifiers, granted scope, public client ids), keyed by canonicalized server URL. Written owner-only. |
8789| `~/.mcp-inspector/storage/client.json` | Install-level client settings (client metadata URL, enterprise IdP). The same file the web client's **Client Settings** dialog writes. |
88| The server's `oauth` block in the [catalog file](/docs/draft/tools/inspector/configuration#catalog-file-format) | Per-server client id/secret, scopes, the enterprise-managed flag, and the [step-up](#mid-session-re-authorization) policy. |
90| The server's `oauth` block in the [catalog file](/docs/draft/tools/inspector/configuration.md#catalog-file-format) | Per-server client id/secret, scopes, the enterprise-managed flag, and the [step-up](#mid-session-re-authorization) policy. |
8991
90The path to `oauth.json` is resolved in order: `MCP_INSPECTOR_OAUTH_STATE_PATH`, then `<MCP_STORAGE_DIR>/oauth.json` (see [Environment variables](/docs/draft/tools/inspector/configuration#environment-variables)), then the default above. All three clients resolve it the same way. Command-line `--client-id` / `--client-secret` / `--client-metadata-url` override `client.json`.
92The path to `oauth.json` is resolved in order: `MCP_INSPECTOR_OAUTH_STATE_PATH`, then `<MCP_STORAGE_DIR>/oauth.json` (see [Environment variables](/docs/draft/tools/inspector/configuration.md#environment-variables)), then the default above. All three clients resolve it the same way. Command-line `--client-id` / `--client-secret` / `--client-metadata-url` override `client.json`.
9193
92The secrets themselves (access and refresh tokens, client secrets, registration access tokens, and IdP session tokens) are not in `oauth.json`. They go to the [secret store](/docs/draft/tools/inspector/configuration#where-secrets-are-stored), which is the OS keychain when one is reachable. `MCP_INSPECTOR_PERSIST_TOKENS` limits which acquired tokens are kept: `all` (default), `access` (no refresh tokens), or `none` (re-authorize every run). See [Secret store variables](/docs/draft/tools/inspector/configuration#secret-store-variables).
94The secrets themselves (access and refresh tokens, client secrets, registration access tokens, and IdP session tokens) are not in `oauth.json`. They go to the [secret store](/docs/draft/tools/inspector/configuration.md#where-secrets-are-stored), which is the OS keychain when one is reachable. `MCP_INSPECTOR_PERSIST_TOKENS` limits which acquired tokens are kept: `all` (default), `access` (no refresh tokens), or `none` (re-authorize every run). See [Secret store variables](/docs/draft/tools/inspector/configuration.md#secret-store-variables).
9395
9496## Mid-session re-authorization
9597
from line 143
141143 --wait-for-auth 120 --method tools/list
142144```
143145
144The `deepLink` in the handoff block navigates a browser straight to a *connected* Inspector; see [Deep links](/docs/draft/tools/inspector/web#deep-links).
146The `deepLink` in the handoff block navigates a browser straight to a *connected* Inspector; see [Deep links](/docs/draft/tools/inspector/web.md#deep-links).
145147
146148> [!NOTE]
147149>
No line in this hunk matches that.