Configuration and flags changeddocs/draft/tools/inspector/configuration
Nearest release: v2.1.295, published 5 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 8 Oct 2026 12:58 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.
Upstream edited
Recorded here
Lines+13added
Lines−13removed
From line
16
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
The whole hunk
from line 16, old and new numbered
/
from line 16
1616> [!NOTE]
1717>
1818> The package also installs a second, separate bin, `mcpdo`, the experimental
19> [connection client](/docs/draft/tools/inspector/mcpdo). It is not reached
19> [connection client](/docs/draft/tools/inspector/mcpdo.md). It is not reached
2020> through the launcher and takes no mode flag.
2121
2222## Choosing servers
from line 93
9393| `--cwd <path>` | Working directory for a stdio server process. | None |
9494| `-e <KEY=VALUE>` | Environment variables for a stdio server. Repeatable. | None |
9595| `--header "Name: Value"` | HTTP headers for an HTTP/SSE server. Repeatable. | Requires an ad-hoc HTTP/SSE server on the web client. |
96| `--protocol-era <era>` | `legacy`, `auto`, or `modern`: the [protocol era](/docs/draft/tools/inspector/protocol-eras) to negotiate. | Requires an ad-hoc target on the web client. The CLI and TUI also let it override a file's `protocolEra`. |
96| `--protocol-era <era>` | `legacy`, `auto`, or `modern`: the [protocol era](/docs/draft/tools/inspector/protocol-eras.md) to negotiate. | Requires an ad-hoc target on the web client. The CLI and TUI also let it override a file's `protocolEra`. |
9797| `--skill-catalog-max-skills <n>` / `--skill-catalog-max-bytes <n>` | Budget for a skills verification run (most skills, most bytes read). | **CLI and TUI only.** Overrides the file's `skillCatalogMaxSkills` / `skillCatalogMaxBytes`. |
9898| `[target...]` | Positional command/URL for one ad-hoc server. | None |
9999
from line 133
133133
134134## CLI-only flags
135135
136The whole scripting surface belongs to the CLI. See [CLI client](/docs/draft/tools/inspector/cli) for usage.
136The whole scripting surface belongs to the CLI. See [CLI client](/docs/draft/tools/inspector/cli.md) for usage.
137137
138138| Group | Flags |
139139| - | - |
from line 149
149149
150150| Variable | Effect |
151151| - | - |
152| `MCP_DEBUG` | Append the error stack to a top-level `--web` or `--tui` failure (a `--cli` failure always prints its [JSON error envelope](/docs/draft/tools/inspector/cli#exit-codes-and-error-envelopes) instead). Only when set to a meaningful value: `0`, `false`, and empty read as off. |
152| `MCP_DEBUG` | Append the error stack to a top-level `--web` or `--tui` failure (a `--cli` failure always prints its [JSON error envelope](/docs/draft/tools/inspector/cli.md#exit-codes-and-error-envelopes) instead). Only when set to a meaningful value: `0`, `false`, and empty read as off. |
153153| `DEBUG` | Same, with the same meaningful-value rule, so a stray `DEBUG=0` doesn't turn stack traces on and `DEBUG` still works as the npm `debug` package's namespace filter. |
154154
155155### CLI and TUI
from line 169
169169
170170| Variable | Effect |
171171| - | - |
172| `MCP_INSPECTOR_API_TOKEN` | Pin the [session token](/docs/draft/tools/inspector/web#the-session-token) instead of generating a random one per launch. |
172| `MCP_INSPECTOR_API_TOKEN` | Pin the [session token](/docs/draft/tools/inspector/web.md#the-session-token) instead of generating a random one per launch. |
173173| `DANGEROUSLY_OMIT_AUTH` | Disable the `/api/*` token check entirely. Only `true` or `1` turn it off. |
174174| `HOST` | Bind host. Defaults to `127.0.0.1`. |
175175| `CLIENT_PORT` | Web UI port. Defaults to `6274`. |
from line 192
192192> The web backend spawns processes and holds OAuth tokens, so anyone who can
193193> reach it can drive it.
194194
195What the token does and does not protect is laid out under [The web backend and its API token](/docs/draft/tools/inspector/security#the-web-backend-and-its-api-token).
195What the token does and does not protect is laid out under [The web backend and its API token](/docs/draft/tools/inspector/security.md#the-web-backend-and-its-api-token).
196196
197197### Secret store variables
198198
199Read by **every** client: web, CLI, TUI, and [mcpdo](/docs/draft/tools/inspector/mcpdo). How they combine is described under [Where secrets are stored](#where-secrets-are-stored).
199Read by **every** client: web, CLI, TUI, and [mcpdo](/docs/draft/tools/inspector/mcpdo.md). How they combine is described under [Where secrets are stored](#where-secrets-are-stored).
200200
201201| Variable | Effect |
202202| - | - |
from line 245
245245> * **Encrypt the file:** supply a generated key with `MCP_INSPECTOR_SECRET_KEY_FILE` (preferred) or `MCP_INSPECTOR_SECRET_KEY`.
246246> * **Don't write secrets to disk at all:** `MCP_INSPECTOR_SECRET_STORE=memory`, and re-enter them each session.
247247>
248> Even encrypted, secrets on disk carry moderate risk. See [what the file store protects against](/docs/draft/tools/inspector/security#what-the-file-store-protects-against).
248> Even encrypted, secrets on disk carry moderate risk. See [what the file store protects against](/docs/draft/tools/inspector/security.md#what-the-file-store-protects-against).
249249
250[mcpdo](/docs/draft/tools/inspector/mcpdo) never falls back to `memory`: its commands and its daemon are separate processes, so it uses the file store instead.
250[mcpdo](/docs/draft/tools/inspector/mcpdo.md) never falls back to `memory`: its commands and its daemon are separate processes, so it uses the file store instead.
251251
252252### The file store
253253
from line 292
292292}
293293```
294294
295Fields that equal their default are omitted when the Inspector writes the file back, keeping diffs minimal. `protocolEra` (see [Protocol eras](/docs/draft/tools/inspector/protocol-eras)) defaults to `legacy` and `modernLogLevel` to `debug`.
295Fields that equal their default are omitted when the Inspector writes the file back, keeping diffs minimal. `protocolEra` (see [Protocol eras](/docs/draft/tools/inspector/protocol-eras.md)) defaults to `legacy` and `modernLogLevel` to `debug`.
296296
297You do not have to hand-write these; the web client can [import an existing client config](/docs/draft/tools/inspector/recipes#importing-an-existing-client-config) from Claude Desktop, Cursor, Cline, or VS Code, or a registry `server.json`.
297You do not have to hand-write these; the web client can [import an existing client config](/docs/draft/tools/inspector/recipes.md#importing-an-existing-client-config) from Claude Desktop, Cursor, Cline, or VS Code, or a registry `server.json`.
298298
No line in this hunk matches that.