Security changeddocs/draft/tools/inspector/security
Nearest release: v2.1.295, published 5 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 8 Oct 2026 12:58 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.
Upstream edited
Recorded here
Lines+5added
Lines−5removed
From line
13
where the diff opens
First seen
8 Oct 2026
this site's first read of the page
Recorded edits3to this page, all time
The whole hunk
from line 13, old and new numbered
/
from line 13
1313
1414## The web backend and its API token
1515
16The web client is a browser app backed by a Node server that owns the MCP connections. That server can start stdio processes on request, so every `/api/*` route requires a per-launch bearer token (`x-mcp-remote-auth: Bearer <token>`). How the browser obtains it is described under [The session token](/docs/draft/tools/inspector/web#the-session-token).
16The web client is a browser app backed by a Node server that owns the MCP connections. That server can start stdio processes on request, so every `/api/*` route requires a per-launch bearer token (`x-mcp-remote-auth: Bearer <token>`). How the browser obtains it is described under [The session token](/docs/draft/tools/inspector/web.md#the-session-token).
1717
1818What the token does and does not protect:
1919
from line 24
2424
2525### Where the backend listens
2626
27The backend binds `127.0.0.1` by default. Binding every interface (`0.0.0.0`, `::` and equivalent spellings) is refused unless you set `DANGEROUSLY_BIND_ALL_INTERFACES=true`. Binding one specific address is allowed without that opt-in, because it is one deliberate exposure rather than all of them at once. See [Hosting on a network](/docs/draft/tools/inspector/recipes#hosting-on-a-network).
27The backend binds `127.0.0.1` by default. Binding every interface (`0.0.0.0`, `::` and equivalent spellings) is refused unless you set `DANGEROUSLY_BIND_ALL_INTERFACES=true`. Binding one specific address is allowed without that opt-in, because it is one deliberate exposure rather than all of them at once. See [Hosting on a network](/docs/draft/tools/inspector/recipes.md#hosting-on-a-network).
2828
2929> [!WARNING]
3030>
from line 34
3434
3535## Docker
3636
37The [Docker image](/docs/draft/tools/inspector/recipes#docker) changes two things about the picture above.
37The [Docker image](/docs/draft/tools/inspector/recipes.md#docker) changes two things about the picture above.
3838
3939### Publish the port on loopback only
4040
from line 64
6464
6565**`headers` are not secrets.** They are saved in `mcp.json` exactly as written, so a header that carries a credential (an API key, a static `Authorization` value) stays in the file.
6666
67How the store is selected, and how to change it, is under [Where secrets are stored](/docs/draft/tools/inspector/configuration#where-secrets-are-stored). This section covers the risks.
67How the store is selected, and how to change it, is under [Where secrets are stored](/docs/draft/tools/inspector/configuration.md#where-secrets-are-stored). This section covers the risks.
6868
6969### The automatic plaintext fallback
7070
from line 123
123123
124124## The mcpdo connection daemon
125125
126[mcpdo](/docs/draft/tools/inspector/mcpdo) keeps connections open between commands by handing them to a background daemon, `mcpdod`. It is started **automatically** the first time a command needs it (`mcpdo connect`, or any command against a connection). There is no separate "start the daemon" step to opt into. This section describes what that process exposes.
126[mcpdo](/docs/draft/tools/inspector/mcpdo.md) keeps connections open between commands by handing them to a background daemon, `mcpdod`. It is started **automatically** the first time a command needs it (`mcpdo connect`, or any command against a connection). There is no separate "start the daemon" step to opt into. This section describes what that process exposes.
127127
128128### How clients reach it, and who else can
129129
No line in this hunk matches that.