Web client changeddocs/draft/tools/inspector/web
Nearest release: v2.1.295, published 5 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 8 Oct 2026 12:58 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.
Upstream edited
Recorded here
Lines+30added
Lines−14removed
From line
20
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
The whole hunk
from line 20, old and new numbered
/
from line 20
20202. A `?MCP_INSPECTOR_API_TOKEN=...` query string, the form used in that printed URL.
21213. `sessionStorage`, as a backstop.
2222
23Set the `MCP_INSPECTOR_API_TOKEN` environment variable to pin a known token (useful for scripted launches), or set `DANGEROUSLY_OMIT_AUTH=true` to disable the check entirely, but only on a machine where nothing else can reach the port. Both are described under [Web backend environment variables](/docs/draft/tools/inspector/configuration#web-backend-environment-variables). What the token does and does not protect is described under [Security](/docs/draft/tools/inspector/security#the-web-backend-and-its-api-token).
23Set the `MCP_INSPECTOR_API_TOKEN` environment variable to pin a known token (useful for scripted launches), or set `DANGEROUSLY_OMIT_AUTH=true` to disable the check entirely, but only on a machine where nothing else can reach the port. Both are described under [Web backend environment variables](/docs/draft/tools/inspector/configuration.md#web-backend-environment-variables). What the token does and does not protect is described under [Security](/docs/draft/tools/inspector/security.md#the-web-backend-and-its-api-token).
2424
2525## Dev mode
2626
from line 48
4848| **Network** | HTTP / SSE servers | The raw HTTP view: status, headers, bodies. |
4949| **Console** | stdio servers | The server process's `stderr`. |
5050
51**Network** and **Console** never appear together. Legacy and modern eras are described in [Protocol eras](/docs/draft/tools/inspector/protocol-eras).
51**Network** and **Console** never appear together. Legacy and modern eras are described in [Protocol eras](/docs/draft/tools/inspector/protocol-eras.md).
5252
5353
5454
55The tab bar on a connected server. Which tabs appear depends on the capabilities the server reported.
56
5557### The monitoring sidebar
5658
5759**Tasks**, **Logs**, **Protocol**, **Network**, and **Console** form a *monitor group*. Pin the group and they leave the tab bar and move into a resizable right-hand column, so you can watch traffic while working in Tools or Resources. Drag the column's edge to resize it, from 320 to 720 pixels wide. The column width and the selected monitor tab persist across reloads.
from line 60
5860
5961
6062
63The monitoring sidebar pinned beside the Tools screen and dragged to its full width, with the tool call's request and response expanded in the Protocol stream.
64
6165## Servers
6266
6367The Servers screen is the entry point. A server row carries its transport, its connection state, and a control that opens its per-server settings.
from line 75
7175| `--config <path>` | That file, read-only (never written or seeded) | No |
7276| `--server-url <url>` or a positional command | One ad-hoc server, held in memory | No |
7377
74On a first launch the web client seeds the catalog with three sample servers: a filesystem server scoped to `/tmp`, the canonical "everything" reference server, and the MCP org's hosted example server (Streamable HTTP, with OAuth via dynamic client registration). See [Configuration and flags](/docs/draft/tools/inspector/configuration) for the full rules, including why the CLI and TUI seed an empty catalog instead.
78On a first launch the web client seeds the catalog with three sample servers: a filesystem server scoped to `/tmp`, the canonical "everything" reference server, and the MCP org's hosted example server (Streamable HTTP, with OAuth via dynamic client registration). See [Configuration and flags](/docs/draft/tools/inspector/configuration.md) for the full rules, including why the CLI and TUI seed an empty catalog instead.
7579
7680### Server Settings
7781
78* **Protocol Era**: `legacy` / `auto` / `modern`. See [Protocol eras](/docs/draft/tools/inspector/protocol-eras).
79* **Log Level per Request**: the level a modern-era connection stamps on each outgoing request by default, or `off` to opt out (see [Logging](/docs/draft/tools/inspector/protocol-eras#logging)).
80* **Advertised Extensions**: which extensions the Inspector declares in `capabilities.extensions`. A debugging knob: a server may legitimately change what it registers based on what you advertise. Uncheck the Tasks extension and reconnect against the `test-servers/configs/advertised-extensions-http.json` fixture (setup in [Reproducing each era locally](/docs/draft/tools/inspector/protocol-eras#reproducing-each-era-locally)) to watch a tool disappear.
82* **Protocol Era**: `legacy` / `auto` / `modern`. See [Protocol eras](/docs/draft/tools/inspector/protocol-eras.md).
83* **Log Level per Request**: the level a modern-era connection stamps on each outgoing request by default, or `off` to opt out (see [Logging](/docs/draft/tools/inspector/protocol-eras.md#logging)).
84* **Advertised Extensions**: which extensions the Inspector declares in `capabilities.extensions`. A debugging knob: a server may legitimately change what it registers based on what you advertise. Uncheck the Tasks extension and reconnect against the `test-servers/configs/advertised-extensions-http.json` fixture (setup in [Reproducing each era locally](/docs/draft/tools/inspector/protocol-eras.md#reproducing-each-era-locally)) to watch a tool disappear.
8185* **Roots**: the roots advertised via the `roots` client capability. `@modelcontextprotocol/server-filesystem`, for instance, calls `roots/list` to learn its allowed directories.
82* **Headers**, **timeouts**, and **OAuth** fields. Headers are saved in the catalog as written; OAuth client secrets and stdio `env:` values go to the [secret store](/docs/draft/tools/inspector/configuration#where-secrets-are-stored).
83* **OAuth Settings**: client ID and secret, a read-only **Redirect URI** to copy into a pre-registered client (it follows the origin you opened the Inspector at), **Scopes** (space-separated), **Request refresh token**, **Revoke tokens on clear**, additional authorization parameters, authorization and token URL overrides, and **Insufficient-scope response**, which decides whether a `403 insufficient_scope` triggers [step-up](/docs/draft/tools/inspector/authorization#mid-session-re-authorization) or surfaces the error.
86* **Headers**, **timeouts**, and **OAuth** fields. Headers are saved in the catalog as written; OAuth client secrets and stdio `env:` values go to the [secret store](/docs/draft/tools/inspector/configuration.md#where-secrets-are-stored).
87* **OAuth Settings**: client ID and secret, a read-only **Redirect URI** to copy into a pre-registered client (it follows the origin you opened the Inspector at), **Scopes** (space-separated), **Request refresh token**, **Revoke tokens on clear**, additional authorization parameters, authorization and token URL overrides, and **Insufficient-scope response**, which decides whether a `403 insufficient_scope` triggers [step-up](/docs/draft/tools/inspector/authorization.md#mid-session-re-authorization) or surfaces the error.
8488* **Fetch Lists One Page at a Time**: when off, list results are auto-aggregated across pages on connect; when on, each list loads page 1 only with a **Load next page** control and an *N pages loaded* status. Reproduce with `test-servers/configs/pagination-http.json`, which paginates 12 tools, resources, and prompts into three pages each.
8589
8690A footer at the bottom of **Server Settings**, **Client Settings** and the **Add / Edit / Clone server** dialogs names the secret store in use, so you see it where you type a secret. It turns into a warning when secrets are memory-only (lost on restart), in an unencrypted file, in a file with loose permissions, or in a file that can't be read.
from line 91
8791
8892
8993
94Server Settings with Advertised Extensions expanded. Unchecking one changes what the Inspector declares at connect.
95
9096## Tools
9197
9298Select a tool to see its description, its input schema rendered as a form, and its annotations. Fill the form and call it; the result renders below with structured content, embedded resources, and images handled natively.
9399
94On modern-era servers this screen also shows mirrored `Mcp-Param-*` headers, excluded tools, and distinct `-32602` error panels, all covered in [Protocol eras](/docs/draft/tools/inspector/protocol-eras#tools-mirrored-headers-and-excluded-tools).
100On modern-era servers this screen also shows mirrored `Mcp-Param-*` headers, excluded tools, and distinct `-32602` error panels, all covered in [Protocol eras](/docs/draft/tools/inspector/protocol-eras.md#tools-mirrored-headers-and-excluded-tools).
95101
96102
97103
104A tool call and its rendered result. The argument form collapses into the result panel once the call returns.
105
98106## Resources
99107
100Lists resources and resource templates with their MIME types and descriptions, reads content on selection, and offers **Subscribe** on servers that support subscriptions. The subscription mechanics differ by era; see [Resource subscriptions](/docs/draft/tools/inspector/protocol-eras#resource-subscriptions).
108Lists resources and resource templates with their MIME types and descriptions, reads content on selection, and offers **Subscribe** on servers that support subscriptions. The subscription mechanics differ by era; see [Resource subscriptions](/docs/draft/tools/inspector/protocol-eras.md#resource-subscriptions).
101109
102110
103111
112A resource read, with an active subscription listed below the resource list.
113
104114## Prompts
105115
106116Lists prompt templates with their arguments, and renders the generated messages for the arguments you supply, which is the fastest way to confirm a prompt produces what you intended.
from line 117
107117
108118
109119
120A prompt rendered with the arguments supplied.
121
110122## Apps
111123
112[MCP Apps](/extensions/apps/overview) are tools that carry UI. The Apps tab renders one in a sandboxed iframe served from a **separate port**, exercises the `ui/*` bridge, and shows the view's `ui/message` submissions and its `notifications/message` logs in panels below the frame.
124[MCP Apps](/extensions/apps/overview.md) are tools that carry UI. The Apps tab renders one in a sandboxed iframe served from a **separate port**, exercises the `ui/*` bridge, and shows the view's `ui/message` submissions and its `notifications/message` logs in panels below the frame.
113125
114126* The sandbox listens on its own port, `6275` by default (set it with `MCP_SANDBOX_PORT`). An app whose UI resource declares `_meta.ui.domain` has its document served from a third listener, the app origin, on `6278` by default (`MCP_APP_ORIGIN_PORT`). Expose or forward both along with the web port.
115127* The sandbox is gated by a `frame-ancestors` CSP, and a bracketed IPv6 literal is not a valid CSP host-source, so browse the Inspector at `localhost`, `127.0.0.1`, a hostname, or a LAN IPv4, **not** at a bare `http://[::1]:...`.
116128* By default the sandbox URL is plain `http` on the bind address, so an `https://` Inspector page blocks the frame as mixed content. Behind a TLS reverse proxy, set `MCP_SANDBOX_FULL_ADDRESS` (and `MCP_APP_ORIGIN_FULL_ADDRESS`) to the public `https://` address the browser reaches each listener at. Neither may share an origin with the Inspector UI; a value that does is ignored with a warning.
117129
118See [Recipes](/docs/draft/tools/inspector/recipes#reviewing-an-mcp-app) for the CLI-first automated review flow.
130See [Recipes](/docs/draft/tools/inspector/recipes.md#reviewing-an-mcp-app) for the CLI-first automated review flow.
119131
120132
121133
134An MCP App rendered in its sandboxed frame, with the app's own logs below it.
135
122136## Protocol, Network, and Console
123137
124138The three tabs show the same traffic at different levels of detail:
125139
126* **Protocol**: the JSON-RPC transcript. Requests paired with responses, notifications inline, [MRTR](/docs/draft/tools/inspector/protocol-eras#multi-round-tool-results-mrtr) rounds grouped as one conversation, and spec errors rendered by class.
140* **Protocol**: the JSON-RPC transcript. Requests paired with responses, notifications inline, [MRTR](/docs/draft/tools/inspector/protocol-eras.md#multi-round-tool-results-mrtr) rounds grouped as one conversation, and spec errors rendered by class.
127141* **Network**: the HTTP layer, for SSE and Streamable HTTP servers. Status codes, request and response headers, and bodies. On modern connections the standardized `Mcp-*` headers are highlighted and sentinel values decoded.
128142* **Console**: the connected stdio server process's `stderr`, which is where most stdio servers put their own diagnostics.
129143
from line 145
131145
132146
133147
148The Protocol tab with an entry expanded, showing the full JSON-RPC exchange.
149
134150## Deep links
135151
136152A driver (a script, a CI harness, or the CLI's [`--print-handoff`](/docs/draft/tools/inspector/authorization#handing-off-from-the-web-client-to-the-cli)) can reach a *connected* Inspector with a single navigation:
from line 169
153169
154170Binding all interfaces (`HOST=0.0.0.0`) is **refused** unless you set `DANGEROUSLY_BIND_ALL_INTERFACES=true`. Binding a *specific* non-loopback address is allowed with no opt-in, since that's a single deliberate exposure rather than every interface at once.
155171
156See the [Hosting on a network](/docs/draft/tools/inspector/recipes#hosting-on-a-network) recipe for the full matrix, and [Configuration](/docs/draft/tools/inspector/configuration#web-backend-environment-variables) for the variables.
172See the [Hosting on a network](/docs/draft/tools/inspector/recipes.md#hosting-on-a-network) recipe for the full matrix, and [Configuration](/docs/draft/tools/inspector/configuration.md#web-backend-environment-variables) for the variables.
157173
No line in this hunk matches that.