332 pages for browser.

Authorization Model Context Protocol · in the page docs/draft/tools/inspector/authorization …ons/auth/enterprise-managed-authorization.md). **4. Authorize in the browser** The Inspector opens the authorization URL. You sign in and consent. **5. Receive the callback** The authorization ser… CLI client Model Context Protocol · in the page docs/draft/tools/inspector/cli …thout calling the tool**, so a pipeline can decide whether it needs a browser before invoking anything: ```bash theme={null} # One tool -> one JSON line mcp-inspector --cli <server> --method tools/ca… Configuration and flags Model Context Protocol · in the page docs/draft/tools/inspector/configuration …`MCP_STORAGE_DIR`. | | `MCP_AUTO_OPEN_ENABLED` | Web, CLI | Controls browser auto-open. `false` never opens one. In the CLI, `true` forces auto-open and lets interactive OAuth run without a TTY, and… mcpdo connection client Model Context Protocol · in the page docs/draft/tools/inspector/mcpdo …n in to the IdP once, then connect to EMA servers silently. | When a browser sign-in is needed and neither stdin nor stderr is a TTY (and `MCP_AUTO_OPEN_ENABLED` is not forced on), `connect` exits `0… Protocol eras Model Context Protocol · in the page docs/draft/tools/inspector/protocol-eras …sues the upstream > request, so they reach the server even though the browser never sends them. , use the CLI for every check that returns JSON, and open a browser only to inspect the rendered widget. **1. Probe the security posture without calling the tool** ```bash theme={null} mcp… Security Model Context Protocol · in the page docs/draft/tools/inspector/security …rmissions. ## The web backend and its API token The web client is a browser app backed by a Node server that owns the MCP connections. That server can start stdio processes on request, so every `/ap… TUI client Model Context Protocol · in the page docs/draft/tools/inspector/tui …e TUI starts OAuth automatically and opens the authorization URL in a browser. 3. When the browser redirect lands on the TUI's loopback listener, the connection finishes on its own, with no second **`… Web client Model Context Protocol · in the page docs/draft/tools/inspector/web …**open that URL**, and don't type `localhost:6274` from memory. The browser recovers the token from three places, in priority order: 1. `window.__INSPECTOR_API_TOKEN__`, injected into `index.html`… Understanding Authorization in MCP Model Context Protocol · in the page docs/draft/tutorials/security/authorization …it comes to acquiring user credentials that may or may not rely on in-browser authentication and authorization flows. > > OAuth flows, in turn, are designed for HTTP-based transports where the MCP ser… Local Server Security Model Context Protocol · in the page docs/draft/tutorials/security/local-server-security …an read anything your account can read — SSH keys, cloud credentials, browser profiles, your home directory — and can open outbound network connections to anywhere. None of that is governed by the pro… Security Best Practices Model Context Protocol · in the page docs/draft/tutorials/security/security_best_practices …ermaid theme={null} sequenceDiagram participant UA as User-Agent (Browser) participant MC as MCP Client participant M as MCP Proxy Server participant TAS as Third-Party Authorization S… Enterprise-Managed Authorization Model Context Protocol · in the page extensions/auth/enterprise-managed-authorization …erver: ```mermaid theme={null} sequenceDiagram participant UA as Browser participant C as MCP Client participant IdP as Enterprise IdP participant MAS as MCP Authorization Server… OAuth Client Credentials Model Context Protocol · in the page extensions/auth/oauth-client-credentials …uthorization flow requires a user to interactively approve access — a browser opens, the user logs in, and grants permission. That works well for humans, but breaks down when there's no user present.… SEP-1036: URL Mode Elicitation for secure out-of-band interactions Model Context Protocol · in the page seps/1036-url-mode-elicitation-for-secure-out-of-band-intera …e data to the MCP client. By directing users to trusted URLs in their browser, this mode maintains security boundaries while enabling rich integrations with third-party services. ## Motivation The c… SEP-2127: MCP Server Cards - HTTP Server Discovery Model Context Protocol · in the page seps/2127-mcp-server-cards …ved as the recommended location. The media types, catalog format, and browser-oriented CORS and caching guidance are specified in [`docs/discovery.md`](https://github.com/modelcontextprotocol/experime… SEP-2567: Sessionless MCP via Explicit State Handles Model Context Protocol · in the page seps/2567-sessionless-mcp …per-session. This generalizes to any stateful workflow — a Playwright browser instance, a database transaction, an open file descriptor. 4. **Mutable list endpoints.** `tools/list` (and `resources/li… SEP-2640: Skills Extension Model Context Protocol · in the page seps/2640-skills-extension …, whoever asked for them: a generic resource-reading tool, a resource browser, a user inspecting the server. A skill is activated only by the host's own skill-loading path, the one that verifies the c… SEP-990: Enable enterprise IdP policy controls during MCP OAuth flows Model Context Protocol · in the page seps/990-enable-enterprise-idp-policy-controls-during-mcp-o …below: ```mermaid theme={null} sequenceDiagram participant UA as Browser participant C as MCP Client participant MAS as MCP Authorization Server participant MRS as MCP Resource Server… SEP-991: Enable URL-based Client Registration using OAuth Client ID Metadata Documents Model Context Protocol · in the page seps/991-enable-url-based-client-registration-using-oauth-c …ervers than there are clients (similar to how there are many more web browsers than API's). A common scenario is an MCP server developer wanting to restrict usage to a set of clients they trust. ###… Authorization Model Context Protocol · in the page specification/2025-03-26/basic/authorization …istinct service. A human user completes the OAuth flow through a web browser, obtaining an access token that identifies them personally and allows the client to act on their behalf. When authorizati… Authorization Model Context Protocol · in the page specification/2025-06-18/basic/authorization …mermaid theme={null} sequenceDiagram participant B as User-Agent (Browser) participant C as Client participant M as MCP Server (Resource Server) participant A as Authorization Server… Authorization Model Context Protocol · in the page specification/2025-11-25/basic/authorization …mermaid theme={null} sequenceDiagram participant B as User-Agent (Browser) participant C as Client participant M as MCP Server (Resource Server) participant A as Authorization Server… Elicitation Model Context Protocol · in the page specification/2025-11-25/client/elicitation …theme={null} sequenceDiagram participant UserAgent as User Agent (Browser) participant User participant Client participant Server Note over Server: Server initiates elicitation… Client Registration Model Context Protocol · in the page specification/2026-07-28/basic/authorization/client-registration …ULD** use `application_type: "native"` * **Web applications** (remote browser-based applications served from a non-local host) **SHOULD** use `application_type: "web"` MCP clients **MUST** be pre… Authorization Model Context Protocol · in the page specification/2026-07-28/basic/authorization/index …mermaid theme={null} sequenceDiagram participant B as User-Agent (Browser) participant C as Client participant M as MCP Server (Resource Server) participant A as Authorization Server… Elicitation Model Context Protocol · in the page specification/2026-07-28/client/elicitation …theme={null} sequenceDiagram participant UserAgent as User Agent (Browser) participant User participant Client participant Server Client->>Server: tools/call(id: 1) Note over… Tools Model Context Protocol · in the page specification/2026-07-28/server/tools …s that need to maintain state across calls — a shopping cart, an open browser context, a database transaction — should do so by returning an explicit handle from a creation tool and accepting that han… Client Registration Model Context Protocol · in the page specification/draft/basic/authorization/client-registration …ULD** use `application_type: "native"` * **Web applications** (remote browser-based applications served from a non-local host) **SHOULD** use `application_type: "web"` MCP clients **MUST** be pre… Authorization Model Context Protocol · in the page specification/draft/basic/authorization/index …mermaid theme={null} sequenceDiagram participant B as User-Agent (Browser) participant C as Client participant M as MCP Server (Resource Server) participant A as Authorization Server… Elicitation Model Context Protocol · in the page specification/draft/client/elicitation …theme={null} sequenceDiagram participant UserAgent as User Agent (Browser) participant User participant Client participant Server Client->>Server: tools/call(id: 1) Note over… Tools Model Context Protocol · in the page specification/draft/server/tools …s that need to maintain state across calls — a shopping cart, an open browser context, a database transaction — should do so by returning an explicit handle from a creation tool and accepting that han…