Skip to content

Commit 2ca63cb

Browse files
msabramomsabramo
committed
Merge branch 'main' into playwright-test
2 parents db9ca37 + a7336cd commit 2ca63cb

26 files changed

+1798
-344
lines changed

‎.dockerignore

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Version control
2+
.git
3+
.gitignore
4+
5+
# Node.js
6+
node_modules
7+
npm-debug.log
8+
9+
# Build artifacts
10+
client/dist
11+
client/build
12+
server/dist
13+
server/build
14+
15+
# Environment variables
16+
.env
17+
.env.local
18+
.env.development
19+
.env.test
20+
.env.production
21+
22+
# Editor files
23+
.vscode
24+
.idea
25+
26+
# Logs
27+
logs
28+
*.log
29+
30+
# Testing
31+
coverage
32+
33+
# Docker
34+
Dockerfile
35+
.dockerignore

‎.git-blame-ignore-revs

Whitespace-only changes.

‎.github/workflows/main.yml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ jobs:
2626
# - run: npm ci
2727
- run: npm install --no-package-lock
2828

29+
- name: Check version consistency
30+
run: npm run check-version
31+
2932
- name: Check linting
3033
working-directory: ./client
3134
run: npm run lint
@@ -62,3 +65,52 @@ jobs:
6265
- run: npm run publish-all
6366
env:
6467
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
68+
69+
publish-github-container-registry:
70+
runs-on: ubuntu-latest
71+
if: github.event_name == 'release'
72+
environment: release
73+
needs: build
74+
permissions:
75+
contents: read
76+
packages: write
77+
attestations: write
78+
id-token: write
79+
steps:
80+
- uses: actions/checkout@v4
81+
82+
- name: Log in to the Container registry
83+
uses: docker/login-action@v3
84+
with:
85+
registry: ghcr.io
86+
username: ${{ github.actor }}
87+
password: ${{ secrets.GITHUB_TOKEN }}
88+
89+
- name: Extract metadata (tags, labels) for Docker
90+
id: meta
91+
uses: docker/metadata-action@v5
92+
with:
93+
images: ghcr.io/${{ github.repository }}
94+
95+
- name: Set up QEMU
96+
uses: docker/setup-qemu-action@v3
97+
98+
- name: Set up Docker Buildx
99+
uses: docker/setup-buildx-action@v3
100+
101+
- name: Build and push Docker image
102+
id: push
103+
uses: docker/build-push-action@v6
104+
with:
105+
context: .
106+
push: true
107+
platforms: linux/amd64,linux/arm64
108+
tags: ${{ steps.meta.outputs.tags }}
109+
labels: ${{ steps.meta.outputs.labels }}
110+
111+
- name: Generate artifact attestation
112+
uses: actions/attest-build-provenance@v2
113+
with:
114+
subject-name: ghcr.io/${{ github.repository }}
115+
subject-digest: ${{ steps.push.outputs.digest }}
116+
push-to-registry: true

‎Dockerfile

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Build stage
2+
FROM node:24-slim AS builder
3+
4+
# Set working directory
5+
WORKDIR /app
6+
7+
# Copy package files for installation
8+
COPY package*.json ./
9+
COPY .npmrc ./
10+
COPY client/package*.json ./client/
11+
COPY server/package*.json ./server/
12+
COPY cli/package*.json ./cli/
13+
14+
# Install dependencies
15+
RUN npm ci --ignore-scripts
16+
17+
# Copy source files
18+
COPY . .
19+
20+
# Build the application
21+
RUN npm run build
22+
23+
# Production stage
24+
FROM node:24-slim
25+
26+
WORKDIR /app
27+
28+
# Copy package files for production
29+
COPY package*.json ./
30+
COPY .npmrc ./
31+
COPY client/package*.json ./client/
32+
COPY server/package*.json ./server/
33+
COPY cli/package*.json ./cli/
34+
35+
# Install only production dependencies
36+
RUN npm ci --omit=dev --ignore-scripts
37+
38+
# Copy built files from builder stage
39+
COPY --from=builder /app/client/dist ./client/dist
40+
COPY --from=builder /app/client/bin ./client/bin
41+
COPY --from=builder /app/server/build ./server/build
42+
COPY --from=builder /app/cli/build ./cli/build
43+
44+
# Set default port values as environment variables
45+
ENV CLIENT_PORT=6274
46+
ENV SERVER_PORT=6277
47+
48+
# Document which ports the application uses internally
49+
EXPOSE ${CLIENT_PORT} ${SERVER_PORT}
50+
51+
# Use ENTRYPOINT with CMD for arguments
52+
ENTRYPOINT ["npm", "start"]

‎README.md

Lines changed: 54 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -137,17 +137,64 @@ The inspector supports bearer token authentication for SSE connections. Enter yo
137137

138138
The MCP Inspector includes a proxy server that can run and communicate with local MCP processes. The proxy server should not be exposed to untrusted networks as it has permissions to spawn local processes and can connect to any specified MCP server.
139139

140+
#### Authentication
141+
142+
The MCP Inspector proxy server requires authentication by default. When starting the server, a random session token is generated and printed to the console:
143+
144+
```
145+
🔑 Session token: 3a1c267fad21f7150b7d624c160b7f09b0b8c4f623c7107bbf13378f051538d4
146+
147+
🔗 Open inspector with token pre-filled:
148+
http://localhost:6274/?MCP_PROXY_AUTH_TOKEN=3a1c267fad21f7150b7d624c160b7f09b0b8c4f623c7107bbf13378f051538d4
149+
```
150+
151+
This token must be included as a Bearer token in the Authorization header for all requests to the server. The inspector will automatically open your browser with the token pre-filled in the URL.
152+
153+
**Automatic browser opening** - The inspector now automatically opens your browser with the token pre-filled in the URL when authentication is enabled.
154+
155+
**Alternative: Manual configuration** - If you already have the inspector open:
156+
157+
1. Click the "Configuration" button in the sidebar
158+
2. Find "Proxy Session Token" and enter the token displayed in the proxy console
159+
3. Click "Save" to apply the configuration
160+
161+
The token will be saved in your browser's local storage for future use.
162+
163+
If you need to disable authentication (NOT RECOMMENDED), you can set the `DANGEROUSLY_OMIT_AUTH` environment variable:
164+
165+
```bash
166+
DANGEROUSLY_OMIT_AUTH=true npm start
167+
```
168+
169+
#### Local-only Binding
170+
171+
By default, the MCP Inspector proxy server binds only to `127.0.0.1` (localhost) to prevent network access. This ensures the server is not accessible from other devices on the network. If you need to bind to all interfaces for development purposes, you can override this with the `HOST` environment variable:
172+
173+
```bash
174+
HOST=0.0.0.0 npm start
175+
```
176+
177+
**Warning:** Only bind to all interfaces in trusted network environments, as this exposes the proxy server's ability to execute local processes.
178+
179+
#### DNS Rebinding Protection
180+
181+
To prevent DNS rebinding attacks, the MCP Inspector validates the `Origin` header on incoming requests. By default, only requests from the client origin are allowed (respects `CLIENT_PORT` if set, defaulting to port 6274). You can configure additional allowed origins by setting the `ALLOWED_ORIGINS` environment variable (comma-separated list):
182+
183+
```bash
184+
ALLOWED_ORIGINS=http://localhost:6274,http://127.0.0.1:6274,http://localhost:8000 npm start
185+
```
186+
140187
### Configuration
141188

142189
The MCP Inspector supports the following configuration settings. To change them, click on the `Configuration` button in the MCP Inspector UI:
143190

144-
| Setting | Description | Default |
145-
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ------- |
146-
| `MCP_SERVER_REQUEST_TIMEOUT` | Timeout for requests to the MCP server (ms) | 10000 |
147-
| `MCP_REQUEST_TIMEOUT_RESET_ON_PROGRESS` | Reset timeout on progress notifications | true |
148-
| `MCP_REQUEST_MAX_TOTAL_TIMEOUT` | Maximum total timeout for requests sent to the MCP server (ms) (Use with progress notifications) | 60000 |
149-
| `MCP_PROXY_FULL_ADDRESS` | Set this if you are running the MCP Inspector Proxy on a non-default address. Example: http://10.1.1.22:5577 | "" |
150-
| `MCP_AUTO_OPEN_ENABLED` | Enable automatic browser opening when inspector starts. Only as environment var, not configurable in browser. | true |
191+
| Setting | Description | Default |
192+
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
193+
| `MCP_SERVER_REQUEST_TIMEOUT` | Timeout for requests to the MCP server (ms) | 10000 |
194+
| `MCP_REQUEST_TIMEOUT_RESET_ON_PROGRESS` | Reset timeout on progress notifications | true |
195+
| `MCP_REQUEST_MAX_TOTAL_TIMEOUT` | Maximum total timeout for requests sent to the MCP server (ms) (Use with progress notifications) | 60000 |
196+
| `MCP_PROXY_FULL_ADDRESS` | Set this if you are running the MCP Inspector Proxy on a non-default address. Example: http://10.1.1.22:5577 | "" |
197+
| `MCP_AUTO_OPEN_ENABLED` | Enable automatic browser opening when inspector starts (works with authentication enabled). Only as environment var, not configurable in browser. | true |
151198

152199
These settings can be adjusted in real-time through the UI and will persist across sessions.
153200

‎cli/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@modelcontextprotocol/inspector-cli",
3-
"version": "0.14.0",
3+
"version": "0.14.3",
44
"description": "CLI for the Model Context Protocol inspector",
55
"license": "MIT",
66
"author": "Anthropic, PBC (https://anthropic.com)",

0 commit comments

Comments
 (0)