M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
M

MCP Inspector

Official
Not a standard server
Visual testing tool for MCP servers

This is not a typical connect-and-use MCP server; read the source repository before using it.

How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #10 of 438
Stars
★ 11.2k Very popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Node.js >=22.19.0 · Docker
Credentials
Optional API key
License
Other / unspecified
Last commit
73FMRS · B

MCP Inspector is the officially maintained MCP protocol testing tool, offering Web, CLI, and TUI interfaces to inspect any MCP server's tools, resources, prompts, and low-level protocol traffic — well suited to protocol development and debugging, but it is not itself a business-facing MCP server meant to be called by end users or AI clients.

Strongest · Documentation 18/20 Weakest · Reliability 10/20

Reliability
10/20
Security and permissions
15/20
Maintenance
17/20
Documentation
18/20
Setup experience
13/20
Why each score
Reliability 10/20
The README describes a substantial build/test apparatus (validate, a per-file ≥90% coverage gate, an end-to-end smoke suite including a headless-Chromium boot check, verify:build-gate, and pack:verify which installs the real published tarball into a throwaway consumer), and references a concrete workflow path (.github/workflows/main.yml). This is detailed and plausible, but no server manifest or tool list was supplied ('not cached'), so the MCP init/tool-list handshake cannot be verified from the given material. Inspector is also itself a meta-tool for testing other MCP servers rather than a conventional single-tool MCP server, so 'declared tools vs. real behavior' cannot be checked here. Per the static calibration rule, since the workflow/test files themselves were not directly inspected (only README's description of them), the score stays conservative and does not credit unverified execution evidence.
Security and permissions 15/20
The documentation shows a deliberately cautious default posture: binding to 0.0.0.0 is refused by default and requires an explicit DANGEROUSLY_BIND_ALL_INTERFACES=true opt-in; auth is on by default and disabling it requires DANGEROUSLY_OMIT_AUTH=true, with dangerous flags clearly prefixed 'DANGEROUSLY_'; the Docker image runs as the non-root 'node' user; and ALLOWED_ORIGINS provides an origin allow-list. These reflect explicit confirmation and some least-privilege awareness, and none of this meets red-line criteria. However, the README itself acknowledges the backend is 'process-spawning' and can be exposed to the local network, without detail on sandboxing of spawned child processes, or how OAuth tokens/API tokens are protected at rest or redacted from logs — data-flow disclosure is incomplete, so full marks are not warranted.
Maintenance 17/20
Evidence points to mature governance: a v2/main vs. legacy-main branch strategy, an issue-driven workflow (PRs must reference 'Closes #issue'), an AGENTS.md/CLAUDE.md contribution contract, OIDC-based npm trusted publishing with provenance signing via GitHub Actions, a release flow with tag/version verification, and numerous specific issue references (#1636, #1769, #1791, #1792, etc.) indicating active issue tracking. The README explicitly states 'License: MIT' in its own License section, though the repository metadata field supplied in this task lists the license as unknown — this inconsistency is a minor deduction. No explicit security-response channel (e.g., SECURITY.md or a security contact) is described, which is also deducted.
Documentation 18/20
Documentation is layered and thorough: the main README, per-client READMEs, task-oriented guides under docs/ (MCP server configuration, App review workflow), an AGENTS.md contribution contract, a specification/ directory with diagrams, and unusually detailed showcase tables for test-server configs covering pagination, subscriptions, tasks, logging, and MRTR round-trips, including expected behaviors. Some limitations are disclosed (e.g., Mcp-Param header mirroring skipped in the browser, SDK v2 dropping tasks support). Minor gaps: no consolidated troubleshooting section and no cost discussion (of low relevance since this is a free open-source tool).
Setup experience 13/20
Setup is described clearly: a single npx command dispatches to web/cli/tui modes, Docker run examples with environment-variable explanations (including the origin-mismatch failure mode from port remapping and its fix), and a pack:verify script that simulates a real npx install against the published tarball. Per the static calibration rule, since the actual workflow/test files were not directly inspected here (only README's self-description), the score cannot exceed 15. Additionally, Inspector is a standalone inspection client rather than a typical MCP server added to a host's config (e.g., Claude Desktop), so no 'add this server to a mainstream client's config' example is provided — a modest gap relative to the setup dimension's usual expectations.

Static review · not runListed 2026-08-06

Read the FMRS scoring method →

Fit and risk

What it can accessRuns commands or codeUses the network

Best for

  • Engineers building or maintaining an MCP server who need to verify protocol behavior
  • Teams that want automated regression checks of an MCP server in CI
  • Advanced users debugging low-level request/response details, such as custom headers or error codes

Not for

  • End users who just want to chat with an AI assistant and don't care about the underlying protocol
  • Teams wanting a hosted, zero-setup inspection service (it must be run locally or self-hosted)
  • Anyone looking for an MCP server that provides business-facing tools to an AI client — Inspector is itself a client/testing tool, not a callable tool server

Required permissions

  • Runs Node.js and may spawn a target MCP server as a subprocess when using stdio transport
  • Makes outbound network connections to reach MCP servers over streamable-HTTP
  • In Web mode, binds a local port (default 6274) and runs a backend capable of spawning processes
  • Reads and writes local configuration files (e.g. `--config`/`--catalog` JSON)

Risks and side effects

  • The Web backend can spawn processes; setting `DANGEROUSLY_BIND_ALL_INTERFACES=true` exposes it to the local network, so pair it with an auth token
  • Setting `DANGEROUSLY_OMIT_AUTH=true` disables authentication and should only be used in fully trusted environments
  • When pointed at an untrusted or malicious MCP server, its responses are proxied and displayed as-is, so the trustworthiness of the server under inspection matters

Setup

Before you start

Runtime：Node.js >=22.19.0 · Docker

MCP_INSPECTOR_API_TOKEN optionalsecret Auth token for the web backend API; if unset, one is generated and printed in the container logs.
Other optional settings (5)
DANGEROUSLY_OMIT_AUTH optional Set to true to disable web UI authentication; local debugging only.
DANGEROUSLY_BIND_ALL_INTERFACES optional Set to true to allow binding 0.0.0.0 (all interfaces); already enabled in the Docker image.
ALLOWED_ORIGINS optional Replaces the default origin allow-list; set it to the browser's actual origin when remapping the published port (e.g. -p 8080:6274).
CLIENT_PORT optional Sets the client port so it matches a remapped published port.
INSPECTOR_SKIP_CLIENT_INSTALL optional Set to 1 during development to skip the root install cascading npm install into every client.

Run it without installing: npx @modelcontextprotocol/inspector opens the Web UI by default; add --cli for the command-line client or --tui for the terminal UI. To develop from source, install Node >=22.19.0, run npm install at the repo root (cascades into every client), then npm run build, or run cd clients/web && npm run dev for fast Web HMR iteration. An official Docker image is also published: docker run --rm -p 6274:6274 ghcr.io/modelcontextprotocol/inspector.

Check that it works

Run npx @modelcontextprotocol/inspector — the web UI should open at http://localhost:6274 with an auth token printed to the logs, or run npx @modelcontextprotocol/inspector --cli --help and confirm the command dispatches correctly.

Troubleshooting

  1. Verify local Node.js is >=22.19.0, or install/build steps will fail
  2. After a fresh clone or a dependency change, re-run `npm install` at the repo root to resync every client
  3. If remapping the Docker published port causes connections to be rejected (403), set `ALLOWED_ORIGINS` to match the origin the browser actually uses
  4. Before using bundled test-server configs, run `npm run test-servers:build` (from `clients/web`) to generate `test-servers/build/`, or subprocess-based test servers won't launch
  5. Use `npm run validate` (fast) or `npm run coverage` (the strict per-file coverage gate) to validate changes — there is no aggregate root `test` script

Things to try

Once connected, you can ask your AI assistant things like:

  • Run npx @modelcontextprotocol/inspector --cli to list the tools on my local MCP server
  • Start the Inspector web UI and connect to my stdio MCP server to inspect its resources and prompts
  • Load the test-servers mrtr-showcase-http. config and demonstrate a full MRTR tool round-trip
  • Open the Inspector TUI and check the paginated tool list of a streamable-HTTP server

Use cases

Visually browsing the tools, resources, and prompts exposed by an MCP server during development
Running scripted smoke tests against an MCP server from CI via the CLI
Interactively invoking tools and watching logs/network traffic from a terminal via the TUI
Debugging protocol-level behavior — pagination, resource subscriptions, tasks, and multi-round-trip (MRTR) elicitation — across legacy and modern protocol eras

Overview

MCP Inspector is a developer tool maintained in the official Model Context Protocol repository (modelcontextprotocol/inspector) for inspecting and debugging MCP servers — it is a client-side testing tool, not an MCP server that exposes tools to AI clients. It ships as a single npm package, @modelcontextprotocol/inspector, providing three ways to inspect a server through one mcp-inspector binary: a Web UI (Vite + React + Mantine, default), a scriptable CLI for automation and CI, and an interactive terminal UI (TUI) built with Ink. All three share connection logic, state stores, and OAuth handling via the internal @inspector/core package. The project's current line is v2 (branch v2/main); main holds the legacy v1 implementation in bug-fix-only mode. The repo also bundles composable test MCP servers and ready-made showcase configs demonstrating pagination, resource subscriptions, tasks, logging, and multi-round-trip (MRTR) elicitation across both legacy and modern protocol eras.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 64.1k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision e3217388c859 Data synced 2026-11-04 Read the FMRS scoring method