Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http · sse counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit fb1b0cb · analyzer v28 · 4d ago
skills & prompt files 2
- agent-rules modelcontextprotocol-inspector-fb1b0cb/AGENTS.md
- agent-rules modelcontextprotocol-inspector-fb1b0cb/CLAUDE.md
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 922
filesystem 8
- fs modelcontextprotocol-inspector-fb1b0cb/clients/web/server/ensure-web-build.ts :15
import { existsSync } from "node:fs"; - fs modelcontextprotocol-inspector-fb1b0cb/clients/web/server/sandbox-controller.ts :7
import { readFileSync } from "node:fs"; - fs modelcontextprotocol-inspector-fb1b0cb/clients/web/server/server.ts :8
import { readFileSync } from "node:fs"; - fs modelcontextprotocol-inspector-fb1b0cb/clients/web/server/vite-base-config.ts :11
import { rmSync } from "node:fs"; - fs modelcontextprotocol-inspector-fb1b0cb/core/mcp/node/config.ts :1
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs"; - fs modelcontextprotocol-inspector-fb1b0cb/core/mcp/remote/node/server.ts :8
import { existsSync, readFileSync } from "node:fs"; - fs modelcontextprotocol-inspector-fb1b0cb/core/node/version.ts :15
import { readFileSync } from "node:fs"; - fs modelcontextprotocol-inspector-fb1b0cb/core/storage/store-io.ts :7
import * as fs from "node:fs/promises";
shell / exec 3
- shell modelcontextprotocol-inspector-fb1b0cb/clients/web/server/ensure-web-build.ts :17
import { spawnSync } from "node:child_process"; - shell modelcontextprotocol-inspector-fb1b0cb/clients/web/server/sandbox-controller.ts :85
* integer in `0`–`65535` (0 = OS-assigned). The `^\d+$` test rejects `parseInt` - shell modelcontextprotocol-inspector-fb1b0cb/clients/web/server/web-server-config.ts :315
// The `^\d+$` test rejects `parseInt`'s partial parses (`6274abc`, `80.9`).
network 14
- net modelcontextprotocol-inspector-fb1b0cb/clients/web/server/sandbox-controller.ts :6
import { createServer, type Server } from "node:http"; - net modelcontextprotocol-inspector-fb1b0cb/clients/web/server/server.ts :68
return apiApp.fetch(c.req.raw); - net modelcontextprotocol-inspector-fb1b0cb/clients/web/server/vite-hono-plugin.ts :10
import type { IncomingMessage, ServerResponse } from "node:http"; - net modelcontextprotocol-inspector-fb1b0cb/clients/web/src/App.tsx :1742
// Backend-backed session storage used to carry the fetch (Network) log - net modelcontextprotocol-inspector-fb1b0cb/clients/web/src/lib/environmentFactory.ts :48
const fetchFn: typeof fetch = (...args) => globalThis.fetch(...args); - net modelcontextprotocol-inspector-fb1b0cb/clients/web/src/lib/remoteOAuthStorage.ts :14
const defaultFetch: typeof fetch = (...args) => globalThis.fetch(...args); - net modelcontextprotocol-inspector-fb1b0cb/clients/web/src/utils/correlateTransportErrors.ts :128
* transport fetch (when the fetch recorded one; last match wins on repeated ids). - net modelcontextprotocol-inspector-fb1b0cb/core/auth/node/oauth-callback-server.ts :1
import { createServer, type Server } from "node:http"; - net modelcontextprotocol-inspector-fb1b0cb/core/mcp/node/transport.ts :16
import type { Dispatcher } from "undici"; - net modelcontextprotocol-inspector-fb1b0cb/core/mcp/remote/createRemoteTransport.ts :50
// is SSE). A remoted fetch (e.g. createRemoteFetch) buffers responses and cannot - net modelcontextprotocol-inspector-fb1b0cb/core/mcp/remote/node/server.ts :890
const res = await fetch(url, { - net modelcontextprotocol-inspector-fb1b0cb/core/mcp/remote/sessionStorage.ts :39
this.fetchFn = options.fetchFn ?? ((...args) => globalThis.fetch(...args)); - net modelcontextprotocol-inspector-fb1b0cb/core/node/hostUrl.ts :1
import { isIPv6 } from "node:net"; - net modelcontextprotocol-inspector-fb1b0cb/core/react/useServers.ts :136
// fetch() + ReadableStream rather than EventSource because EventSource
secrets 1
- secrets modelcontextprotocol-inspector-fb1b0cb/clients/cli/src/cli.ts :450
const apiToken = process.env.MCP_INSPECTOR_API_TOKEN || undefined;
install hooks 2
- prepack modelcontextprotocol-inspector-fb1b0cb/package.json :73
npm run build - postinstall modelcontextprotocol-inspector-fb1b0cb/package.json :74
node scripts/install-clients.mjs
declared dependencies 29
- @modelcontextprotocol/client@2.0.0-beta.5
- @modelcontextprotocol/core@2.0.0-beta.5
- @modelcontextprotocol/ext-apps@^1.7.4
- @modelcontextprotocol/server@2.0.0-beta.5
- @modelcontextprotocol/server-legacy@2.0.0-beta.5
- @hono/node-server@^2.0.12
- @napi-rs/keyring@^1.3.0
- @vitejs/plugin-react@^6.0.0
- ajv@^8.17.1
- atomically@^2.1.1
- chokidar@^4.0.3
- commander@^13.1.0
- hono@^4.12.18
- ink@^6.0.0
- ink-form@^2.0.1
- ink-scroll-view@^0.3.6
- open@^10.2.0
- pino@^9.14.0
- react@^19.2.4
- undici@^8.5.0
- vite@^8.1.5
- yaml@^2.9.0
- zod@^4.3.6
- @eslint/js@^9.39.5
- eslint@^9.39.5
- globals@^17.7.0
- prettier@3.8.4
- typescript@~5.9.3
- typescript-eslint@^8.65.0
transport_posture 3
- binds all interfaces (0.0.0.0) modelcontextprotocol-inspector-fb1b0cb/clients/cli/__tests__/stored-auth.test.ts :610
HOST: "0.0.0.0", - network-listening, binds all interfaces, no auth detected modelcontextprotocol-inspector-fb1b0cb/clients/web/src/test/integration/server/resolve-bind-host.test.ts :73
HOST: "0.0.0.0", - network-listening, binds all interfaces, no auth detected modelcontextprotocol-inspector-fb1b0cb/clients/web/src/test/integration/server/sandbox-controller.test.ts :192
const controller = createSandboxController({ port: 0, host: "0.0.0.0" });