Back to search
D
53.8 /100

modelcontextprotocol/inspector

Author modelcontextprotocol
Stars 9,813
License Unspecified
Scanned 55d ago
MCP Registry npm

Versions

0.21.2-hotfix-3scored
Apr 14, 2026
0.21.1
Feb 27, 2026
0.21.0
Feb 24, 2026
0.20.0
Feb 6, 2026
0.19.0-hotfix
Jan 23, 2026
+ show 45 moreshow less
0.18.0
Dec 16, 2025
0.17.5
Dec 4, 2025
0.17.4
Nov 26, 2025
0.17.3
Nov 25, 2025
0.17.2
Oct 22, 2025
0.17.1
Oct 13, 2025
0.17.0
Oct 1, 2025
0.16.8
Sep 17, 2025
0.16.7
Sep 12, 2025
0.16.6
Sep 3, 2025
0.16.5
Aug 18, 2025
0.16.4
Aug 14, 2025
0.16.3
Aug 9, 2025
0.16.2
Jul 25, 2025
0.16.1
Jul 10, 2025
0.16.0
Jul 8, 2025
0.15.0
Jun 26, 2025
0.14.3
Jun 18, 2025
0.14.2
Jun 14, 2025
0.14.1
Jun 13, 2025
0.14.0
Jun 4, 2025
0.13.0
May 21, 2025
0.12.0
May 9, 2025
0.11.0-amended
Apr 30, 2025
0.10.2
Apr 17, 2025
0.9.0
Apr 14, 2025
0.8.2
Apr 7, 2025
0.8.1-hotfix
Apr 3, 2025
0.8.0
Apr 2, 2025
0.7.0
Mar 25, 2025
0.6.0
Mar 11, 2025
0.5.1
Mar 5, 2025
0.4.1
Feb 12, 2025
0.4.0
Feb 5, 2025
0.3.0
Dec 5, 2024
0.2.7
Nov 29, 2024
0.2.6
Nov 27, 2024
0.2.5
Nov 27, 2024
0.2.4
Nov 27, 2024
0.2.3
Nov 26, 2024
0.2.2
Nov 25, 2024
0.2.1
Nov 25, 2024
0.2.0
Nov 21, 2024
0.1.0
Nov 11, 2024
0.0.1
Oct 28, 2024
1.0.0
first seen May 20, 2026

Trust breakdown

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 27

echo
annotations: none low

add
annotations: none low

cohort_app
annotations: none low

other_app
annotations: none low

weather_app
annotations: none low

pair
annotations: none low

Test tool

u
annotations: none low

Test tool

test-tool
annotations: none low

Test tool

union-tool
annotations: none low

specializing
annotations: none low

discriminated
annotations: none low

undiscriminated
annotations: none low

pinned-on-inherited
annotations: none low

numerically-pinned
annotations: none low

proto-named
annotations: none low

set-typed
annotations: none low

nullable-disagreement
annotations: none low

structured-const
annotations: none low

indistinguishable
annotations: none low

ambiguous
annotations: none low

array-typed
annotations: none low

malformed
annotations: none low

no-discriminator-supplied
annotations: none low

Test tool

malformed-declaration
annotations: none low

Test tool

allof-tool
annotations: none low

Test tool

definitely-not-a-real-tool
annotations: none low

get_temp
annotations: none low

Permissions 4

network Server uses network capabilities via: fetch(), http, net
medium
filesystem Server uses filesystem capabilities via: fs, fs sync ops, fs/promises, path
low
shell Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
high
env_vars Server uses env_vars capabilities via: process.env
low

Scan Findings 138

medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
info
Tool: indistinguishable manifest_parser · 90%
info
Tool: ambiguous manifest_parser · 90%
info
Tool: array-typed manifest_parser · 90%
info
Tool: malformed manifest_parser · 90%
info
Tool: no-discriminator-supplied manifest_parser · 90%
info
Tool: malformed-declaration manifest_parser · 90%
info
Tool: allof-tool manifest_parser · 90%
info
Tool: definitely-not-a-real-tool manifest_parser · 90%
info
Tool: get_temp manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (51) manifest_parser · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/oauth-resource-metadata-challenge.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/ema-mock-servers.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/auth/revocation-e2e.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/inspectorClient-satisfied-recovery-connect.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/node/servers.test.ts oauth_scope_analyzer · 80%
high
High-risk OAuth scope: admin oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 883 components sbom_generator · 100%
low
Tool 'add' has no annotations annotation_checker · 100%
info
Tool: pair manifest_parser · 90%
info
Tool: u manifest_parser · 90%
low
Tool 'echo' has no annotations annotation_checker · 100%
low
Tool 'cohort_app' has no annotations annotation_checker · 100%
low
Tool 'other_app' has no annotations annotation_checker · 100%
low
Tool 'weather_app' has no annotations annotation_checker · 100%
low
Tool 'pair' has no annotations annotation_checker · 100%
low
Tool 'u' has no annotations annotation_checker · 100%
low
Tool 'test-tool' has no annotations annotation_checker · 100%
low
Tool 'union-tool' has no annotations annotation_checker · 100%
low
Tool 'specializing' has no annotations annotation_checker · 100%
low
Tool 'discriminated' has no annotations annotation_checker · 100%
low
Tool 'undiscriminated' has no annotations annotation_checker · 100%
low
Tool 'pinned-on-inherited' has no annotations annotation_checker · 100%
low
Tool 'numerically-pinned' has no annotations annotation_checker · 100%
low
Tool 'proto-named' has no annotations annotation_checker · 100%
low
Tool 'set-typed' has no annotations annotation_checker · 100%
low
Tool 'nullable-disagreement' has no annotations annotation_checker · 100%
low
Tool 'structured-const' has no annotations annotation_checker · 100%
low
Tool 'indistinguishable' has no annotations annotation_checker · 100%
low
Tool 'ambiguous' has no annotations annotation_checker · 100%
low
Tool 'array-typed' has no annotations annotation_checker · 100%
low
Tool 'malformed' has no annotations annotation_checker · 100%
low
Tool 'no-discriminator-supplied' has no annotations annotation_checker · 100%
low
Tool 'malformed-declaration' has no annotations annotation_checker · 100%
low
Tool 'allof-tool' has no annotations annotation_checker · 100%
low
Tool 'definitely-not-a-real-tool' has no annotations annotation_checker · 100%
low
Tool 'get_temp' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/cli/__tests__/oauth-runner.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/utils/maskSecrets.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/oauth-resource-metadata-challenge.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/oauth-resource-metadata-challenge.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/inspectorClient-oauth.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/ema-mock-servers.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/ema-mock-servers.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/auth/revocation-e2e.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/auth/revocation-e2e.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/remote/servers-route.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/mcp/remote/client-store-route.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/integration/auth/node/storage.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/oauthManager.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/inspectorClient-satisfied-recovery-connect.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/serverList.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/auth/revocation.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/auth/storage-browser.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/client/node-persistence.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/client/runner.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/node/servers.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/auth/ema/tokenEndpoint.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/auth/ema/idpOidc.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-inspector-795b1bb/core/auth/secret-fields.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-ace dependency_analyzer · 60%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Suspicious package name: react-icons dependency_analyzer · 60%
medium
Suspicious package name: react-markdown dependency_analyzer · 60%
medium
Vulnerable dependency: ajv@8.17.1 (GHSA-2g4f-4pwh-qvx6) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@8.5.0 (GHSA-4cwx-7wf7-3272) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@8.5.0 (GHSA-8xcm-r25x-g524) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@8.5.0 (GHSA-jr45-8vmc-qm54) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@8.5.0 (GHSA-m8rv-5g2x-5cg5) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@8.5.0 (GHSA-v3r7-h72x-cjcm) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.1.10 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/sha256.test.ts:20 entropy_analyzer · 70%
info
Tool: weather_app manifest_parser · 90%
medium
Hex string literal (>50 chars) in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/sha256.test.ts:26 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/sha256.test.ts:39 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in modelcontextprotocol-inspector-795b1bb/clients/web/src/test/core/mcp/sha256.test.ts:59 entropy_analyzer · 70%
medium
Buffer.from base64 in modelcontextprotocol-inspector-795b1bb/core/auth/node/file-secret-store.ts:194 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-inspector-795b1bb/core/auth/node/file-secret-store.ts:195 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-inspector-795b1bb/core/auth/node/file-secret-store.ts:196 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-inspector-795b1bb/core/auth/node/file-secret-store.ts:271 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-inspector-795b1bb/core/auth/node/file-secret-store.ts:438 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-inspector-795b1bb/test-servers/src/test-server-oauth.ts:566 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: add manifest_parser · 90%
info
Tool: echo manifest_parser · 90%
info
Tool: cohort_app manifest_parser · 90%
info
Tool: other_app manifest_parser · 90%
info
Tool: test-tool manifest_parser · 90%
info
Tool: union-tool manifest_parser · 90%
info
Tool: specializing manifest_parser · 90%
info
Tool: discriminated manifest_parser · 90%
info
Tool: undiscriminated manifest_parser · 90%
info
Tool: pinned-on-inherited manifest_parser · 90%
info
Tool: numerically-pinned manifest_parser · 90%
info
Tool: proto-named manifest_parser · 90%
info
Tool: set-typed manifest_parser · 90%
info
Tool: nullable-disagreement manifest_parser · 90%
info
Tool: structured-const manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (11) manifest_parser · 80%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
medium
Excessive dependency count: 51 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.25.2 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.18.0 (GHSA-58qx-3vcg-4xpx) dependency_analyzer · 95%
medium
Vulnerable dependency: express-rate-limit@8.2.1 (GHSA-46wh-pxpv-q5gq) dependency_analyzer · 95%
medium
Vulnerable dependency: ajv@6.12.6 (GHSA-2g4f-4pwh-qvx6) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.5.6 (GHSA-qx2v-qp2m-jg93) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.11 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.11 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@7.1.11 (GHSA-v2wj-q39q-566r) dependency_analyzer · 95%
info
SLSA Build Level 3 detected slsa_assessor · 85%
info
Scanner output_poisoning failed output_poisoning · 50%
info
Scanner behavioral_verifier failed behavioral_verifier · 50%
info
SBOM generated: 938 components sbom_generator · 100%
info
MITRE ATLAS technique coverage summary atlas_annotator · 100%
info
ATLAS: Adversarial ML Supply Chain (AML.T0043) atlas_annotator · 100%
info
package.json metadata manifest_parser · 100%