[renovate]

This PR contains the following updates:

Package	Type	Update	Change
alpine (source)	final	patch	3.24.2 → 3.24.3
ghcr.io/modelcontextprotocol/inspector		minor	2.11.0 → 2.12.0
index.docker.io/library/alpine (source)		digest	294b683 → be26560
python (source)		digest	2da6760 → 533b0b2
registry (source)	service	digest	ddf7543 → 01cd312

---

Release Notes

modelcontextprotocol/inspector (ghcr.io/modelcontextprotocol/inspector)

v2.12.0

Compare Source

What's Changed

Security fixes

2.12.0 fixes three vulnerabilities that affect every v2 release from 2.0.0 through 2.11.0. Upgrade with npx @modelcontextprotocol/inspector@latest.

• Opening a URL is restricted to http(s), and the Inspector opens the URL it checked rather than the raw input. A remote server's OAuth authorization URL can no longer run commands through the opener on Windows and WSL. open is bumped to v11 (GHSA-q978-78c7-phqw)
• The production web server validates the Host header and answers any host outside its allow-list with 403 before serving a page. That closes the DNS-rebinding route to the API token and stored OAuth tokens. A new MCP_INSPECTOR_ALLOWED_HOSTS covers reverse proxies that rewrite Host (GHSA-vcc9-3xgm-p9v4)
• The /api/fetch proxy caps upstream response bodies at 4 MiB, refusing early when Content-Length declares more, and still relays the status of an oversized error response (GHSA-m5pj-3536-3xcp)

Other changes

• test(cli): isolate the suite's OAuth state from ~/.mcp-inspector by @​cliffhall in #​2728
• fix: resolve a request's Protocol entry when its send fails by @​cliffhall in #​2733
• fix(subscriptions): stop retrying a subscriptions/listen refused over HTTP by @​cliffhall in #​2730
• feat(web): optional TLS for the web UI listener by @​cliffhall in #​2732
• ci: install pinned npm 11 before every dependency install by @​cliffhall in #​2729
• fix(auth): carry a superseded namespace's client secret across a backend switch by @​cliffhall in #​2731
• test(tui): keep TUI tests off the real ~/.mcp-inspector/auth.log by @​cliffhall in #​2735
• fix(ema): allow a public resource-AS client in leg 3 by @​cliffhall in #​2736
• ci: scan v2/main with a committed CodeQL advanced-setup workflow by @​cliffhall in #​2741
• docs: retroactive DCO signoffs for the 10 unsigned commits on v2/main (#​2617) by @​cliffhall in #​2618
• fix(oauth): refresh an expired token behind an insufficient_scope challenge by @​cliffhall in #​2738
• Recognize HTTP 429 and surface the server's Retry-After by @​cliffhall in #​2737
• fix(auth): key in-flight PKCE verifiers by flow, not server URL by @​cliffhall in #​2742
• fix(auth): carry a client credential only for the client its store stamp names by @​cliffhall in #​2739
• feat(cli): --load mode for load-testing a tool by @​cliffhall in #​2743
• fix(skills): require ttlMs and cacheScope on modern resources/directory/read results by @​olaservo in #​2747
• chore: bump version to 2.12.0 (release step 1) by @​cliffhall in #​2763
• fix(cli): link https in --print-handoff when the web UI is served over TLS by @​cliffhall in #​2773
• fix(web): drop the dropped body's framing headers from an oversize error relay by @​cliffhall in #​2774
• fix(mcpdo): give resources/directory/read a URI and a cursor by @​cliffhall in #​2775
• fix(core): keep the connection up when a request POST is HTTP-refused by @​cliffhall in #​2777
• chore(release): merge v2/main into main for v2.12.0 by @​cliffhall in #​2769

New configuration

• MCP_INSPECTOR_ALLOWED_HOSTS: unset by default. Comma-separated extra hostnames the prod web server accepts in Host. A leading . admits a domain and its subdomains. See the web README's "The Host allow-list" section.
• INSPECTOR_TLS_KEY_PATH and INSPECTOR_TLS_CERT_PATH: unset by default. Set both to serve the web UI over https, in both prod and dev. See docs/tls.md.

Full Changelog: modelcontextprotocol/inspector@2.11.0...2.12.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.12.0

Thanks for helping us improve

This release addresses issues and vulnerabilities reported by these community members. Thank you for taking the time to report them:

• @​CloneOfAlex (#​2439, #​2442, GHSA-m5pj-3536-3xcp)
• @​AyRickk (#​2726)
• @​danpatsey (#​2724)
• @​ferentinai (#​2725)
• @​nosmile99 (#​2723)
• @​steventamm (#​2446)
• @​0xParth (GHSA-vcc9-3xgm-p9v4)
• @​eilonc-pillar (GHSA-q978-78c7-phqw)
• @​hackyhunter (GHSA-vcc9-3xgm-p9v4)
• @​imran-siddique (GHSA-vcc9-3xgm-p9v4)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.01%. Comparing base (7970d58) to head (3bd2077).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6934   +/-   ##
=======================================
  Coverage   80.01%   80.01%           
=======================================
  Files         837      837           
  Lines       85215    85215           
=======================================
+ Hits        68182    68186    +4     
+ Misses      17028    17024    -4     
  Partials        5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.