Thank you for helping keep the Model Context Protocol and its ecosystem secure.
| Version | Package | Support |
|---|---|---|
| 2.x | @modelcontextprotocol/inspector |
✅ Actively supported |
| 1.x | @modelcontextprotocol/inspector |
v1-latest |
| 1.x | @modelcontextprotocol/inspector-client |
|
| 1.x | @modelcontextprotocol/inspector-server |
|
| 1.x | @modelcontextprotocol/inspector-cli |
|
| < 1.0.0 | any | ❌ Unsupported |
v2 ships as a single package — @modelcontextprotocol/inspector. The three
inspector-client / inspector-server / inspector-cli sub-packages exist only
on the v1 line and are deprecated.
v1 development happens on the v1/main branch and is limited to security fixes.
Those releases are published under the v1-latest dist-tag so they never
displace the current v2 release:
npm i @modelcontextprotocol/inspector@v1-latestEverything else — features, bug fixes, improvements — lands in v2 only.
If you discover a security vulnerability in this repository, please report it through the GitHub Security Advisory process for this repository. Private vulnerability reporting is enabled, so this is the fastest route to a maintainer.
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Note that this repository does not accept pull requests from outside contributors (see CONTRIBUTORS.md) — this does not apply to security reports, which should always go through the advisory process above rather than any public channel.
To help us triage and respond quickly, please include:
- A description of the vulnerability
- Steps to reproduce the issue
- The potential impact
- Whether it affects v2, v1, or both
- Any suggested fixes (optional)