MCP Inspector - Fail to run due to expecting https endpoint on mcp resource

[tjwald]

Describe the bug

MCP Inspector fails to start due to the MCP being passed in only exposing an http endpoint and not https.

Regression

The MCP Inspector in version 9.5 works

Steps to reproduce

Any mcp server that only exposes http endpoint

Expected behavior

Either let us pass a referenceexpression for the endpoint or fix it from failing due to missing endpoint.

Screenshots

No response

IDE and version

Rider

IDE version

No response

Nuget packages

CommunityToolkit.Aspire.Hosting.McpInspector version 13.0.0

Additional context

No response

Help us help you

No, just wanted to report this

[dahlsailrunner]

I've spent some time with this, and had the same issue. But running under https is better, so I set that up and was trying to get it to work (finally succeeded! -- see final code snippet in this comment for the solution). To see this all working, you can look at this repo: dahlsailrunner/simple-mcp-aspire

Here's a snippet from my launchSettings.json in the MCP server project - note that I only have an https endpoint specified:

"https": {
      "commandName": "Project",
      "dotnetRunMessages": true,
      "launchBrowser": true,
      "applicationUrl": "https://localhost:7229",
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
    }

This would use the https endpoint and the McpInspector would start up and reference the correct URL. But then when you try to connect, it will fail due to an untrusted SSL certificate.

An easy (but not great) way to correct this was adding this line to the app host after AddMcpInspector():

builder.AddMcpInspector("mcp-inspector")
    .WithEnvironment("NODE_TLS_REJECT_UNAUTHORIZED", "0")

This is not great because it ignores any cert errors -- it seemed like there needed to be a way to trust the local asp.net cert from the McpInspector - and the official Aspire hosting integration for JavaScript had the answer - instead of the above, do this:

builder.AddMcpInspector("mcp-inspector")
    .WithCertificateTrustConfiguration((ctx) =>
            {
                if (ctx.Scope == CertificateTrustScope.Append)
                {
                    ctx.EnvironmentVariables["NODE_EXTRA_CA_CERTS"] = ctx.CertificateBundlePath;
                }
                else
                {
                    if (ctx.EnvironmentVariables.TryGetValue("NODE_OPTIONS", out var existingOptionsObj))
                    {
                        ctx.EnvironmentVariables["NODE_OPTIONS"] = existingOptionsObj switch
                        {
                            // Attempt to append to existing NODE_OPTIONS if possible, otherwise overwrite
                            string s when !string.IsNullOrEmpty(s) => $"{s} --use-openssl-ca",
                            ReferenceExpression re => ReferenceExpression.Create($"{re} --use-openssl-ca"),
                            _ => "--use-openssl-ca",
                        };
                    }
                    else
                    {
                        ctx.EnvironmentVariables["NODE_OPTIONS"] = "--use-openssl-ca";
                    }
                }

                return Task.CompletedTask;
            })

I suspect that if the above .WithCertificateTrustConfiguration() call was added somewhere in this method call, that everything would work without requiring developers to add this code to their app host.

I could create a PR if that's the easiest way to get this resolved. By the way, I think the only way to really test this would be to use Playwright and do a UI automation test. Including Playwright in the tests would probably mean a whole new test project. Not sure if that's what would be desired or not.

[tjwald]

The MCP I am connecting to is open source and is running with http :(

[dahlsailrunner]

Ahh -- the solution above won't help you then. My solution involves the McpInspector actually trusting the dotnet dev cert in order to make a connection. Maybe I'll create a new issue for the "trust the dev cert" problem i ran into.