1.0.0

Versioning Note

Since this should be the last release of the classic MCP Inspector, it is finally being promoted to 1.0.0, primarily so that it can be referred to as the V1 implementation. It fixes outstanding security warnings and includes a couple of bug fixes.

Along with the release of the the upcoming 2026-07-28 MCP specification, we will be publishing an entirely new Inspector with a completely different codebase. The V2 web-based inspector client, the CLI, and a new TUI — all of which have a shared code architecture — will all ship as a single npm package. The V1 Inspector package will be officially deprecated at that time, and no further work will be done on that line.

What's Changed

• fix: call tasks/result when task status is input_required by @galagaevdc in #1174
• Fix resource refresh button not triggering re-fetch by @olaservo in #1148
• chore: pin prettier to 3.9.5 and run format check after install by @cliffhall in #1716
• chore(deps): bump vitest to ^4.1.0 (CVE fix) by @cliffhall in #1707
• chore(deps): bump vite to ^7.3.5 (CVE fixes) by @cliffhall in #1709
• chore(deps): bump shell-quote to ^1.8.4 (CVE fix) by @cliffhall in #1711
• chore(deps): override hono to ^4.12.25 (CVE fixes) by @cliffhall in #1708
• chore(deps): override form-data to ^4.0.6 (CVE fix) by @cliffhall in #1710
• chore(deps): override @babel/core to ^7.29.6 (CVE fix) by @cliffhall in #1712
• chore(deps): finalize security overrides and regenerate lockfile by @cliffhall in #1718
• fix(server): guard the /fetch proxy against SSRF to link-local/metadata (alert 53) by @cliffhall in #1717
• Bump to version 1.0.0 by @cliffhall in #1720

New Contributors

• @galagaevdc made their first contribution in #1174

Full Changelog: 0.22.0...1.0.0