1.0.4

What's Changed

v1.x security fixes

1.0.4 is a security release for the deprecated v1 line. Upgrade with npx @modelcontextprotocol/inspector@v1-latest, or move to v2 (@latest).

• Server-supplied pattern regexes are no longer evaluated. Patterns in a tool's output schema and in an elicitation's requested schema are stripped before validation, including patterns reachable through $ref, and the elicitation form no longer passes them to the browser's own field validation. The result says which checks were skipped. A schema the Inspector cannot transform safely, such as one that declares $id or anchors, is reported as not validated instead of being evaluated. Because patterns are no longer evaluated, a value that fails a server's pattern is now accepted, with that note. Every other schema constraint still applies. (GHSA-2fw8-7jmw-r937)
• chore(release): bump version to 1.0.4 by @cliffhall in #2884

Thanks for helping us improve

This release addresses a vulnerability reported by a community member. Thank you for taking the time to report it responsibly:

• @KillerX345 (GHSA-2fw8-7jmw-r937)

Full Changelog: 1.0.3...1.0.4
Smoke test ledger: https://claude.ai/artifact/V52r72rRhuLLFbw2N9x6HR