Skip to content

2.12.0

Latest
Latest

Choose a tag to compare

View all tags
@cliffhall cliffhall released this 21 Oct 18:13
2.12.0
0cac110
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Security fixes

2.12.0 fixes three vulnerabilities that affect every v2 release from 2.0.0 through 2.11.0. Upgrade with npx @modelcontextprotocol/inspector@latest.

  • Opening a URL is restricted to http(s), and the Inspector opens the URL it checked rather than the raw input. A remote server's OAuth authorization URL can no longer run commands through the opener on Windows and WSL. open is bumped to v11 (GHSA-q978-78c7-phqw)
  • The production web server validates the Host header and answers any host outside its allow-list with 403 before serving a page. That closes the DNS-rebinding route to the API token and stored OAuth tokens. A new MCP_INSPECTOR_ALLOWED_HOSTS covers reverse proxies that rewrite Host (GHSA-vcc9-3xgm-p9v4)
  • The /api/fetch proxy caps upstream response bodies at 4 MiB, refusing early when Content-Length declares more, and still relays the status of an oversized error response (GHSA-m5pj-3536-3xcp)

Other changes

  • test(cli): isolate the suite's OAuth state from ~/.mcp-inspector by @cliffhall in #2728
  • fix: resolve a request's Protocol entry when its send fails by @cliffhall in #2733
  • fix(subscriptions): stop retrying a subscriptions/listen refused over HTTP by @cliffhall in #2730
  • feat(web): optional TLS for the web UI listener by @cliffhall in #2732
  • ci: install pinned npm 11 before every dependency install by @cliffhall in #2729
  • fix(auth): carry a superseded namespace's client secret across a backend switch by @cliffhall in #2731
  • test(tui): keep TUI tests off the real ~/.mcp-inspector/auth.log by @cliffhall in #2735
  • fix(ema): allow a public resource-AS client in leg 3 by @cliffhall in #2736
  • ci: scan v2/main with a committed CodeQL advanced-setup workflow by @cliffhall in #2741
  • docs: retroactive DCO signoffs for the 10 unsigned commits on v2/main (#2617) by @cliffhall in #2618
  • fix(oauth): refresh an expired token behind an insufficient_scope challenge by @cliffhall in #2738
  • Recognize HTTP 429 and surface the server's Retry-After by @cliffhall in #2737
  • fix(auth): key in-flight PKCE verifiers by flow, not server URL by @cliffhall in #2742
  • fix(auth): carry a client credential only for the client its store stamp names by @cliffhall in #2739
  • feat(cli): --load mode for load-testing a tool by @cliffhall in #2743
  • fix(skills): require ttlMs and cacheScope on modern resources/directory/read results by @olaservo in #2747
  • chore: bump version to 2.12.0 (release step 1) by @cliffhall in #2763
  • fix(cli): link https in --print-handoff when the web UI is served over TLS by @cliffhall in #2773
  • fix(web): drop the dropped body's framing headers from an oversize error relay by @cliffhall in #2774
  • fix(mcpdo): give resources/directory/read a URI and a cursor by @cliffhall in #2775
  • fix(core): keep the connection up when a request POST is HTTP-refused by @cliffhall in #2777
  • chore(release): merge v2/main into main for v2.12.0 by @cliffhall in #2769

New configuration

  • MCP_INSPECTOR_ALLOWED_HOSTS: unset by default. Comma-separated extra hostnames the prod web server accepts in Host. A leading . admits a domain and its subdomains. See the web README's "The Host allow-list" section.
  • INSPECTOR_TLS_KEY_PATH and INSPECTOR_TLS_CERT_PATH: unset by default. Set both to serve the web UI over https, in both prod and dev. See docs/tls.md.

Full Changelog: 2.11.0...2.12.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.12.0

Thanks for helping us improve

This release addresses issues and vulnerabilities reported by these community members. Thank you for taking the time to report them:

Contributors

cliffhall, steventamm, and 10 other contributors
Assets 2
Loading