Starstruk Logo MarkStarstruk

1.0.0

elizaOS/eliza1.0.0Jul 18, 2026by cliffhall

AI Summary

The classic MCP Inspector is promoted to version 1.0.0, marking the end of its active development life. This release focuses on fixing security vulnerabilities and addressing bugs to ensure stability before the upcoming V2 migration.

Key Highlights

  • Promoted to 1.0.0 (End of V1 line)
  • Fix critical security warnings (CVEs in vitest, vite, shell-quote, etc.)
  • Guard SSRF proxy against link-local addresses
  • Fix resource refresh button not triggering re-fetch

Full Release Notes

## Versioning Note
Since this **should** be the last release of the classic MCP Inspector, it is finally being promoted to 1.0.0, primarily so that it can be referred to as the V1 implementation. It fixes outstanding security warnings and includes a couple of bug fixes.

Along with the release of the the upcoming [2026-07-28 MCP specification](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/), we will be publishing an entirely new Inspector with a completely different codebase. The V2 web-based inspector client, the CLI, and a new TUI —  all of which have a shared code architecture — will all ship as a single npm package. The V1 Inspector package will be officially deprecated at that time, and no further work will be done on that line.

## What's Changed
* fix: call tasks/result when task status is input_required by @galagaevdc in https://github.com/modelcontextprotocol/inspector/pull/1174
* Fix resource refresh button not triggering re-fetch by @olaservo in https://github.com/modelcontextprotocol/inspector/pull/1148
* chore: pin prettier to 3.9.5 and run format check after install by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1716
* chore(deps): bump vitest to ^4.1.0 (CVE fix) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1707
* chore(deps): bump vite to ^7.3.5 (CVE fixes) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1709
* chore(deps): bump shell-quote to ^1.8.4 (CVE fix) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1711
* chore(deps): override hono to ^4.12.25 (CVE fixes) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1708
* chore(deps): override form-data to ^4.0.6 (CVE fix) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1710
* chore(deps): override @babel/core to ^7.29.6 (CVE fix) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1712
* chore(deps): finalize security overrides and regenerate lockfile by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1718
* fix(server): guard the /fetch proxy against SSRF to link-local/metadata (alert 53) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1717
* Bump to version 1.0.0 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1720

## New Contributors
* @galagaevdc made their first contribution in https://github.com/modelcontextprotocol/inspector/pull/1174

**Full Changelog**: https://github.com/modelcontextprotocol/inspector/compare/0.22.0...1.0.0