2.7.0 2.8.0
modelcontextprotocol/inspectorSep 16, 2026 → Sep 23, 20267 days between releases
What's New
Adds secret key file support and security advisory skill while fixing /api authentication logic.
Breaking Changes
- Fixed /api auth to only disable when DANGEROUSLY_OMIT_AUTH is set (behavioral change).
New Features
- MCP_INSPECTOR_SECRET_KEY_FILE environment variable for secure secret storage.
- Security-advisory skill added.
- Per-server setting to suppress the standalone GET notification stream.
- Run skills:eval through the GitHub Copilot CLI.
- Documentation for read-only mcp.json interoperability.
Improvements
- Added MCP_INSPECTOR_SECRET_KEY_FILE environment variable for secret storage.
- Security-advisory skill added.
- Run skills:eval through the GitHub Copilot CLI.
- Documentation improvements for mcp.json and roadmap alignment.
Bug Fixes
- Fixed /api auth to only disable when DANGEROUSLY_OMIT_AUTH is set.
- Fixed stamping Mcp-Method on modern-era notification POSTs.
- Fixed resolving local $refs before choosing form widgets.
- Fixed detaching OIDC compat's normal-path body releases.
Upgrade Notes
The `/api` authentication behavior has changed; it now only disables when `DANGEROUSLY_OMIT_AUTH` is explicitly set. Review your configuration if you rely on default auth settings. New secret management is available via the `MCP_INSPECTOR_SECRET_KEY_FILE` environment variable.
The Two Releases
2.7.0
Sep 16, 2026· 1 month ago
Release 2.7.0 enhances the testing infrastructure with machine-wide leases, adds configurable timeouts for OAuth and connections, and introduces a launch flag for protocol eras.
Full release notes2.8.0
Sep 23, 2026· 29 days ago
Release 2.8.0 improves security through secret key file support, adds a security advisory skill, and fixes bugs related to authentication and schema rendering.
Full release notes