Starstruk Logo MarkStarstruk

1.0.0

modelcontextprotocol/inspector1.0.0Jul 18, 2026by cliffhall

AI Summary

The final release of the classic inspector, focused on security hardening before the v2 transition.

Key Highlights

  • Security hardening with CVE fixes for vitest, vite, hono, shell-quote, and form-data.
  • SSRF protection fix for the /fetch proxy.
  • Finalization of security overrides and lockfile regeneration.

Full Release Notes

## Versioning Note
Since this **should** be the last release of the classic MCP Inspector, it is finally being promoted to 1.0.0, primarily so that it can be referred to as the V1 implementation. It fixes outstanding security warnings and includes a couple of bug fixes.

Along with the release of the the upcoming [2026-07-28 MCP specification](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/), we will be publishing an entirely new Inspector with a completely different codebase. The V2 web-based inspector client, the CLI, and a new TUI —  all of which have a shared code architecture — will all ship as a single npm package. The V1 Inspector package will be officially deprecated at that time, and no further work will be done on that line.

## What's Changed
* fix: call tasks/result when task status is input_required by @galagaevdc in https://github.com/modelcontextprotocol/inspector/pull/1174
* Fix resource refresh button not triggering re-fetch by @olaservo in https://github.com/modelcontextprotocol/inspector/pull/1148
* chore: pin prettier to 3.9.5 and run format check after install by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1716
* chore(deps): bump vitest to ^4.1.0 (CVE fix) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1707
* chore(deps): bump vite to ^7.3.5 (CVE fixes) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1709
* chore(deps): bump shell-quote to ^1.8.4 (CVE fix) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1711
* chore(deps): override hono to ^4.12.25 (CVE fixes) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1708
* chore(deps): override form-data to ^4.0.6 (CVE fix) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1710
* chore(deps): override @babel/core to ^7.29.6 (CVE fix) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1712
* chore(deps): finalize security overrides and regenerate lockfile by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1718
* fix(server): guard the /fetch proxy against SSRF to link-local/metadata (alert 53) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1717
* Bump to version 1.0.0 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1720

## New Contributors
* @galagaevdc made their first contribution in https://github.com/modelcontextprotocol/inspector/pull/1174

**Full Changelog**: https://github.com/modelcontextprotocol/inspector/compare/0.22.0...1.0.0