1.0.2

modelcontextprotocol/inspector1.0.2Aug 24, 2026by cliffhall

AI Summary

A security-focused maintenance release for the deprecated v1 branch, addressing publishing configuration and critical security vulnerabilities.

Key Highlights

Security fixes for DNS rebinding attacks and npm audit advisories.
Publishing fixes including npm dist-tag configuration and CI workflow updates.
Dependency hardening by denying install scripts for esbuild and fsevents.

Full Release Notes

## What's Changed
 
### v1.x security and publishing fixes
* chore: pin v1 publishes to the `v1` dist-tag by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1828
* fix: v1 dist-tag must be `v1-latest` — npm rejects `v1` by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/1829
* ci(v1): pin workflow branch filters to v1/main, re-enabling the e2e gate by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2066
* fix: prevent DNS-rebinding TOCTOU in safeProxyFetch by pinning resolved IPs by @manjunathbhaskar in https://github.com/modelcontextprotocol/inspector/pull/1732
* fix(deps): bump js-yaml overrides to patched 3.15.1 / 4.3.1 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2073
* fix(deps): clear remaining npm audit advisories by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2075
* chore: deny esbuild and fsevents install scripts by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2077
* chore: bump version to 1.0.2 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2081

## New Contributors
* @manjunathbhaskar made their first contribution in https://github.com/modelcontextprotocol/inspector/pull/1732

**Full Changelog**: https://github.com/modelcontextprotocol/inspector/compare/1.0.1...1.0.2