2.12.0

## What's Changed

### Security fixes

2.12.0 fixes three vulnerabilities that affect every v2 release from 2.0.0 through 2.11.0. Upgrade with `npx @modelcontextprotocol/inspector@latest`.

* **Opening a URL is restricted to `http(s)`, and the Inspector opens the URL it checked rather than the raw input.** A remote server's OAuth authorization URL can no longer run commands through the opener on Windows and WSL. `open` is bumped to v11 ([GHSA-q978-78c7-phqw](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw))
* **The production web server validates the `Host` header** and answers any host outside its allow-list with 403 before serving a page. That closes the DNS-rebinding route to the API token and stored OAuth tokens. A new `MCP_INSPECTOR_ALLOWED_HOSTS` covers reverse proxies that rewrite `Host` ([GHSA-vcc9-3xgm-p9v4](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-vcc9-3xgm-p9v4))
* **The `/api/fetch` proxy caps upstream response bodies at 4 MiB**, refusing early when `Content-Length` declares more, and still relays the status of an oversized error response ([GHSA-m5pj-3536-3xcp](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-m5pj-3536-3xcp))

### Other changes

* test(cli): isolate the suite's OAuth state from ~/.mcp-inspector by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2728
* fix: resolve a request's Protocol entry when its send fails by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2733
* fix(subscriptions): stop retrying a subscriptions/listen refused over HTTP by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2730
* feat(web): optional TLS for the web UI listener by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2732
* ci: install pinned npm 11 before every dependency install by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2729
* fix(auth): carry a superseded namespace's client secret across a backend switch by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2731
* test(tui): keep TUI tests off the real ~/.mcp-inspector/auth.log by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2735
* fix(ema): allow a public resource-AS client in leg 3 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2736
* ci: scan v2/main with a committed CodeQL advanced-setup workflow by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2741
* docs: retroactive DCO signoffs for the 10 unsigned commits on v2/main (#2617) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2618
* fix(oauth): refresh an expired token behind an insufficient_scope challenge by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2738
* Recognize HTTP 429 and surface the server's Retry-After by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2737
* fix(auth): key in-flight PKCE verifiers by flow, not server URL by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2742
* fix(auth): carry a client credential only for the client its store stamp names by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2739
* feat(cli): --load mode for load-testing a tool by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2743
* fix(skills): require ttlMs and cacheScope on modern resources/directory/read results by @olaservo in https://github.com/modelcontextprotocol/inspector/pull/2747
* chore: bump version to 2.12.0 (release step 1) by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2763
* fix(cli): link https in --print-handoff when the web UI is served over TLS by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2773
* fix(web): drop the dropped body's framing headers from an oversize error relay by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2774
* fix(mcpdo): give resources/directory/read a URI and a cursor by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2775
* fix(core): keep the connection up when a request POST is HTTP-refused by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2777
* chore(release): merge v2/main into main for v2.12.0 by @cliffhall in https://github.com/modelcontextprotocol/inspector/pull/2769


### New configuration

* `MCP_INSPECTOR_ALLOWED_HOSTS`: unset by default. Comma-separated extra hostnames the prod web server accepts in `Host`. A leading `.` admits a domain and its subdomains. See the web README's "The Host allow-list" section.
* `INSPECTOR_TLS_KEY_PATH` and `INSPECTOR_TLS_CERT_PATH`: unset by default. Set both to serve the web UI over https, in both prod and dev. See [`docs/tls.md`](https://github.com/modelcontextprotocol/inspector/blob/main/docs/tls.md).

**Full Changelog**: https://github.com/modelcontextprotocol/inspector/compare/2.11.0...2.12.0
**Smoke test ledger for milestone branch**: [v2/chore/milestone-merge-v2.12.0](https://claude.ai/artifact/MTedfPXmfVa9q7DpzfgNTT)

## Thanks for helping us improve

This release addresses issues and vulnerabilities reported by these community members. Thank you for taking the time to report them:

* @CloneOfAlex (#2439, #2442, GHSA-m5pj-3536-3xcp)
* @AyRickk (#2726)
* @danpatsey (#2724)
* @ferentinai (#2725)
* @nosmile99 (#2723)
* @steventamm (#2446)
* @0xParth (GHSA-vcc9-3xgm-p9v4)
* @eilonc-pillar (GHSA-q978-78c7-phqw)
* @hackyhunter (GHSA-vcc9-3xgm-p9v4)
* @imran-siddique (GHSA-vcc9-3xgm-p9v4)