1.0.0

Versioning Note

Since this should be the last release of the classic MCP Inspector, it is finally being promoted to 1.0.0, primarily so that it can be referred to as the V1 implementation. It fixes outstanding security warnings and includes a couple of bug fixes.

Along with the release of the the upcoming 2026-07-28 MCP specification, we will be publishing an entirely new Inspector with a completely different codebase. The V2 web-based inspector client, the CLI, and a new TUI — all of which have a shared code architecture — will all ship as a single npm package. The V1 Inspector package will be officially deprecated at that time, and no further work will be done on that line.

What's Changed

• fix: call tasks/result when task status is input_required by @galagaevdc in #1174
• Fix resource refresh button not triggering re-fetch by @olaservo in #1148
• chore: pin prettier to 3.9.5 and run format check after install by @cliffhall in #1716
• chore(deps): bump vitest to ^4.1.0 (CVE fix) by @cliffhall in #1707
• chore(deps): bump vite to ^7.3.5 (CVE fixes) by @cliffhall in #1709
• chore(deps): bump shell-quote to ^1.8.4 (CVE fix) by @cliffhall in #1711
• chore(deps): override hono to ^4.12.25 (CVE fixes) by @cliffhall in #1708
• chore(deps): override form-data to ^4.0.6 (CVE fix) by @cliffhall in #1710
• chore(deps): override @babel/core to ^7.29.6 (CVE fix) by @cliffhall in #1712
• chore(deps): finalize security overrides and regenerate lockfile by @cliffhall in #1718
• fix(server): guard the /fetch proxy against SSRF to link-local/metadata (alert 53) by @cliffhall in #1717
• Bump to version 1.0.0 by @cliffhall in #1720

New Contributors

• @galagaevdc made their first contribution in #1174

Full Changelog: 0.22.0...1.0.0

0.22.0

What's Changed

• ci: switch npm publish to OIDC trusted publishing by @pcarleton in #1199
• Update package.json to contain repository.url in for npm trusted publisher setup by @cliffhall in #1201
• fix: add repository field to workspace package.json files for npm trusted publishing by @cliffhall in #1202
• ci: gate claude.yml on author_association to skip unauthorized invokes by @cliffhall in #1270
• chore(deps): npm audit fix for transitive security advisories by @olaservo in #1380
• feat: add URL-mode elicitation support by @cliffhall in #1423
• chore: bump version to 0.22.0 by @Copilot in #1428

Full Changelog: 0.21.2...0.22.0

0.21.2

What's Changed

• Fix decimal typing behavior for number inputs in tools form by @MumuTW in #1127
• fix: ensure DCR always registers both redirect URIs by @asoorm in #1173
• fix: add horizontal scrolling for long values in json view by @Dinesht04 in #1177
• Inspector client: Added proxy fetch for use by auth (to avoid CORS issues) by @BobDickinson in #1047
• chore(deps): bump hono from 4.12.1 to 4.12.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1117
• chore(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #1125
• chore(deps): bump actions/attest-build-provenance from 3 to 4 by @dependabot[bot] in #1126
• chore(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #1136
• chore(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #1137
• chore(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #1138
• fix: validate serverInfo.websiteUrl before rendering as link by @cliffhall in #1186
• fix(server): sanitize error responses to prevent stack trace exposure by @cliffhall in #1187
• chore: bump version to 0.21.2 by @olaservo in #1194
• ci: switch npm publish to OIDC trusted publishing by @pcarleton in #1199
• Update package.json to contain repository.url in for npm trusted publisher setup by @cliffhall in #1201
• fix: add repository field to workspace package.json files for npm trusted publishing by @cliffhall in #1202

New Contributors

• @MumuTW made their first contribution in #1127
• @Dinesht04 made their first contribution in #1177

Full Changelog: 0.21.1...0.21.2-hotfix-3

0.21.1

What's Changed

• fix: include server/static in published package files by @jwoods02 in #1113
• Remove misleading structured content compatibility warning by @olaservo in #1098
• chore: bump version to 0.21.1 by @Copilot in #1116

New Contributors

• @jwoods02 made their first contribution in #1113

Full Changelog: 0.21.0...0.21.1

0.21.0

What's Changed

• Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #1057
• Bump actions/upload-artifact from 4 to 6 by @dependabot[bot] in #1058
• Bump actions/attest-build-provenance from 2 to 3 by @dependabot[bot] in #1059
• Bump actions/cache from 4 to 5 by @dependabot[bot] in #1060
• Bump actions/github-script from 7 to 8 by @dependabot[bot] in #1061
• fix: display tool title field in Inspector UI by @olaservo in #1054
• Bump actions/checkout from 4 to 6 by @dependabot[bot] in #1079
• fix: enhance resolution and enum handling in anyOf schemas by @Edison-A-N in #901
• fix: include LICENSE file in published npm packages by @olaservo in #1055
• feat(client): display tool annotations in Tools tab by @olaservo in #1066
• Bump qs from 6.14.1 to 6.14.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1088
• fix: add missing tool result to AppsRenderer by @infoxicator in #1075
• Update SECURITY.md to use GitHub Security Advisories by @localden in #1097
• oauth: add tenant suffix to oauth flow by @howardjohn in #1096
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1106
• Manage display of "Run as Task" checkbox on Tools Tab by @cliffhall in #1072
• chore: bump version to 0.21.0 by @Copilot in #1112

New Contributors

• @Edison-A-N made their first contribution in #901
• @infoxicator made their first contribution in #1075
• @localden made their first contribution in #1097

Full Changelog: 0.20.0...0.21.0

0.20.0

What's Changed

• Fix async sampling test by @cliffhall in #1035
• fix(client): fix dev mode hanging on Windows by @olaservo in #1051
• fix(client): circular function calls leads to memory leak by @dzhulk in #1049
• Enable Dependabot for GitHub Actions by @koic in #1048
• Bump the npm_and_yarn group across 1 directory with 3 updates by @dependabot[bot] in #1065
• Fixed test failures induced by MCP SDK update by @BobDickinson in #1067
• Add MCP Apps support to Inspector by @cliffhall in #1044
• Bump version to 0.20.0 by @olaservo in #1070

New Contributors

• @dzhulk made their first contribution in #1049

Full Changelog: 0.19.0...0.20.0

0.19.0

What's Changed

• Update V2 messaging to clarify V1 focus by @olaservo in #958
• fix issue link in CONTRIBUTING.md by @DaleSeo in #963
• [Docs] Fix broken CONTRIBUTING.md links in GitHub templates by @koic in #964
• Add support for SEP-1330 Elicitation Enums by @cliffhall in #952
• feat: add theme property to Icon and Prompt types by @Vijaydaswani in #968
• fix: allow empty elicitation form data when all fields are optional by @bolinfest in #926
• chore: bump version to 0.18.0 by @olaservo in #969
• Bump TS SDK version to 1.24.3 by @cliffhall in #971
• fix: detect 401 errors from StreamableHTTP transport for OAuth flow by @olaservo in #966
• Update docker launch command by @cliffhall in #972
• Show description for anyOf fields in JSON editor by @DaleSeo in #974
• Allow Claude to code review PRs from forks by @cliffhall in #1001
• fix: detect 401 errors from StreamableHTTP transport in client by @thinhtpt-dev in #999
• Update typescript sdk to 1.25.2 by @olaservo in #1004
• Add a toast on connection error by @howardjohn in #765
• fix: OAuth DCR scope field compliance and error handling by @asoorm in #1003
• Fix failure to extract resource metadata url from WWW-authenticate header by @cliffhall in #924
• Converted CLI tests to use vitest by @BobDickinson in #1012
• Update LICENSE and package.json for Linux Foundation transition by @Copilot in #1018
• Add MCP docs server to Claude Code GitHub Action by @olaservo in #937
• Add Tasks support by @cliffhall in #1013
• Bump version to 0.19.0 by @olaservo in #1029
• Fix async sampling test by @cliffhall in #1035

New Contributors

• @DaleSeo made their first contribution in #963
• @Vijaydaswani made their first contribution in #968
• @bolinfest made their first contribution in #926
• @thinhtpt-dev made their first contribution in #999
• @howardjohn made their first contribution in #765
• @asoorm made their first contribution in #1003
• @BobDickinson made their first contribution in #1012
• @Copilot made their first contribution in #1018

Full Changelog: 0.17.5...0.19.0-hotfix

0.18.0

What's Changed

• Update V2 messaging to clarify V1 focus by @olaservo in #958
• fix issue link in CONTRIBUTING.md by @DaleSeo in #963
• [Docs] Fix broken CONTRIBUTING.md links in GitHub templates by @koic in #964
• Add support for SEP-1330 Elicitation Enums by @cliffhall in #952
• feat: add theme property to Icon and Prompt types by @Vijaydaswani in #968
• fix: allow empty elicitation form data when all fields are optional by @bolinfest in #926
• chore: bump version to 0.18.0 by @olaservo in #969
• Bump TS SDK version to 1.24.3 by @cliffhall in #971
• fix: detect 401 errors from StreamableHTTP transport for OAuth flow by @olaservo in #966

New Contributors

• @DaleSeo made their first contribution in #963
• @Vijaydaswani made their first contribution in #968
• @bolinfest made their first contribution in #926

Full Changelog: 0.17.5...0.18.0

0.17.5

What's Changed

• zod4 compatibility fixed for CI by @evalstate in #939
• Fix ReadableStream controller double-close crash by @felixweinberger in #940
• fix: proper stream cleanup and transport close on disconnect by @felixweinberger in #941
• mcp: add icon + website for testing SEP-973 by @jesselumarie in #778
• Bump version to 0.17.5 by @cliffhall in #954

New Contributors

• @jesselumarie made their first contribution in #778

Full Changelog: 0.17.3...0.17.5

0.17.4

What's Changed

• fix: resolve $ref references in tool input schema properties by @yanOO1497 in #889
• Handle nullable arrays in tool inputSchemas by @cliffhall in #895
• Fix a typo by @koic in #903
• fix: set user specified scope in DCR by @stdevi in #871
• Add Inspector V2 development notices and PR template by @olaservo in #911
• Bump version to 0.17.3 by @olaservo in #914
• Fix typescript errors and bump version by @olaservo in #916
• Fix $ref resolution in request schema properties before validation by @vincent0426 in #902
• Added UI to provide additional _meta values by @ln-12 in #770
• Bump Claude Code GitHub Action to v1 by @koic in #921

New Contributors

• @yanOO1497 made their first contribution in #889
• @koic made their first contribution in #903
• @stdevi made their first contribution in #871
• @vincent0426 made their first contribution in #902

Full Changelog: 0.17.2...0.17.4