Security: Node.js runtime advisories (October 2026)

On October 20, 2026, eMudhra disclosed that the private keys for eight of its intermediate CA certificates could be recovered from the public certificates. On October 21, Node.js shipped security releases that update its bundled CA certificates for the compromise. The same releases fix several unrelated high-severity runtime CVEs, including DNS name truncation, TLS hostname checks on non-canonical IP addresses, and an out-of-bounds write in the Brotli decoder.

How this release stands

• The Inspector relies on the Node.js runtime for certificate checks. It ships no CA certificates of its own and doesn't opt into the system trust store. Every HTTPS connection it makes, to MCP servers and to OAuth discovery and token endpoints, is verified by the Node.js it runs on.
• The Docker image needs no action. ghcr.io/modelcontextprotocol/inspector:2.13.0 runs Node.js 22.23.4, a patched release, and contains no system CA store.
• This release also updates two of its own dependencies past published advisories: undici (#2812) and fast-uri (#2820).

If you run the Inspector from npm (npx or a global install)

It runs on your Node.js, which we can't update for you. Please run Node.js 22.23.4, 24.22.1 or 26.12.1, or later, and check with node --version. The package's engines field still accepts Node.js 22.19.0 and up, so npm won't warn you about an older, unpatched runtime. Node.js 20 and earlier are end-of-life, get no fix, and aren't supported by Inspector v2.

What's Changed

• feat(cli): --load-max-error-rate / --load-max-p99 thresholds set the exit code by @cliffhall in #2787
• feat(cli): --load-connections spreads a load run over many sessions by @cliffhall in #2791
• fix(auth): keep a static client's SEP-2352 issuer stamp across saves and restarts by @cliffhall in #2794
• docs(skills): document the v1 release procedure and advisory-fork merge constraints by @cliffhall in #2785
• feat(scripts): release:notes --advisory lists GHSA fixes and credits their reporters by @cliffhall in #2788
• test(cli): isolate the suite's default catalog from ~/.mcp-inspector by @cliffhall in #2793
• chore(web): restrict the dev Vite server's CORS to the configured origins by @cliffhall in #2789
• Warn on non-loopback web binds and document the token's access-control boundary by @cliffhall in #2790
• fix(auth): read a DCR secret stamped for another client as absent (#2768) by @cliffhall in #2792
• feat(cli): carry 429 retry timing in the CLI and mcpdo error envelopes by @cliffhall in #2795
• feat(web): sort the Tools list by displayed label (#2782) by @cliffhall in #2798
• feat(mcpdo): add tools/call --load on the shared load engine by @cliffhall in #2786
• fix(web): keep a failed connect's reason on the server card (#2783) by @cliffhall in #2801
• chore(cli): migrate the CLI bundle from tsup to tsdown by @cliffhall in #2803
• fix: guard OAuth destinations against link-local and metadata addresses in every client by @cliffhall in #2796
• chore(deps): upgrade the MCP TypeScript SDK to 2.4.0 by @cliffhall in #2799
• chore(build): migrate the web runner, mcpdo and TUI bundles from tsup to tsdown by @cliffhall in #2807
• feat(mcpdo): --load-connections and --load-max-* thresholds for tools/call --load by @cliffhall in #2806
• chore(skills): take SEP-2640 constants and schemas from the SDK, move the rest to core/extension/skills by @cliffhall in #2808
• feat(auth): opt-in scope on OAuth token refresh via scopeForRefresh (Entra AADSTS90009) by @cliffhall in #2809
• Release 2.13.0 step 1: audit fixes and bump to 2.13.0 on v2/main by @cliffhall in #2815
• fix(core): a deliberate disconnect no longer ends in "error" (#2817) by @cliffhall in #2819
• fix(deps): update fast-uri to 3.1.9 past four moderate advisories (#2820) by @cliffhall in #2821
• chore(release): merge v2/main into main for v2.13.0 by @cliffhall in #2818

Full Changelog: 2.12.0...2.13.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.13.0

Thanks for helping us improve

This release addresses issues reported by these community members. Thank you for taking the time to file them:

• @aurelium (#2782)
• @tarun-amagian (#2783)

What's Changed

Security fixes

2.12.0 fixes three vulnerabilities that affect every v2 release from 2.0.0 through 2.11.0. Upgrade with npx @modelcontextprotocol/inspector@latest.

• Opening a URL is restricted to http(s), and the Inspector opens the URL it checked rather than the raw input. A remote server's OAuth authorization URL can no longer run commands through the opener on Windows and WSL. open is bumped to v11 (GHSA-q978-78c7-phqw)
• The production web server validates the Host header and answers any host outside its allow-list with 403 before serving a page. That closes the DNS-rebinding route to the API token and stored OAuth tokens. A new MCP_INSPECTOR_ALLOWED_HOSTS covers reverse proxies that rewrite Host (GHSA-vcc9-3xgm-p9v4)
• The /api/fetch proxy caps upstream response bodies at 4 MiB, refusing early when Content-Length declares more, and still relays the status of an oversized error response (GHSA-m5pj-3536-3xcp)

Other changes

• test(cli): isolate the suite's OAuth state from ~/.mcp-inspector by @cliffhall in #2728
• fix: resolve a request's Protocol entry when its send fails by @cliffhall in #2733
• fix(subscriptions): stop retrying a subscriptions/listen refused over HTTP by @cliffhall in #2730
• feat(web): optional TLS for the web UI listener by @cliffhall in #2732
• ci: install pinned npm 11 before every dependency install by @cliffhall in #2729
• fix(auth): carry a superseded namespace's client secret across a backend switch by @cliffhall in #2731
• test(tui): keep TUI tests off the real ~/.mcp-inspector/auth.log by @cliffhall in #2735
• fix(ema): allow a public resource-AS client in leg 3 by @cliffhall in #2736
• ci: scan v2/main with a committed CodeQL advanced-setup workflow by @cliffhall in #2741
• docs: retroactive DCO signoffs for the 10 unsigned commits on v2/main (#2617) by @cliffhall in #2618
• fix(oauth): refresh an expired token behind an insufficient_scope challenge by @cliffhall in #2738
• Recognize HTTP 429 and surface the server's Retry-After by @cliffhall in #2737
• fix(auth): key in-flight PKCE verifiers by flow, not server URL by @cliffhall in #2742
• fix(auth): carry a client credential only for the client its store stamp names by @cliffhall in #2739
• feat(cli): --load mode for load-testing a tool by @cliffhall in #2743
• fix(skills): require ttlMs and cacheScope on modern resources/directory/read results by @olaservo in #2747
• chore: bump version to 2.12.0 (release step 1) by @cliffhall in #2763
• fix(cli): link https in --print-handoff when the web UI is served over TLS by @cliffhall in #2773
• fix(web): drop the dropped body's framing headers from an oversize error relay by @cliffhall in #2774
• fix(mcpdo): give resources/directory/read a URI and a cursor by @cliffhall in #2775
• fix(core): keep the connection up when a request POST is HTTP-refused by @cliffhall in #2777
• chore(release): merge v2/main into main for v2.12.0 by @cliffhall in #2769

New configuration

• MCP_INSPECTOR_ALLOWED_HOSTS: unset by default. Comma-separated extra hostnames the prod web server accepts in Host. A leading . admits a domain and its subdomains. See the web README's "The Host allow-list" section.
• INSPECTOR_TLS_KEY_PATH and INSPECTOR_TLS_CERT_PATH: unset by default. Set both to serve the web UI over https, in both prod and dev. See docs/tls.md.

Full Changelog: 2.11.0...2.12.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.12.0

Thanks for helping us improve

This release addresses issues and vulnerabilities reported by these community members. Thank you for taking the time to report them:

• @CloneOfAlex (#2439, #2442, GHSA-m5pj-3536-3xcp)
• @AyRickk (#2726)
• @danpatsey (#2724)
• @ferentinai (#2725)
• @nosmile99 (#2723)
• @steventamm (#2446)
• @0xParth (GHSA-vcc9-3xgm-p9v4)
• @eilonc-pillar (GHSA-q978-78c7-phqw)
• @hackyhunter (GHSA-vcc9-3xgm-p9v4)
• @imran-siddique (GHSA-vcc9-3xgm-p9v4)

What's Changed

v1.x security fixes

1.0.3 is a security release for the deprecated v1 line. Upgrade with npx @modelcontextprotocol/inspector@v1-latest, or move to v2 (@latest).

• Proxy rejects browser requests without an allowed Origin when authentication is disabled, and DANGEROUSLY_OMIT_AUTH is read strictly (only true, 1 or yes) (GHSA-wmjf-2m46-2352)
• The OAuth callback no longer takes connection settings from its URL. It reconnects only with the connection saved in that tab before the redirect, and never over stdio (GHSA-4fc4-wcmh-4g86)
• MCP App links open with noopener,noreferrer and only for http(s) URLs, and the proxy rejects same-origin browser requests to its API. A new DANGEROUSLY_ALLOW_SAME_ORIGIN_API opt-out covers single-origin reverse-proxy setups (GHSA-6x67-4w4w-9f3w)
• The stored proxy token is no longer sent to a proxy address supplied in the URL, and a query-supplied address is no longer saved. MCP_PROXY_PORT must be a number (GHSA-2rq8-f55p-j2jp)
• The /fetch proxy drops Authorization, Cookie and related headers on cross-origin redirects, and refuses a cross-origin redirect of a request that still carries a body (GHSA-f6mc-jg3x-vq53)
• The /fetch proxy caps upstream response bodies at 5 MiB (GHSA-m5pj-3536-3xcp)
• SSE connection logs show header names, not values, and stdio env values are masked in the query log (GHSA-8qgq-27v6-55w3)
• chore: bump version to 1.0.3 by @cliffhall in #2754

New configuration

• DANGEROUSLY_ALLOW_SAME_ORIGIN_API: off by default. Set it to true, 1 or yes only if the client and proxy are served from one origin behind a reverse proxy. See the README's "Same-origin API Requests" section.

Thanks for helping us improve

This release addresses vulnerabilities reported by these community members. Thank you for taking the time to report them responsibly:

• @andesyteoss (GHSA-wmjf-2m46-2352)
• @ayaangazali (GHSA-f6mc-jg3x-vq53)
• @bhavya32 (GHSA-6x67-4w4w-9f3w, GHSA-4fc4-wcmh-4g86)
• @CloneOfAlex (GHSA-m5pj-3536-3xcp)
• @dodge1218 (GHSA-8qgq-27v6-55w3)
• @GEONWOOHAN (GHSA-f6mc-jg3x-vq53)
• @lemohangkhaile-blip (GHSA-wmjf-2m46-2352)
• @sondt99 (GHSA-2rq8-f55p-j2jp)

Full Changelog: 1.0.2...1.0.3
Smoke test ledger: https://claude.ai/artifact/5dXSVLSAQux1LxY2BosADa

What's Changed

• docs(pr-flow): always start work in a new git worktree by @cliffhall in #2663
• chore(deps): upgrade the MCP TypeScript SDK to 2.3.1 by @cliffhall in #2665
• fix(gate-lease): key the lock on a fixed per-user path, not TMPDIR by @cliffhall in #2664
• test(web): bind the auto-open server to :0 instead of probing a free port by @cliffhall in #2669
• fix(cli): refresh write-back updates the fresh on-disk entry by @cliffhall in #2666
• fix(smoke): run the Firefox pass in the Playwright container on macOS 27 by @cliffhall in #2662
• fix(auth): carry stripped-namespace secrets over before purging (#2630) by @cliffhall in #2671
• docs(agents): pace bulk GitHub writes under the secondary rate limit by @cliffhall in #2673
• fix(auth): pass empty fallbacks to joinSnapshot in updateOAuthServerEntry by @cliffhall in #2685
• fix(remote): relay upstream HTTP status so auto era falls back on a 400 probe by @cliffhall in #2684
• feat(web): hide 'Run as task' on modern-era connections by @cliffhall in #2687
• fix(web): keep every monitoring-sidebar entry inside its column (#2675) by @cliffhall in #2688
• chore(pack:verify): assert skills/mcpdo ships and drive an mcpdo tool call by @cliffhall in #2679
• docs(skills): fix test-servers' path to ensure-test-servers.mjs (#2523) by @cliffhall in #2678
• test(web): isolate integration OAuth state from ~/.mcp-inspector (#2670) by @cliffhall in #2677
• fix(mcpdo): route connections and OAuth through HTTPS_PROXY / HTTP_PROXY by @cliffhall in #2686
• fix(web): one-line warning when the browser opener cannot start by @cliffhall in #2689
• fix(auth): don't treat a plain 403 without WWW-Authenticate as an OAuth challenge by @cliffhall in #2690
• fix(tui): delete copy-to-file temp files when the TUI exits by @cliffhall in #2692
• fix(tui): Esc clears a kept list filter before exiting by @cliffhall in #2693
• fix(web): re-read the viewed skill file on a skills/get fetch (#2516) by @cliffhall in #2694
• fix(launcher): print the version for --version / -V in every mode by @cliffhall in #2695
• fix(mcpdo): restore a fresh OAuth-flow lock instead of deleting it on a lost steal by @cliffhall in #2696
• docs(release): drive mcpdo in the milestone smoke by @cliffhall in #2697
• fix(skills): name each client's own catalog-budget remedies by @cliffhall in #2698
• fix(auth): apply endpoint overrides when the AS publishes no metadata by @cliffhall in #2691
• fix(cli): call a taskSupport: required tool via the task path by @cliffhall in #2699
• fix(cli): keep the stdio target when an option precedes it by @cliffhall in #2704
• fix(cli): exit quietly when --completion's reader closes early by @cliffhall in #2700
• fix(cli): -q suppresses the --output "Wrote N bytes" status line by @cliffhall in #2702
• fix(cli,mcpdo,tui): name each client's own remedy on a connect timeout by @cliffhall in #2703
• fix(cli): refuse a URL that contradicts a positional command or --transport stdio by @cliffhall in #2701
• fix(tui): show the Inspector version in the header by @cliffhall in #2706
• feat(web): show tool/prompt/resource counts in list headers and Connection Info by @cliffhall in #2708
• feat(web): form rows for array-of-object tool inputs by @cliffhall in #2707
• chore(scripts): guard the file set each coverage run measures (#2709) by @cliffhall in #2711
• chore(deps): October dependency refresh (#2557) by @cliffhall in #2710
• fix(install): strip npm_config_allow_scripts from the per-client installs by @cliffhall in #2713
• chore(deps): deny esbuild/fsevents install scripts; guard unreviewed ones by @cliffhall in #2714
• chore: bump version to 2.11.0 (#2716) by @cliffhall in #2717
• chore(release): merge v2/main into main for v2.11.0 by @cliffhall in #2720

Full Changelog: 2.10.1...2.11.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.11.0

Thanks for helping us improve

This release addresses issues reported by these community members. Thank you for taking the time to file them:

• @ashokjayaprakash (#2561)
• @axel-codebear (#2562)
• @ivan-kovatchev (#2660)
• @jhelm (#2518)
• @revetkn (#2515)
• @Rohit496 (#2607)
• @roli-lpci (#2523)
• @symdeb (#2516)
• @v0ropaev (#2611)

Why The Patch?

The addition of the new mcpdo client threw a curveball into the default npx @modelcontextprotocol/inspector@latest method of running the inspector, because there were now two binaries to run, the launcher (used by the other clients) and mcpdo. This quick follow-up patch restores sanity so that command works again. Instructions for launching new mcpdo client are on README.md.

What's Changed

• fix(package): restore npx @modelcontextprotocol/inspector with an inspector bin alias by @cliffhall in #2652
• chore(release): 2.10.1 step 1 — audit, bump to 2.10.1 by @cliffhall in #2655
• docs(publishing): list pack:verify's npm default-bin check by @cliffhall in #2659
• chore(release): merge v2/main into main for v2.10.1 by @cliffhall in #2657

Full Changelog: 2.10.0...2.10.1
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.10.1

What's Changed

• docs(release): add the release-notes step and the re-cut procedure by @cliffhall in #2555
• Scope secret-store entries by a per-state-file namespace by @BobDickinson in #2556
• Promote recurring pr-flow/board-ops command blocks into scripts/ helpers by @BobDickinson in #2559
• refactor(core): adopt @modelcontextprotocol/ext-tasks; host adapter in core/extension/tasks by @cliffhall in #2564
• test(web): drop the unjustified double cast in storage-browser.test.ts by @cliffhall in #2584
• test(cli): prove the catalog-budget escape hatch round-trips by @cliffhall in #2595
• test(core): crashable stdio fixture + mid-session crash reconciliation tests by @cliffhall in #2598
• fix(web): one scrollbar for long JSON tool results by @cliffhall in #2593
• fix(web): compare deep-link auth tokens in constant time by @cliffhall in #2577
• feat(web): add an unauthenticated GET /healthz probe to the backend by @cliffhall in #2585
• feat(web): show the OAuth redirect URI with copy in Server Settings by @cliffhall in #2586
• fix: redact URL query secrets in error text shown by the web and TUI clients by @cliffhall in #2588
• fix(core): --server with an Object.prototype name reports not found (#2537) by @cliffhall in #2583
• fix(cli): read stored-auth tokens from the active issuer slot (#2517) by @cliffhall in #2572
• feat(cli): add -q/--quiet to print only the result or the error by @cliffhall in #2576
• feat(cli): bash/zsh/fish shell completion via --completion by @cliffhall in #2579
• Purge secret-store entries orphaned when a state file's namespace stamp is stripped by @cliffhall in #2600
• feat(cli): servers/add, servers/edit, servers/remove catalog writes by @cliffhall in #2581
• feat(scripts): script the release notes and Release creation (release:notes) by @cliffhall in #2591
• feat(cli): --output / --output-format raw|json to save a result to a file by @cliffhall in #2582
• feat(cli,tui): skills catalog budget flags (--skill-catalog-max-skills/--skill-catalog-max-bytes) by @cliffhall in #2587
• ci: replace the suspended DCO app with a signoff check we own by @cliffhall in #2603
• fix(tui): cap Protocol tab request/response bodies like the Network pane by @cliffhall in #2597
• fix(tui,web): handle a browser opener that cannot be spawned by @cliffhall in #2575
• feat(tui): copy values via OSC 52, with a save-to-file fallback (#2421) by @cliffhall in #2573
• feat(tui): add a / filter to the Tools, Resources, Prompts and Skills lists by @cliffhall in #2578
• feat(tui): w on the tool result view saves the result to a file by @cliffhall in #2594
• feat(tui): add a '?' keybinding help overlay by @cliffhall in #2592
• feat(tui): Tasks and Subscriptions tabs and a Roots editor by @cliffhall in #2599
• test(web): subscribe the fetch log before connecting in timeout-diagnostics (#2580) by @cliffhall in #2612
• feat(daemon-cli): mcpdo — experimental connection CLI client (#1432) by @BobDickinson in #1783
• fix(web): chain MRTR rounds when the server rotates requestState by @cliffhall in #2610
• ci: run the DCO check on every v2 PR now, before push, and after merge (#2616) by @cliffhall in #2619
• chore(core): promote the CLI surface mcpdo shares into core/cli (#2461) by @cliffhall in #2613
• feat(tui): verify the whole skills catalog with v, so the catalog budget applies by @cliffhall in #2620
• test(tui): stop parsing the wrapped frame for the saved-copy path by @cliffhall in #2626
• chore(release): 2.10.0 step 1 — audit, audit fixes, bump to 2.10.0 by @cliffhall in #2627
• fix(cli): complete servers/add|edit|remove and --output-format values by @cliffhall in #2634
• fix: v2.10.0 merge review findings — TUI error redaction, mcpdo daemon flush, CodeQL #78-#81 by @cliffhall in #2639
• ci: make DCO a required status check on v2/main (#2621) by @cliffhall in #2635
• fix: sweep table-cell escaping (CodeQL #74-#76) and document mcpdo's environment variables by @cliffhall in #2641
• chore(release): merge v2/main into main for v2.10.0 by @cliffhall in #2637

Full Changelog: 2.9.0...2.10.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.10.0

Thanks for helping us improve

This release addresses issues reported by these community members. Thank you for taking the time to file them:

• @CloneOfAlex (#2420, #2421, #2428, #2429, #2430, #2431, #2432, #2433, #2434, #2435, #2436, #2437, #2438)

What's Changed

• docs(pr-flow): make an exhaustive Copilot review loop the step after opening a PR by @cliffhall in #2466
• docs(pr-flow): assign the issue to yourself when work starts by @cliffhall in #2468
• fix(skills): require ttlMs and cacheScope on modern skills/get results by @cliffhall in #2469
• fix(skills): report a "dynamic" skill as unverifiable, not verified by @cliffhall in #2474
• fix(web): mask the tail of a form secret split by a raw & by @cliffhall in #2475
• fix(gate-lease): serve queued local:gate runs in arrival order by @cliffhall in #2476
• fix(core): advertise the MCP Apps UI extension only from a client that renders Apps by @cliffhall in #2471
• fix(remote): re-arm relay waits for string progress tokens by @cliffhall in #2478
• fix(cli): end the long-lived stream cleanly on EPIPE by @cliffhall in #2479
• docs(skills): get Copilot's testing → test-servers hand-off to 100% (#2459) by @cliffhall in #2477
• fix(tui): cap rendered request/response body lines by @cliffhall in #2480
• docs(pr-flow): make the In Progress / In Review card moves runnable, with a check by @cliffhall in #2472
• docs(pr-flow): read the issue and all its comments before starting work by @cliffhall in #2491
• fix(cli): redact URL query secrets in the error envelope by @cliffhall in #2488
• chore(smoke): run smoke:tui for real in GitHub CI by @cliffhall in #2489
• chore(deps): upgrade the MCP TypeScript SDK to 2.1.0 by @cliffhall in #2492
• fix(web): prompt a reconnect when custom headers change on a live connection by @cliffhall in #2493
• chore(scripts): fail fast when node_modules is older than its lockfile by @cliffhall in #2495
• fix(cli): bound the OAuth browser open and say when it fails by @cliffhall in #2499
• chore(tui): justify every exhaustive-deps suppression by @cliffhall in #2500
• test(launcher,cli): assert Windows backslash paths survive argv forwarding by @cliffhall in #2501
• fix(core): enforce one deadline per RequestInit in withOAuthRequestTimeout by @cliffhall in #2503
• fix(docker): derive the HEALTHCHECK probe address from HOST by @cliffhall in #2504
• chore(smoke): surface the app's connect error on a connect timeout by @cliffhall in #2505
• fix(scripts): fail the Dependabot sweep clearly on a bad alert listing by @cliffhall in #2502
• fix(auth): pin the AES-GCM auth tag length in FileSecretStore by @cliffhall in #2509
• ci: split the npm release job so install scripts never hold the OIDC token by @cliffhall in #2506
• fix(web): report the Inspector version as clientInfo.version by @cliffhall in #2511
• test: stop the useServers render loop and guard against its return by @cliffhall in #2513
• fix(docker): skip the web healthcheck probe under --cli/--tui by @cliffhall in #2510
• test(web): configure React's act environment and wrap the updates it exposes by @cliffhall in #2514
• SHA-pin the actions in credential-holding workflow jobs by @cliffhall in #2512
• feat(auth): store acquired OAuth tokens in the secret store; clobber-safe oauth.json writes by @BobDickinson in #2482
• docs: add MCP Inspector: Our AI Software Factory by @BobDickinson in #2498
• fix(deps): make @modelcontextprotocol/server-legacy a devDependency by @cliffhall in #2520
• chore(deps): upgrade the MCP TypeScript SDK to 2.2.0 by @cliffhall in #2526
• chore(deps): upgrade the MCP Apps extension SDK to 2.0.3 by @cliffhall in #2527
• chore(release): npm audit fixes and bump version to 2.9.0 by @cliffhall in #2529
• fix(cli): catch an opener that cannot be spawned instead of crashing by @cliffhall in #2534
• fix(core): redact a form secret's raw-& tail in recorded bodies by @cliffhall in #2535
• fix(cli): split trailing punctuation off redacted URLs in linear time by @cliffhall in #2541
• chore(release): merge v2/main into main for v2.9.0 by @cliffhall in #2536
• fix(ci): publish the tarball by a ./ path so npm reads it as a file by @cliffhall in #2552
• chore(release): merge v2/main into main for the v2.9.0 re-release (publish fix) by @cliffhall in #2553

Full Changelog: 2.8.0...2.9.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.9.0

Known issue

OAuth profiles that share a server can overwrite each other's tokens (#2549). If you use MCP_INSPECTOR_OAUTH_STATE_PATH to keep separate OAuth profiles against the same server, give each profile its own secret store too: set MCP_INSPECTOR_SECRET_STORE=file and a distinct MCP_INSPECTOR_SECRET_FILE per profile (or a per-profile MCP_STORAGE_DIR). The default single-profile setup is unaffected. A fix is planned for 2.10.0.

Thanks for helping us improve

This release addresses issues reported by these community members. Thank you for taking the time to file them:

• @CloneOfAlex (#2407, #2408, #2410, #2412, #2413, #2414, #2415, #2416, #2418, #2422, #2423, #2424, #2425)
• @GeeksikhSecurity (#2483, #2484, #2485)
• @imran-siddique (#2405)
• @lowlyocean (#2458)
• @oiuv (#2445)
• @Peter-Cumming (#2460)

What's Changed

• fix(web): only DANGEROUSLY_OMIT_AUTH=true/1 disables /api auth by @cliffhall in #2390
• fix: stamp Mcp-Method on modern-era notification POSTs by @cliffhall in #2392
• fix: detach the OIDC compat's normal-path body releases by @cliffhall in #2393
• fix: resolve local $refs before choosing form widgets (#2321) by @cliffhall in #2391
• feat: per-server setting to suppress the standalone GET notification stream by @cliffhall in #2394
• fix(core): reframe the type-union lint as a portability trade by @cliffhall in #2395
• docs: document read-only mcp.json interoperability for external tooling by @cliffhall in #2396
• Run skills:eval through the GitHub Copilot CLI by @cliffhall in #2398
• Make the testing → test-servers hand-off fire under Copilot on the pagination prompt by @cliffhall in #2402
• docs: re-align the H2 2026 roadmap with the published MCP roadmap and official extensions by @cliffhall in #2401
• chore: add the project LICENSE and point every manifest at it by @cliffhall in #2449
• docs: add the security-advisory skill, and reconcile the two rules it contradicts by @cliffhall in #2444
• feat: MCP_INSPECTOR_SECRET_KEY_FILE, and document secret storage for every runtime by @cliffhall in #2448
• docs(skills): stop board lookups from trusting item-list --limit by @cliffhall in #2452
• chore: bump version to 2.8.0 (release step 1) by @cliffhall in #2454
• chore(release): merge v2/main into main for v2.8.0 by @cliffhall in #2456

Full Changelog: 2.7.0...2.8.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.8.0

Thanks for helping us improve

This release addresses issues reported by these community members. Thank you for taking the time to file them:

• @aliengineering-byte (#1912)
• @Hritik003 (#2385)
• @mulezi1029 (#2321)
• @Navesz (#2406)
• @sbguangha (#2331)

What's Changed

• chore: bump the vitest trio to 4.1.11 past GHSA-82fw-gwwq-j7x9 by @cliffhall in #2315
• feat(test-servers): a CIMD showcase fixture that serves its own client metadata document by @cliffhall in #2307
• chore: land the #2247 round-9 review findings on v2/main by @cliffhall in #2322
• feat: bound every OAuth-path request with a deadline by @cliffhall in #2324
• fix: bold the labels, not the values, and give Connection Info's URLs full width by @cliffhall in #2329
• fix: exempt loopback hosts from the CIMD metadata URL HTTPS requirement by @cliffhall in #2326
• fix: state every test-gate timeout instead of inheriting a library default by @cliffhall in #2334
• fix: force the Storybook dep pre-bundle on every run (#2340) by @cliffhall in #2342
• chore: run each client's test suite once in local:gate, not twice by @cliffhall in #2343
• feat: queue concurrent local:gate runs on a machine-wide lease (#2339) by @cliffhall in #2344
• docs: record why maxWorkers stays unset, with the measurement (#2336) by @cliffhall in #2345
• chore: state the smoke-helper and CI wall-clock budgets (#2333) by @cliffhall in #2349
• chore: remove gate-lease.test.mjs temp directories after the suite by @cliffhall in #2351
• docs: stop justifying the asyncUtilTimeout pin by pointing at #2335 by @cliffhall in #2352
• fix: sample the SkillsScreen geometry only once the Frontmatter highlighter has landed by @cliffhall in #2353
• docs: correct two stale gate comments after #2354 (gate-lease MAX_WAIT_MS, main.yml table pointer) by @cliffhall in #2357
• docs: bring quality-gate.md up to date after #2338 and document the gate lease by @cliffhall in #2355
• chore(deps): bump ext-apps to 2.0.0 and drop the SDK-v1 shims by @cliffhall in #2358
• chore: refresh the stale ext-apps example in the sdk-watch comments by @cliffhall in #2361
• feat: bound connect attempts with a 30 s default connectionTimeout by @cliffhall in #2362
• fix: reset relay request-response waits on progress notifications (#2028) by @cliffhall in #2363
• docs: add an environment-variable reference by @cliffhall in #2366
• feat(core): report outstanding-request and notification-stream state on a request timeout (#2318) by @cliffhall in #2364
• fix: accept a path-less skill root URI in normalizeSkillUri by @cliffhall in #2368
• feat: add --protocol-era launch flag for ad-hoc servers by @cliffhall in #2372
• feat: make the skills verification catalog budget configurable per server (#2294) by @cliffhall in #2367
• fix: record an intercepted 401's status, headers and body in the network log by @cliffhall in #2371
• feat(web): configurable public addresses for the MCP Apps listeners by @cliffhall in #2370
• fix: report a gate-lease wait only when the run actually queued by @cliffhall in #2375
• Declare the skills extension in the Inspector's client capabilities by @cliffhall in #2374
• chore(release): bump to 2.7.0, audit clean, and fix sdk-watch suppression by @cliffhall in #2379
• feat(test-servers): stall an OAuth endpoint so #2319's timeouts can be driven by @cliffhall in #2383
• fix(test): AppRenderer theme flip — happy-dom drops GC'd MutationObserver callbacks by @cliffhall in #2386
• docs: pack:verify is not a local:gate stage — name it as its own release step by @cliffhall in #2387
• chore(release): merge v2/main into main for v2.7.0 by @cliffhall in #2381

Full Changelog: 2.6.0...2.7.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.7.0

Thanks for helping us improve

This release addresses issues reported by these community members. Thank you for taking the time to file them:

• @Avi-Jadhav03 (#2028)
• @eitansuez (#1862)
• @kraenhansen (#2208)
• @tulshi (#2297)

What's Changed

• fix(web): reset pending OAuth slots during render, not in an effect by @cliffhall in #2237
• fix: terminate the OAuth connection-details refresh promise chain by @cliffhall in #2236
• fix: key the OAuth clear's active-session check on the storage key by @cliffhall in #2238
• chore(deps): npm audit fix before release bump; monthly npm-outdated issue by @cliffhall in #2232
• chore(deps): remove dependabot.yml, fold action bumps into the monthly sweep by @cliffhall in #2239
• chore(deps): sweep Dependabot alerts into board-tracked issues by @cliffhall in #2243
• test(auth): make the revocation fixture a real form-urldecoder by @cliffhall in #2246
• chore(deps): refresh fast-uri, qs and browserslist to clear npm audit by @cliffhall in #2249
• feat(skills): measure a skill reached from another skill by @cliffhall in #2245
• fix(web): remove the wall-clock race in the import-JSON debounce guard test by @cliffhall in #2255
• fix(auth): floor the shared revocation budget instead of racing zero by @cliffhall in #2256
• feat: support the Skills extension (SEP-2640) with digest verification by @cliffhall in #2251
• chore: grant artifact-metadata:write to the GHCR publish job by @cliffhall in #2258
• fix: type-discriminate progress toast ids, and a CSPRNG fallback for newAttemptId by @cliffhall in #2259
• chore: widen verify:dep-lockstep to declared cross-install copies by @cliffhall in #2260
• Reshape the testing → test-servers pointer into an imperative step by @cliffhall in #2261
• fix: cap the re-auth banner width and move its flat CSS into the Paper theme by @cliffhall in #2266
• feat: refactor the Skills detail pane into collapsible sections with an internally-scrolling file viewer by @cliffhall in #2265
• feat: watch the MCP SDK nightly and file an upgrade issue by @cliffhall in #2268
• fix: swap the toast ref Set on teardown instead of clearing it by @cliffhall in #2267
• docs: specify screenshot capture width and Monitor sidebar width in /pr-flow by @cliffhall in #2271
• docs: rule that a wait is a notification, never a tight poll loop by @cliffhall in #2272
• docs: reply to each review comment in its own thread, not in a rollup comment by @cliffhall in #2273
• docs: add a reusable CLI smoke-testing guide for v2 by @cliffhall in #2275
• fix: send an empty-string pagination cursor verbatim on every list adapter by @cliffhall in #2277
• fix: decline a union branch requiring a name it never declares by @cliffhall in #2276
• fix: strip ANSI from TUI test frames so FORCE_COLOR cannot break assertions by @cliffhall in #2279
• fix: key resource list rows by position so duplicate URIs cannot collide by @cliffhall in #2281
• feat: seed the MCP org example server as a remote first-run card by @cliffhall in #2283
• feat(web): collapse the schema-portability section by default by @cliffhall in #2285
• fix: preserve CIMD registration provenance across SDK issuer binding by @cliffhall in #2287
• docs: ALLOWED_ORIGINS recipe for a *.localhost proxy by @cliffhall in #2290
• fix: report a terminal OAuth token-endpoint refusal instead of a dead retry by @cliffhall in #2288
• fix: two load-dependent Storybook flakes — SkillsScreen geometry and the Ace-worker wait by @cliffhall in #2291
• feat: Skills extension phase 3 — CLI methods, TUI pane, resources/directory/read, and the frontmatter cross-check by @cliffhall in #2293
• docs(release): make the two-PR flow, the production smoke, the ledger and the UI tag explicit by @cliffhall in #2299
• chore(release): audit, hono advisory fix, and bump to 2.6.0 by @cliffhall in #2302
• chore: merge v2/main for the v2.6.0 milestone release by @cliffhall in #2304

Full Changelog: 2.5.0...2.6.0
Smoke test ledger for milestone branch: v2/chore/milestone-merge-v2.6.0
SEP-2640 support added: Verifying Skills over MCP

Thanks for helping us improve

This release addresses issues reported by these community members. Thank you for taking the time to file them:

• @georgeatparallel (#2201)
• @Izelude (#2205)
• @jiezeng2004-design (#1886)
• @randy-s-shin (#2242)