Issues

• Web: concurrent OAuth flows to the same server overwrite each other's PKCE verifier (shared oauth.json keyed by server URL)

  modelcontextprotocol/inspector#2726 · Filter by author AyRickk opened on Oct 16, 2026

• EMA leg 3 requires a resource-AS client secret, which blocks public clients the redeem already supports

  modelcontextprotocol/inspector#2725 · Filter by author ferentinai opened on Oct 16, 2026
  1

• insufficient_scope challenge retry doesn't detect expired access token, gives up after one identical retry

  bug
  modelcontextprotocol/inspector#2724 · Filter by author danpatsey opened on Oct 14, 2026
  3

• TUI tests append to the developer's real ~/.mcp-inspector/auth.log (App.test.tsx mounts the real getTuiLogger)

  modelcontextprotocol/inspector#2723 · Filter by author nosmile99 opened on Oct 14, 2026
  1

• Modern subscriptions: a subscriptions/listen refused with HTTP 403 is retried eight times in silence

  bugv2
  modelcontextprotocol/inspector#2722 · Filter by author cliffhall opened on Oct 14, 2026 · v2.12.0
  1

• Protocol tab leaves a request PENDING when the server denies it with a bare HTTP 403

  bugv2
  modelcontextprotocol/inspector#2721 · Filter by author cliffhall opened on Oct 14, 2026 · v2.12.0
  2

• CLI tests write the developer's real ~/.mcp-inspector OAuth state file (oauth-runner, programmatic-ergonomics)

  bugv2
  modelcontextprotocol/inspector#2719 · Filter by author cliffhall opened on Oct 14, 2026 · v2.12.0

• CI installs with npm 10, so the allowScripts denials from #2712 do not apply there

  chorev2
  modelcontextprotocol/inspector#2715 · Filter by author cliffhall opened on Oct 13, 2026 · v2.12.0

• [v2] Per-tool call and log history in the web UI

  enhancementv2
  modelcontextprotocol/inspector#2705 · Filter by author cliffhall opened on Oct 12, 2026 · v2.12.0

• A stripped stamp re-adopted on a different secret-store backend still loses what only the old backend held

  bugv2
  modelcontextprotocol/inspector#2672 · Filter by author cliffhall opened on Oct 12, 2026 · v2.12.0
  1

• docs: record retroactive DCO signoffs for the 10 unsigned commits on v2/main

  documentationv2
  modelcontextprotocol/inspector#2617 · Filter by author cliffhall opened on Oct 7, 2026 · v2.12.0
  2

  

• Board the SDK watch and monthly dependency-refresh issues with the GitHub App token

  blockedchorev2
  modelcontextprotocol/inspector#2548 · Filter by author cliffhall opened on Sep 30, 2026 · v2.12.0
  1

• Move the Dependabot alert sweep from the nonexistent PROJECT_TOKEN to the GitHub App token

  blockedchorev2
  modelcontextprotocol/inspector#2547 · Filter by author cliffhall opened on Sep 30, 2026 · v2.12.0
  1

• Scan v2/main with CodeQL: switch from default setup to a committed advanced-setup workflow

  chorev2
  modelcontextprotocol/inspector#2545 · Filter by author cliffhall opened on Sep 30, 2026 · v2.12.0
  1

• Create the GitHub App for board writes and security-alert reads, and store its credentials as org secrets

  chorev2
  modelcontextprotocol/inspector#2544 · Filter by author cliffhall opened on Sep 30, 2026 · v2.12.0
  1

• Tracker: security and board automation on a GitHub App credential

  chorev2
  modelcontextprotocol/inspector#2543 · Filter by author cliffhall opened on Sep 30, 2026 · v2.12.0
  1

• Nightly security sweep: turn Dependabot and code-scanning (CodeQL) alerts into board-tracked issues

  blockedchorev2
  modelcontextprotocol/inspector#2542 · Filter by author cliffhall opened on Sep 30, 2026 · v2.12.0
  1

• Nightly triage: sweep unboarded issues onto the board and run the board audit

  blockedchorev2
  modelcontextprotocol/inspector#2463 · Filter by author cliffhall opened on Sep 23, 2026 · v2.12.0
  3

• GHSA draft cards: place on the board for the affected line, and include affected versions + reporter

  blockedchorev2
  modelcontextprotocol/inspector#2462 · Filter by author cliffhall opened on Sep 23, 2026 · v2.12.0
  3

  

• Add HTTPS/TLS support for the Inspector web listener

  enhancementv2
  modelcontextprotocol/inspector#2446 · Filter by author steventamm opened on Sep 22, 2026 · v2.12.0
  3

• [Discussion] Proactively detect and surface server-side rate limiting

  questionv2
  modelcontextprotocol/inspector#2442 · Filter by author CloneOfAlex opened on Sep 18, 2026 · v2.12.0
  1

• [Discussion] Semantic/fuzzy tool search instead of exact-substring filtering

  questionv2
  modelcontextprotocol/inspector#2440 · Filter by author CloneOfAlex opened on Sep 18, 2026 · v2.12.0
  1

• [Discussion] Built-in load/concurrency test mode for stress-testing MCP servers

  questionv2
  modelcontextprotocol/inspector#2439 · Filter by author CloneOfAlex opened on Sep 18, 2026 · v2.12.0
  1

• Drop the ext-apps#733 elicitation mirrors when the package ships a release containing it

  choremcp-appsv2waiting on sdk
  modelcontextprotocol/inspector#2360 · Filter by author cliffhall opened on Sep 13, 2026 · v2.12.0
  4

• Optional Tool Outcome Attestation (TOA) verify gate for MCP CI / promote / register

  questionv2
  modelcontextprotocol/inspector#2198 · Filter by author AgentStatus-Dev opened on Aug 30, 2026 · v2.12.0
  1