chore(deps): update dependency @modelcontextprotocol/inspector to v2

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@modelcontextprotocol/inspector	^0.22.0 → ^2.0.0

---

Release Notes

modelcontextprotocol/inspector (@​modelcontextprotocol/inspector)

v2.1.0

Compare Source

What's Changed

• docs: restore SECURITY.md, lost in the v2 tree swap by @​cliffhall in #​1843
• fix(core): mirror SEP-2243 x-mcp-header args to Mcp-Param-* on tools/call by @​SamMorrowDrums in #​1847
• docs: post-swap branch model, PR policy, milestone rule, and Copilot review instructions by @​cliffhall in #​1866
• docs: converge README Test servers section with main's restructure by @​cliffhall in #​1880
• docs: rename CONTRIBUTORS.md to CONTRIBUTING.md so GitHub surfaces the policy by @​cliffhall in #​1884
• docs: unpin the branch-pinned CONTRIBUTORS.md links in the PR template by @​cliffhall in #​1879
• docs: restore SECURITY.md on v2/main, so the next tree swap can't drop it by @​cliffhall in #​1867
• ci: restore the Claude Code workflow and .mcp.json, lost in the v2 tree swap by @​cliffhall in #​1869
• chore: restore repo files dropped by the v2 tree swap by @​cliffhall in #​1871
• chore(deps): bring main's rc-series bumps to v2/main (@​hono/node-server 2.x, vite 8.1.5) by @​cliffhall in #​1881
• fix(scripts): await the pack:verify web child's exit before removing its work dir by @​cliffhall in #​1895
• docs: add Incoming to both boards, adopt the v2 Priority field, and document the triage rubric by @​cliffhall in #​1892
• docs: replace the markdown bug template with GitHub issue forms by @​cliffhall in #​1894
• chore(deps): untangle the vitest/Storybook exact-pin knot to clear GHSA-p63j-vcc4-9vmv by @​cliffhall in #​1899
• chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory by @​cliffhall in #​1900
• chore: merge v2/main for the v2.1.0 milestone release by @​cliffhall in #​1903

New Contributors

• @​SamMorrowDrums made their first contribution in #​1847

Full Changelog: modelcontextprotocol/inspector@2.0.0...2.1.0

v2.0.0

Compare Source

The v2 Inspector is now the default release.

npx @modelcontextprotocol/inspector          # web UI
npx @modelcontextprotocol/inspector --cli    # CLI
npx @modelcontextprotocol/inspector --tui    # TUI

What's new

v2 ships as a single package with three clients — a Vite + React + Mantine web UI, a scriptable CLI, and an Ink-based TUI — over a shared @inspector/core runtime, so all three behave identically.

Upgrading from v1

• Node >= 22.19.0 is now required (was >= 22.7.5).
• CLI flags changed substantially. In particular --config now means a read-only session file; --catalog is the writable server list. See MCP server configuration.
• The v1 sub-packages (inspector-client, inspector-server, inspector-cli) are deprecated and not part of v2 — v2 publishes a single package.

v1

v1 is deprecated and receives security fixes only, published under the v1-latest tag:

npm i @modelcontextprotocol/inspector@v1-latest

v1.0.1: — v1 deprecated

Compare Source

v1 is deprecated. Use @​modelcontextprotocol/inspector@​latest (v2). v1 receives security fixes only.

v1.0.0

Compare Source

Versioning Note

Since this should be the last release of the classic MCP Inspector, it is finally being promoted to 1.0.0, primarily so that it can be referred to as the V1 implementation. It fixes outstanding security warnings and includes a couple of bug fixes.

Along with the release of the the upcoming 2026-07-28 MCP specification, we will be publishing an entirely new Inspector with a completely different codebase. The V2 web-based inspector client, the CLI, and a new TUI — all of which have a shared code architecture — will all ship as a single npm package. The V1 Inspector package will be officially deprecated at that time, and no further work will be done on that line.

What's Changed

• fix: call tasks/result when task status is input_required by @​galagaevdc in #​1174
• Fix resource refresh button not triggering re-fetch by @​olaservo in #​1148
• chore: pin prettier to 3.9.5 and run format check after install by @​cliffhall in #​1716
• chore(deps): bump vitest to ^4.1.0 (CVE fix) by @​cliffhall in #​1707
• chore(deps): bump vite to ^7.3.5 (CVE fixes) by @​cliffhall in #​1709
• chore(deps): bump shell-quote to ^1.8.4 (CVE fix) by @​cliffhall in #​1711
• chore(deps): override hono to ^4.12.25 (CVE fixes) by @​cliffhall in #​1708
• chore(deps): override form-data to ^4.0.6 (CVE fix) by @​cliffhall in #​1710
• chore(deps): override @​babel/core to ^7.29.6 (CVE fix) by @​cliffhall in #​1712
• chore(deps): finalize security overrides and regenerate lockfile by @​cliffhall in #​1718
• fix(server): guard the /fetch proxy against SSRF to link-local/metadata (alert 53) by @​cliffhall in #​1717
• Bump to version 1.0.0 by @​cliffhall in #​1720

New Contributors

• @​galagaevdc made their first contribution in #​1174

Full Changelog: modelcontextprotocol/inspector@0.22.0...1.0.0

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Sunday and Saturday (* 0-6 * * 6,0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.