inspector

Name: inspector
Author: MCPJam

Issues

Testing and evaluation platform to chat, inspect, and debug MCP servers, MCP apps, and ChatGPT apps.

2,172stars

271forks

TypeScript

Installation

# Add to your Claude Code skills
git clone https://github.com/MCPJam/inspector

Getting Started

Guides for using mcp servers skills like inspector.

Best MCP Servers in 2026
Category-by-category picks: databases, dev tools, productivity, browser automation.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills
First-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.

Security ReportIssues

Last scanned: 4/25/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@electron-forge/cli: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/core: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/core-utils: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/maker-base: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/maker-deb: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/maker-dmg: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/maker-rpm: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/maker-squirrel: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/maker-zip: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/plugin-base: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/plugin-fuses: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/plugin-vite: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/publisher-base: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/publisher-github: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/shared-types: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/template-base: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/template-vite: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/template-vite-typescript: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/template-webpack: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron-forge/template-webpack-typescript: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron/node-gyp: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@electron/rebuild: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@inquirer/editor: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@inquirer/prompts: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@tootallnate/once: @tootallnate/once vulnerable to Incorrect Control Flow Scoping",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@workos-inc/authkit-nextjs: authkit-nextjs may let session cookies be cached in CDNs",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@workos-inc/node: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "@xmldom/xmldom: xmldom: Uncontrolled recursion in XML serialization leads to DoS",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "cacache: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "electron: Electron: AppleScript injection in app.moveToApplicationsFolder on macOS",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "external-editor: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "hono: hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "http-proxy-agent: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "iron-session: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "make-fetch-happen: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mermaid: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "next: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "protobufjs: Arbitrary code execution in protobufjs",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "streamdown: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tmp: tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-04-25T05:51:05.482Z",
  "semgrepRan": false,
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Frequently Asked Questions

What is inspector?

inspector is an open-source mcp servers skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by MCPJam. Testing and evaluation platform to chat, inspect, and debug MCP servers, MCP apps, and ChatGPT apps. It has 2,172 GitHub stars.

Is inspector safe to use?

inspector failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.

How do I install inspector?

Clone the repository with "git clone https://github.com/MCPJam/inspector" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is inspector written in?

inspector is primarily written in TypeScript. It is open-source under MCPJam on GitHub, so you can review or fork the full source.

Are there alternatives to inspector?

Yes. SkillsLLM lists many other MCP Servers skills you can browse and compare side by side. Open the MCP Servers category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh inspector against similar tools.

MCP for Beginners

Build MCP servers that give AI assistants real capabilities

36 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

243,639

Popular in MCP Servers

Top skills in this category by stars

Scrapling

by D4Vinci

🕷️ An adaptive Web Scraping framework that handles everything from a single request to a full-scale crawl!

76,731

Unla mcp-router

MCPJam is the open-source testing & evaluations platform for MCP server developers who ship. Interactively test tools, prompts, resources, and authorization across 16 client configurations and 170+ models. Run evals on test cases, get insights on what's breaking, and gate regressions to secure every deployment.

🚀 Quick start

Open the hosted app. No install needed.

👉 app.mcpjam.com

... or run MCPJam locally for HTTP/S and local STDIO servers:

npx @mcpjam/inspector@latest

👋🏽 Why MCPJam

Clients like ChatGPT, Claude, and Cursor all read your server differently. MCPJam catches those differences, shows where your server breaks, and tells you how to fix it:

Inspect & debug: Explore your server's tools, resources, and prompts in one place. Test prompts from real LLMs, with full visibility & traces on every JSON-RPC message and OAuth exchange.
Cross-client evals: Score agent behavior across 16 client configurations — ChatGPT, Claude, Cursor, Copilot, and more — to understand how your MCP integrations perform across all users. Track accuracy, latency, and tool-call performance over time.
Security & reliability: Automate conformance & behavior checks in CI/CD to catch regressions before they reach production.

🔨 Features

Capability	What it does
Playground	Cross-client chat interface that emulates UIs, tool calls, and skills (with full traces). OpenAI Apps SDK and MCP app UIs, text tools, and a Chrome DevTools-style widget emulator. Read more
Chat	Multi-server chat on frontier models for free, or bring your own API key. Compare up to 3 models side by side. Read more
OAuth Debugger	Visualize your OAuth & EMA requests step-by-step to find the source of errors. Guided MCP OAuth conformance checks across protocol versions 03-26, 06-18, 11-25, and 2026-07-28; DCR, client pre-registration, and CIMD. Read more
Server Debugging	Manually run tools, resources, templates, prompts, and elicitation flows with full JSON-RPC logs.
Skills	Extend models with reusable behaviors in Chat and Playground. Local skills are read from your filesystem and never leave your machine; a project can also carry hosted skills, available on accounts where that is enabled. Read more
Workspaces	Shared server groups with real-time team sync, so everyone tests the same config. Read more
Evals	Test cases with expected tool calls, run across LLMs, with accuracy metrics over time. Read more
CLI	Probe servers, run doctor checks, exercise OAuth, and list tools/resources/prompts from your terminal. Read more
SDK	Programmatically drive inspections, snapshot capabilities, and assert on tool/resource shapes from your own tests. Read more
CI/CD	Run conformance, E2E tests, evals, and OAuth checks on every PR in GitHub Actions or any pipeline. Read more

Playground

Debug your server against a model using tool calls or in-panel chat, with Chat, Trace, and Raw views. Supports the OpenAI Apps SDK and MCP app UIs, text tools, and a Chrome DevTools-style widget emulator so you can iterate on widgets locally.

Invoke a tool to render its widget instantly, or drive your server with an LLM.
Watch all JSON-RPC and window.openai messages in the logs.
Switch the emulator between Desktop, Tablet, and Mobile.
Test locale changes, CSP permissions, light/dark mode, hover & touch, and safe-area insets.

Trace view: every tool call, agent step, and JSON-RPC message in one timeline.

Chat

Multi-server chat on frontier models for free, or bring your own API key. Chat, Trace, and Raw views; compare up to 3 models side by side and watch each server's token usage.

OAuth Debugger

Guided MCP OAuth conformance checks with step-by-step explanations. Test against every version of the OAuth spec (2025-03-26, 2025-06-18, 2025-11-25, and the 2026-07-28 draft), with support for client pre-registration, Dynamic Client Registration (DCR), and Client ID Metadata Documents (CIMD).

Server Debugging

Everything you need to test an MCP server by hand: run tools, resources, resource templates, prompts, and elicitation flows with full JSON-RPC observability. Every feature of the original inspector, and more.

Skills

Use Skills in Chat and Playground to extend models with reusable behaviors. Local skills are read from your filesystem and never leave your machine; a project can also carry hosted skills, available on accounts where that is enabled. Read more

Workspaces

Group servers into shared workspaces with real-time team sync, so everyone on your team tests against the same configuration. Read more

Evals

Define test cases with expected tool calls and run them across multiple LLMs. Track accuracy over time to catch regressions early and improve your server with every iteration. Read more

CLI

Run MCPJam from the terminal for fast local dev loops and CI. Probe servers, run OAuth checks, inspect tools and resources, and execute evals without leaving your shell. Read more

SDK

Programmatic access to MCPJam for custom tooling, scripting, and integrations. Build your own workflows on top of MCPJam's inspection and evaluation primitives. Read more

CI/CD

Wire MCPJam into GitHub Actions, GitLab CI, or any CI system to run conformance, E2E tests, and evals on every PR — and catch MCP server regressions before they ship. Read more

🔌 Install

MCPJam Inspector runs three ways: a hosted web app, a desktop app for Mac and Windows, or via your terminal. The web app is HTTPS-only and has no install. Terminal and Desktop support HTTP/S and local STDIO servers.

Node.js 20+ is only required for the terminal install (npx). The hosted and desktop apps have no local runtime requirements.

Hosted web app: Open app.mcpjam.com. No install, always latest, and you can share server links with teammates like a Google Doc. HTTPS server URLs only; no STDIO, tunneling, skills, or tasks (those need the local inspector). Hosted docs

Desktop app: Download the installer. Supports HTTP/S and local STDIO, no Node.js required. Install Mac · Install Windows

Terminal: Supports HTTP/S and local STDIO. Open the printed localhost URL after it starts.

npx @mcpjam/inspector@latest

Docker: There is no published image, so build one from source first. Bound to localhost for security. Available at http://127.0.0.1:6274. Always use -p 127.0.0.1:6274:6274 (not -p 6274:6274) to keep the inspector