MCP Inspector
This action sends data to the server
Why: MCP traffic goes directly from your browser to the MCP server. If the browser blocks the request with a CORS error, the inspector automatically retries through this app's server-side /api/proxy (Node.js), which is not subject to browser same-origin restrictions. A 'CORS fallback' badge (orange) appears when this happens; a 'via proxy' badge (cyan) appears when you explicitly chose Via Server Proxy.
Sent to the server:
- MCP server URL
- Custom headers you configured (including any Authorization / Bearer tokens)
- OAuth Access Token (sent as Authorization: Bearer header)
- JSON-RPC 2.0 payload: versioned server/discover or legacy initialize, tools/list discovery, tools/call with your arguments
- SSL/TLS fields when configured (CA bundle, client cert, client key — used server-side only)
Data handling: the server relays this request to your target and returns its response; the target receives the fields above.
This app does not log, trace or save request/response payloads or uploaded files on its server. External APIs and storage providers apply their own retention policies; this app cannot delete their copies.
To keep traffic 100% in-browser: configure your MCP server with
Access-Control-Allow-Origin: * and Access-Control-Allow-Headers: Content-Type, Authorization. Direct browser fetch will then succeed and no proxy badges will appear.Audit the source: src/app/api/proxy/route.ts
Connection
Tools
History
Disconnected
Standards, sources and review dates
- MCP · 2026-07-28 + explicit legacy · Reviewed
HTTP JSON-RPC discovery, tool listing/calls; legacy initialize lifecycle. Not a full conformance suite. Review interval: 7 days.