▸ Agent Skills
7 min read

Documentation Index

Fetch the complete documentation index at: https://modelcontextprotocol.io/llms.txt Use this file to discover all available pages before exploring further.

Configuration and flags

Catalog vs. config files, which client owns which flag, and every environment variable

The mcp-inspector binary is a launcher: it reads two flags of its own and forwards every other argument to one of three clients (web, CLI, or TUI). Each client defines its own flags, so a flag that works in one can be unknown to another (--method, for example, is CLI-only). This page groups flags and environment variables by the client that owns them.

The launcher owns exactly two things

FlagBehavior
--web / --cli / --tuiSelects the client, --web by default. Passing more than one fails with Specify at most one of --web, --cli, or --tui. Launcher flags must come first: parsing stops at the first argument the launcher does not own, and everything from that point on is forwarded to the client unchanged.
-h / --helpWith no mode flag, prints the launcher’s own help and exits. With a mode flag it is forwarded, so mcp-inspector --cli --help prints the CLI’s help.

Everything below belongs to a client.

Choosing servers

--catalog vs. --config

All three clients resolve --catalog and --config through the same shared code, so each flag behaves the same in the web app, the CLI, and the TUI. Where the two differ from each other is the table below.

--catalog <path>--config <path>
Writable?Yes, the Inspector’s own server list.No. Served as-is, never written, seeded, or migrated.
Missing file?Created and seeded (see below).Errors.
Default~/.mcp-inspector/mcp.json, or the MCP_CATALOG_PATH environment variable.None; you must pass it.
Editable in the web UI?Yes.No.
Use it forYour own working set of servers.A read-only session against someone else’s config file.

The two are mutually exclusive, and neither combines with an ad-hoc target. Passing both is rejected identically by all three clients.

<Note> What a freshly seeded catalog contains depends on the client. The web backend seeds two sample servers, so a first launch has something to connect to immediately:

{
  "mcpServers": {
    "filesystem-server-default": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
    },
    "everything-server-default": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-everything"]
    }
  }
}

The CLI and TUI seed an empty { "mcpServers": {} } instead: they are non-interactive or list-driven, so sample entries would be noise rather than a starting point.

Either way, seeding happens only when the file does not exist yet, and a read-only --config is never seeded at all.

<Note> --config is what you want when pointing the Inspector at a config file you didn’t write: a coworker’s, a client application’s, or one checked into a repo. It guarantees the Inspector will not touch the file.

Ad-hoc targets

Instead of a file you can name one server directly, either as a positional command (stdio) or a URL:

mcp-inspector node build/index.js                              # stdio, positional
mcp-inspector --server-url https://api.example.com/mcp --transport http

Shared server-selection flags

Defined separately by each of web, CLI, and TUI, so they’re available in all three, with the divergences noted:

FlagMeaningDivergence
--catalog <path>Writable catalog file.None
--config <path>Read-only session file.None
--server <name>Pick one named server out of the file.Web and CLI only. The TUI loads every server in the file and lets you choose interactively.
--transport <type>stdio, sse, or http.Ad-hoc targets only.
--server-url <url>Server URL for SSE/HTTP.Ad-hoc targets only.
--cwd <path>Working directory for a stdio server process.None
-e <KEY=VALUE>Environment variables for a stdio server. Repeatable.None
--header "Name: Value"HTTP headers for an HTTP/SSE server. Repeatable.Requires an ad-hoc HTTP/SSE server on the web client.
[target...]Positional command/URL for one ad-hoc server.None

The -- separator

The web and CLI clients split their arguments at a bare -- and pass everything after it to the target command as its own arguments. This is how you pass a flag that the Inspector would otherwise eat:

mcp-inspector node build/index.js -- --config /etc/myserver.conf --verbose

Without the separator, --config would be read as the Inspector’s own read-only-session flag.

Web-only flags

FlagMeaning
--devRun the Vite dev server instead of the pre-built bundle. Useful when working on the Inspector itself.

CLI and TUI: OAuth client flags

These five are defined by the CLI and TUI only. The web client obtains the same settings through its Client Settings dialog.

FlagEnvironment variableMeaning
--client-config <path>MCP_CLIENT_CONFIG_PATHInstall-level client config. Default ~/.mcp-inspector/storage/client.json.
--client-id <id>NoneOAuth client ID for a static client. Overrides client.json.
--client-secret <secret>NoneOAuth client secret for confidential clients. Overrides client.json.
--client-metadata-url <url>NoneCIMD metadata URL. Overrides client.json.
--callback-url <url>MCP_OAUTH_CALLBACK_URLThe redirect URI sent to the authorization server. Default http://127.0.0.1:6276/oauth/callback. Must be a loopback host (127.0.0.1 or localhost): the local callback listener receives the authorization code over plaintext http, so any other host is rejected and there is no flag to override this.

CLI-only flags

The whole scripting surface belongs to the CLI. See CLI client for usage.

GroupFlags
What to invoke--method, --tool-name, --tool-arg, --tool-args-json, --uri, --prompt-name, --prompt-args, --log-level, --metadata, --tool-metadata
How to run it--connect-timeout, --format, --app-info
Auth--use-stored-auth, --stored-auth-only, --relogin, --wait-for-auth, --list-stored-auth, --print-handoff

Environment variables

Environment variables split the same way as flags: two are read by the launcher itself, and the rest belong to the CLI and TUI or to the web backend.

Read by the launcher

VariableEffect
MCP_DEBUGAppend the error stack to a top-level failure. Only when set to a meaningful value: 0, false, and empty read as off.
DEBUGSame, with the same meaningful-value rule, so a stray DEBUG=0 doesn’t turn stack traces on and DEBUG still works as the npm debug package’s namespace filter.

CLI and TUI

VariableEffect
MCP_CATALOG_PATHFallback for --catalog. Honored only when no ad-hoc target is given, so a shell that exports it can still run one-off ad-hoc invocations.
MCP_CLIENT_CONFIG_PATHFallback for --client-config.
MCP_OAUTH_CALLBACK_URLFallback for --callback-url.
MCP_STORAGE_DIRDirectory for the OAuth state file (<dir>/oauth.json).
MCP_INSPECTOR_OAUTH_STATE_PATHPer-file override of the OAuth state path. Takes precedence over MCP_STORAGE_DIR.
MCP_AUTO_OPEN_ENABLEDControls browser auto-open and whether interactive OAuth may run without a TTY. true forces auto-open and allows OAuth prompts without a TTY, false never opens, and unset opens only on a TTY.

Web backend environment variables

VariableEffect
MCP_INSPECTOR_API_TOKENPin the session token instead of generating a random one per launch.
DANGEROUSLY_OMIT_AUTHDisable the /api/* token check entirely.
HOSTBind host. Defaults to localhost.
CLIENT_PORTWeb UI port. Defaults to 6274.
DANGEROUSLY_BIND_ALL_INTERFACESRequired opt-in to bind a wildcard host (0.0.0.0, ::, or any equivalent spelling).
ALLOWED_ORIGINSComma-separated origin allow-list. Replaces the default list rather than merging.
MCP_SANDBOX_PORTPin the MCP Apps sandbox port, which is dynamic by default.
HTTPS_PROXY / HTTP_PROXY / NO_PROXYStandard proxy routing for outbound MCP connections.

<Warning> Never combine DANGEROUSLY_OMIT_AUTH and DANGEROUSLY_BIND_ALL_INTERFACES. The web backend spawns processes and holds OAuth tokens, so anyone who can reach it can drive it.

Catalog file format

A catalog or config file is the familiar MCP client config shape (a mcpServers object) with per-server Inspector settings alongside:

{
  "mcpServers": {
    "my-stdio-server": {
      "command": "node",
      "args": ["build/index.js"],
      "env": { "API_KEY": "..." }
    },
    "my-modern-server": {
      "type": "http",
      "url": "https://api.example.com/mcp",
      "protocolEra": "modern",
      "modernLogLevel": "info",
      "headers": { "X-Tenant": "acme" },
      "roots": [{ "uri": "file:///Users/me/project", "name": "project" }]
    }
  }
}

Fields that equal their default are omitted when the Inspector writes the file back, keeping diffs minimal. protocolEra (see Protocol eras) defaults to legacy and modernLogLevel to debug.

You do not have to hand-write these; the web client can import an existing client config from Claude Desktop, Cursor, Cline, or VS Code, or a registry server.json.


Last updated Oct 08, 2026