Security Policy
August 1, 2026 · View on GitHub
Thank you for helping keep the Model Context Protocol and its ecosystem secure.
Supported Versions
| Version | Package | Support |
|---|---|---|
| 2.x | @modelcontextprotocol/inspector | ✅ Actively supported |
| 1.x | @modelcontextprotocol/inspector | ⚠️ Security fixes only, published under v1-latest |
| 1.x | @modelcontextprotocol/inspector-client | ⚠️ Security fixes only |
| 1.x | @modelcontextprotocol/inspector-server | ⚠️ Security fixes only |
| 1.x | @modelcontextprotocol/inspector-cli | ⚠️ Security fixes only |
| < 1.0.0 | any | ❌ Unsupported |
v2 ships as a single package — @modelcontextprotocol/inspector. The three
inspector-client / inspector-server / inspector-cli sub-packages exist only
on the v1 line and are deprecated.
v1 development happens on the v1/main branch and is limited to security fixes.
Those releases are published under the v1-latest dist-tag so they never
displace the current v2 release:
npm i @modelcontextprotocol/inspector@v1-latest
Everything else — features, bug fixes, improvements — lands in v2 only.
Reporting Security Issues
If you discover a security vulnerability in this repository, please report it through the GitHub Security Advisory process for this repository. Private vulnerability reporting is enabled, so this is the fastest route to a maintainer.
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Note that this repository does not accept pull requests from outside contributors (see CONTRIBUTING.md) — this does not apply to security reports, which should always go through the advisory process above rather than any public channel.
What to Include
To help us triage and respond quickly, please include:
- A description of the vulnerability
- Steps to reproduce the issue
- The potential impact
- Whether it affects v2, v1, or both
- Any suggested fixes (optional)